phantom_stealer | d8a05deefe97c6bbe1e083e9d8a182e6b6e5fbc77af483d2cdef0b4cadec22ce

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pdh.dll
Size 4.4MB
Sample260424-jafxhabv21
SHA256 d8a05deefe97c6bbe1e083e9d8a182e6b6e5fbc77af483d2cdef0b4cadec22ce
MD5 ff185b05b231eed98d33239f1b202241
SHA1 fa12ecc7f62ab4af572a2ff261ff7c88f525bfe6
SHA512 47d90ab9aa0d2cfe0d5756cdf38464d9c57b71b84b870ae596fb764ef9552b9ac450fc9dc4b38a4e3ded326b33715e5d0db3434fff48d7a809e7f80c82c1e034
SSDEEP 98304:j87K9q2QTS2cvDVu8lPs/4jXISObkpXsd5KPiba4jkwUoyETGUJGYSBKshieGdXS:qKuGu8lxXfJXsKab5L1shih0
TLSH
T15926BF06B7D40995D11BCA34CA1BE332C2B2B9650A36D2CB1965E74B2FB3F914F3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery phantom_stealer persistence stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.taikei-rmc-co.biz
Port
587
Username
[email protected]
Password
e9*w}o;Gm5Zh_2Oc

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
mail.taikei-rmc-co.biz
Port
587
Username
[email protected]
Password
e9*w}o;Gm5Zh_2Oc
Email to
[email protected]

Mutex

P97KH92W6NXUNLKT9UBI

Attributes

anti_analysis
0
cb_enables_ssl
1
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 1 IoCs

resource	yara_rule
behavioral3/memory/4256-0-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

Executes dropped EXE 1 IoCs

pid	Process
4860	rundll32.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RasManSvc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RasManagement\\rundll32.exe\""	rundll32.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
208	icanhazip.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4512 set thread context of 4256	4512	rundll32.exe	84

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2516	chrome.exe
5356	msedge.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	jsc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	jsc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134214917941832681"	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
4256	jsc.exe
4256	jsc.exe
4256	jsc.exe
1696	chrome.exe
1696	chrome.exe
4256	jsc.exe
4256	jsc.exe
4256	jsc.exe
4256	jsc.exe
4256	jsc.exe
4256	jsc.exe
4256	jsc.exe
4256	jsc.exe
4256	jsc.exe
5664	firefox.exe
5664	firefox.exe
5664	firefox.exe
5664	firefox.exe
5664	firefox.exe
5664	firefox.exe
5664	firefox.exe
5664	firefox.exe
5664	firefox.exe
5664	firefox.exe
5664	firefox.exe
5664	firefox.exe
5664	firefox.exe
5664	firefox.exe
5664	firefox.exe
5664	firefox.exe
5664	firefox.exe
5664	firefox.exe
5664	firefox.exe
5664	firefox.exe
4256	jsc.exe
4256	jsc.exe
4256	jsc.exe
4256	jsc.exe
4256	jsc.exe
4256	jsc.exe
4256	jsc.exe
4256	jsc.exe
4256	jsc.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	4256	jsc.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
1696	chrome.exe
1696	chrome.exe
228	chrmstp.exe
5664	firefox.exe
5664	firefox.exe
5664	firefox.exe
5664	firefox.exe
5664	firefox.exe
5664	firefox.exe
5664	firefox.exe
5664	firefox.exe
1048	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5664	firefox.exe
4256	jsc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4256	4512	rundll32.exe	84
PID 4512 wrote to memory of 4256	4512	rundll32.exe	84
PID 4256 wrote to memory of 1696	4256	jsc.exe	86
PID 1696 wrote to memory of 616	1696	chrome.exe	87
PID 4256 wrote to memory of 1696	4256	jsc.exe	86
PID 4256 wrote to memory of 1696	4256	jsc.exe	86
PID 4256 wrote to memory of 616	4256	jsc.exe	87
PID 4256 wrote to memory of 616	4256	jsc.exe	87
PID 1696 wrote to memory of 4888	1696	chrome.exe	88
PID 1696 wrote to memory of 2516	1696	chrome.exe	89
PID 1696 wrote to memory of 5084	1696	chrome.exe	90
PID 1696 wrote to memory of 4776	1696	chrome.exe	91
PID 1696 wrote to memory of 2072	1696	chrome.exe	92
PID 1696 wrote to memory of 4692	1696	chrome.exe	93
PID 1696 wrote to memory of 3508	1696	chrome.exe	94
PID 1696 wrote to memory of 1740	1696	chrome.exe	95
PID 1696 wrote to memory of 3544	1696	chrome.exe	96
PID 4256 wrote to memory of 1696	4256	jsc.exe	86
PID 4256 wrote to memory of 1696	4256	jsc.exe	86
PID 4256 wrote to memory of 616	4256	jsc.exe	87
PID 4256 wrote to memory of 616	4256	jsc.exe	87
PID 1696 wrote to memory of 2308	1696	chrome.exe	110
PID 4256 wrote to memory of 3544	4256	jsc.exe	96
PID 4256 wrote to memory of 1740	4256	jsc.exe	95
PID 4256 wrote to memory of 4692	4256	jsc.exe	93
PID 4256 wrote to memory of 4692	4256	jsc.exe	93
PID 4256 wrote to memory of 5084	4256	jsc.exe	90
PID 4256 wrote to memory of 5084	4256	jsc.exe	90
PID 4256 wrote to memory of 2516	4256	jsc.exe	89
PID 4256 wrote to memory of 2516	4256	jsc.exe	89
PID 4256 wrote to memory of 2308	4256	jsc.exe	110
PID 4256 wrote to memory of 2308	4256	jsc.exe	110
PID 4256 wrote to memory of 1696	4256	jsc.exe	86
PID 4256 wrote to memory of 1696	4256	jsc.exe	86
PID 4256 wrote to memory of 2072	4256	jsc.exe	92
PID 4256 wrote to memory of 2072	4256	jsc.exe	92
PID 4256 wrote to memory of 3508	4256	jsc.exe	94
PID 4256 wrote to memory of 3508	4256	jsc.exe	94
PID 4256 wrote to memory of 4888	4256	jsc.exe	88
PID 4256 wrote to memory of 4888	4256	jsc.exe	88
PID 4256 wrote to memory of 616	4256	jsc.exe	87
PID 4256 wrote to memory of 616	4256	jsc.exe	87
PID 4256 wrote to memory of 3544	4256	jsc.exe	96
PID 4256 wrote to memory of 3544	4256	jsc.exe	96
PID 4256 wrote to memory of 1740	4256	jsc.exe	95
PID 4256 wrote to memory of 1740	4256	jsc.exe	95
PID 4256 wrote to memory of 4692	4256	jsc.exe	93
PID 4256 wrote to memory of 4692	4256	jsc.exe	93
PID 4256 wrote to memory of 5084	4256	jsc.exe	90
PID 4256 wrote to memory of 5084	4256	jsc.exe	90
PID 4256 wrote to memory of 2516	4256	jsc.exe	89
PID 4256 wrote to memory of 2516	4256	jsc.exe	89
PID 4256 wrote to memory of 1696	4256	jsc.exe	86
PID 4256 wrote to memory of 1696	4256	jsc.exe	86
PID 4256 wrote to memory of 2072	4256	jsc.exe	92
PID 4256 wrote to memory of 2072	4256	jsc.exe	92
PID 4256 wrote to memory of 3508	4256	jsc.exe	94
PID 4256 wrote to memory of 3508	4256	jsc.exe	94
PID 4256 wrote to memory of 4888	4256	jsc.exe	88
PID 4256 wrote to memory of 4888	4256	jsc.exe	88
PID 4256 wrote to memory of 616	4256	jsc.exe	87
PID 4256 wrote to memory of 616	4256	jsc.exe	87
PID 1696 wrote to memory of 5340	1696	chrome.exe	128
PID 1696 wrote to memory of 5484	1696	chrome.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\pdh.dll,#1
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4256
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff80c0c728,0x7fff80c0c734,0x7fff80c0c740
      4⤵
      PID:616
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1928,i,9557938548887449569,15760800402924415561,262144 --field-trial-handle=2232,i,16471251634074305091,7965881513937980486,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
      4⤵
      PID:4888
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz" --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,13927369573802651552,14916515524718130260,524288 --field-trial-handle=2232,i,16471251634074305091,7965881513937980486,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
      4⤵
      System Time Discovery
      PID:2516
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz" --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,15010085504848146126,8606738256444178999,524288 --field-trial-handle=2232,i,16471251634074305091,7965881513937980486,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:8
      4⤵
      PID:5084
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3084,i,2277848201115494557,15446195938266869634,2097152 --field-trial-handle=2232,i,16471251634074305091,7965881513937980486,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:1
      4⤵
      PID:4776
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3088,i,18031819946425152207,188375834144797308,2097152 --field-trial-handle=2232,i,16471251634074305091,7965881513937980486,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:1
      4⤵
      PID:2072
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3396,i,7261307085268408777,16626139242176332913,2097152 --field-trial-handle=2232,i,16471251634074305091,7965881513937980486,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
      4⤵
      PID:4692
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3416,i,5030657231811872375,1259851514321353791,2097152 --field-trial-handle=2232,i,16471251634074305091,7965881513937980486,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:2
      4⤵
      PID:3508
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4232,i,8571278886614201064,16967566381287314381,2097152 --field-trial-handle=2232,i,16471251634074305091,7965881513937980486,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
      4⤵
      PID:1740
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4324,i,5261778237479772339,8340072020850881543,2097152 --field-trial-handle=2232,i,16471251634074305091,7965881513937980486,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:2
      4⤵
      PID:3544
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz" --force-high-res-timeticks=disabled --metrics-shmem-handle=4424,i,11306406082166622639,6910249397787235788,524288 --field-trial-handle=2232,i,16471251634074305091,7965881513937980486,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
      4⤵
      PID:2308
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz" --force-high-res-timeticks=disabled --metrics-shmem-handle=5252,i,16510144513294065920,6449141559665009469,524288 --field-trial-handle=2232,i,16471251634074305091,7965881513937980486,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
      4⤵
      PID:5340
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5364,i,16339132699725573826,17366168189921424258,2097152 --field-trial-handle=2232,i,16471251634074305091,7965881513937980486,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
      4⤵
      PID:5484
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5392,i,10914816182395788645,9022812184679321902,2097152 --field-trial-handle=2232,i,16471251634074305091,7965881513937980486,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
      4⤵
      PID:5492
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz" --force-high-res-timeticks=disabled --metrics-shmem-handle=5452,i,10142496280208939609,17116459794886261825,524288 --field-trial-handle=2232,i,16471251634074305091,7965881513937980486,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
      4⤵
      PID:5636
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:2172
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x274,0x278,0x27c,0x250,0x22c,0x7ff79b6d55a0,0x7ff79b6d55ac,0x7ff79b6d55b8
        5⤵
        Drops file in Program Files directory
        
        PID:5104
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:228
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x268,0x26c,0x270,0x228,0x274,0x7ff79b6d55a0,0x7ff79b6d55ac,0x7ff79b6d55b8
        6⤵
        Drops file in Program Files directory
        
        PID:2308
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5356,i,5203011640624075351,16211301206879289126,2097152 --field-trial-handle=2232,i,16471251634074305091,7965881513937980486,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
      4⤵
      PID:4408
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz" --force-high-res-timeticks=disabled --metrics-shmem-handle=5856,i,3346176937431607840,6518362761471421589,524288 --field-trial-handle=2232,i,16471251634074305091,7965881513937980486,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
      4⤵
      PID:2120
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5432,i,7301263532728946746,14977282476477666889,2097152 --field-trial-handle=2232,i,16471251634074305091,7965881513937980486,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
      4⤵
      PID:984
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz" --force-high-res-timeticks=disabled --metrics-shmem-handle=5452,i,7540593041474979325,9349918405601521327,524288 --field-trial-handle=2232,i,16471251634074305091,7965881513937980486,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
      4⤵
      PID:1656
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5524,i,5985875106091922438,18222036607616436847,2097152 --field-trial-handle=2232,i,16471251634074305091,7965881513937980486,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
      4⤵
      PID:2192
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz" --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,8648264350818200167,16844250040065143414,524288 --field-trial-handle=2232,i,16471251634074305091,7965881513937980486,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
      4⤵
      PID:3800
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz" --force-high-res-timeticks=disabled --metrics-shmem-handle=5552,i,14623611381655092558,5598374427652975243,524288 --field-trial-handle=2232,i,16471251634074305091,7965881513937980486,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
      4⤵
      PID:5012
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5908,i,11485084179593332272,3342721606622332629,2097152 --field-trial-handle=2232,i,16471251634074305091,7965881513937980486,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
      4⤵
      PID:4220
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5872,i,803626093220074978,3105947886571194449,2097152 --field-trial-handle=2232,i,16471251634074305091,7965881513937980486,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
      4⤵
      PID:4136
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz" --force-high-res-timeticks=disabled --metrics-shmem-handle=5680,i,11141550314016056031,16039526593296142461,524288 --field-trial-handle=2232,i,16471251634074305091,7965881513937980486,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
      4⤵
      PID:5940
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5392,i,16081403100882110242,12841891521288523361,2097152 --field-trial-handle=2232,i,16471251634074305091,7965881513937980486,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:1
      4⤵
      PID:824
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5632,i,13901517478589394612,4900615789671199432,2097152 --field-trial-handle=2232,i,16471251634074305091,7965881513937980486,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:2
      4⤵
      PID:5908
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5548,i,16301497891144938183,7414771980313182187,2097152 --field-trial-handle=2232,i,16471251634074305091,7965881513937980486,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1
      4⤵
      PID:5380
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5740,i,6768965633412378269,2940144010059800822,2097152 --field-trial-handle=2232,i,16471251634074305091,7965881513937980486,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:2
      4⤵
      PID:5568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2u4bhlb5.kwj"
    3⤵
    PID:5376
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\2u4bhlb5.kwj
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:5664
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27099 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2092 -initialChannelId {1670bfaa-6f27-48bc-bd37-92ad8f587385} -parentPid 5664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5664" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:5832
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2328 -prefsLen 27135 -prefMapHandle 2340 -prefMapSize 270279 -ipcHandle 2384 -initialChannelId {1861ff80-f0e7-40ce-91d5-6f35e2b510b2} -parentPid 5664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:5932
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e76b85c9-f572-47f5-b501-9563c1a5b3ae.dmp"
        5⤵
        
        PID:4696
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2768 -prefsLen 27135 -prefMapHandle 2264 -prefMapSize 270279 -ipcHandle 2860 -initialChannelId {19892ef3-01ac-4c25-a5ca-0a2cc3b4cf44} -parentPid 5664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5664" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:6068
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\fb6ad94d-3278-4db3-b300-673139f3459e.dmp"
        5⤵
        
        PID:5244
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2860 -prefsLen 27135 -prefMapHandle 3320 -prefMapSize 270279 -ipcHandle 2984 -initialChannelId {c4192f3e-6867-416f-ad93-a717dc9b1930} -parentPid 5664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5664" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:3576
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9b4791f2-1466-4f0f-bdfe-2c7bed7e0ca2.dmp"
        5⤵
        
        PID:1984
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2972 -prefsLen 27200 -prefMapHandle 3320 -prefMapSize 270279 -ipcHandle 2948 -initialChannelId {c754e59b-04ca-4226-a053-840f46a1dec3} -parentPid 5664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5664" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:4216
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3804 -prefsLen 27325 -prefMapHandle 3336 -prefMapSize 270279 -jsInitHandle 3816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3824 -initialChannelId {45ae03ad-5504-4fc5-8659-24db83bce0c2} -parentPid 5664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:1976
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\452f976c-73d9-484c-9612-f3e50fc81458.dmp"
        5⤵
        
        PID:212
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3956 -prefsLen 27325 -prefMapHandle 3960 -prefMapSize 270279 -ipcHandle 3308 -initialChannelId {d363a15a-f7a1-463f-a2bc-234da91a0935} -parentPid 5664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5664" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:2940
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\80229100-a251-41c9-bca4-83297154550e.dmp"
        5⤵
        
        PID:4632
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4236 -prefsLen 27325 -prefMapHandle 4240 -prefMapSize 270279 -ipcHandle 4260 -initialChannelId {aa4f5842-4de5-4756-b216-ee6c6eaee3b6} -parentPid 5664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5664" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:6004
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4632 -prefsLen 34824 -prefMapHandle 4636 -prefMapSize 270279 -jsInitHandle 4640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4648 -initialChannelId {e5ee3464-e9ad-4fbc-b34f-d2af2a0d0a99} -parentPid 5664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:4668
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4632 -prefsLen 35012 -prefMapHandle 4676 -prefMapSize 270279 -ipcHandle 3164 -initialChannelId {f2282902-52d4-41af-b1f6-41669cc7b9e9} -parentPid 5664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:788
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5036 -prefsLen 32900 -prefMapHandle 4784 -prefMapSize 270279 -jsInitHandle 4776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5068 -initialChannelId {cc6b5809-507e-49ef-9964-be6b983a6212} -parentPid 5664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:2780
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5224 -prefsLen 32952 -prefMapHandle 5220 -prefMapSize 270279 -jsInitHandle 5056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2328 -initialChannelId {405592bf-cb32-499e-8613-ae5adcb2ef40} -parentPid 5664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:5616
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5436 -prefsLen 32952 -prefMapHandle 5440 -prefMapSize 270279 -jsInitHandle 5512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5520 -initialChannelId {9ea24f4f-0349-4a9e-9dc0-b6aed087c99a} -parentPid 5664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:4392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:1048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7fff7fd3c188,0x7fff7fd3c194,0x7fff7fd3c1a0
      4⤵
      PID:1424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1820,i,5469344640543289238,11013268690175987486,262144 --field-trial-handle=2328,i,16786315767492647375,85402843543346828,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
      4⤵
      PID:5256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,16622612141717140920,6243508458986074799,524288 --field-trial-handle=2328,i,16786315767492647375,85402843543346828,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
      4⤵
      System Time Discovery
      PID:5356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,9138988416538042333,3666031736505082681,524288 --field-trial-handle=2328,i,16786315767492647375,85402843543346828,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:8
      4⤵
      PID:5212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3348,i,16545971909576033040,9128271169288865615,2097152 --field-trial-handle=2328,i,16786315767492647375,85402843543346828,262144 --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:1
      4⤵
      PID:1364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3368,i,8900915528121077231,7336254940535386672,2097152 --field-trial-handle=2328,i,16786315767492647375,85402843543346828,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:1
      4⤵
      PID:4036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,14181025648665624206,1288175504636011525,524288 --field-trial-handle=2328,i,16786315767492647375,85402843543346828,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:8
      4⤵
      PID:2088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,11543775580008685069,15628826138331072273,524288 --field-trial-handle=2328,i,16786315767492647375,85402843543346828,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:8
      4⤵
      PID:3988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,41213399591795177,13467620155944992371,524288 --field-trial-handle=2328,i,16786315767492647375,85402843543346828,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:8
      4⤵
      PID:3372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3692,i,1998158870748831267,10176999968842974992,2097152 --field-trial-handle=2328,i,16786315767492647375,85402843543346828,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:1
      4⤵
      PID:1772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3704,i,6597831958452291041,11863799416647066654,2097152 --field-trial-handle=2328,i,16786315767492647375,85402843543346828,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:2
      4⤵
      PID:3360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3708,i,17019383943897026193,4370625238593722576,2097152 --field-trial-handle=2328,i,16786315767492647375,85402843543346828,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
      4⤵
      PID:1952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3768,i,17624995153075428735,8252983687630621720,2097152 --field-trial-handle=2328,i,16786315767492647375,85402843543346828,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:2
      4⤵
      PID:3660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3808,i,1993183787674117358,11255784654051792070,2097152 --field-trial-handle=2328,i,16786315767492647375,85402843543346828,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3836,i,7811100575322487169,10542850366315988101,2097152 --field-trial-handle=2328,i,16786315767492647375,85402843543346828,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:2
      4⤵
      PID:4604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3868,i,4740371697822574445,17685451687934198072,2097152 --field-trial-handle=2328,i,16786315767492647375,85402843543346828,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:1
      4⤵
      PID:4684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3880,i,12354868659977536859,8619506243574337800,2097152 --field-trial-handle=2328,i,16786315767492647375,85402843543346828,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:2
      4⤵
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3888,i,7535642315942168021,12998976620037516007,2097152 --field-trial-handle=2328,i,16786315767492647375,85402843543346828,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:1
      4⤵
      PID:2872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3928,i,16478308127734508168,11640998602636850703,2097152 --field-trial-handle=2328,i,16786315767492647375,85402843543346828,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:2
      4⤵
      PID:4996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,6285150427561350039,10508205951368224484,524288 --field-trial-handle=2328,i,16786315767492647375,85402843543346828,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
      4⤵
      PID:4720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,15410331464455390567,13535637665192835851,524288 --field-trial-handle=2328,i,16786315767492647375,85402843543346828,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
      4⤵
      PID:2752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,11599859235584677416,8064170855362862607,524288 --field-trial-handle=2328,i,16786315767492647375,85402843543346828,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
      4⤵
      PID:2008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4168,i,17995845354337329704,11683133543600806779,524288 --field-trial-handle=2328,i,16786315767492647375,85402843543346828,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
      4⤵
      PID:4060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,14702629073170769274,4797583634670351946,524288 --field-trial-handle=2328,i,16786315767492647375,85402843543346828,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,14702629073170769274,4797583634670351946,524288 --field-trial-handle=2328,i,16786315767492647375,85402843543346828,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
      4⤵
      PID:468

C:\Users\Admin\AppData\Roaming\Microsoft\RasManagement\rundll32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\RasManagement\rundll32.exe"
1⤵
- Executes dropped EXE
PID:4860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1052

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 7d134c2044469e4807c5aa3772ab53f41442829b91956991a7ea4ed581d5fe7e
MD5 fa04f5cd1c44d66d0ecd3c1e546f5506
SHA1 e3b54020dad44b177969a58b8ef975c0750e7002
SHA512 0d1226852f1765c4da01dc2525f4891b998f343fdef7e49158f7bf2e4a9c7b41c47022b30cbfb5318d30ae275b8e83bbe399cd074ce951935091e630734214c2
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 8KB
SHA256 9e573ac081a04c1f95bcd8edb172fe74f8ed4e6dbfed665a7ef6750f9c3e590b
MD5 0083a83c469a3cb00669a5bfcfc9b5f5
SHA1 ef5322795997f44c3f2d0b1c23b1c49e3dfdee0c
SHA512 980f61c5face100c0d1c6904c3e37573ec1867a1867edb565eb66686a42adbb3a724a7d3dd2e9a79dceb0d14ffaac2a3543168d9e00404e0ba049252389c70d0
SSDEEP 96:oRaezWcv5u1m4KkhK3XK3OcuRl6BwSUhK27K2iEtkLC0Xkk3LhK3EK3pr0:fe6IuZkftlvlIc0/vcY
TLSH
T113127DD69F02486F3B839F6B325335516D9F640AC7E4A4B37BEB5106B8CA964002F1B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil\Crashpad\settings.dat
Size 280B
SHA256 f7100f59f95f945bb6d11398e94985ee0864fddb725e1e5658889f05877bbb66
MD5 85955fb66875b3a3b3e148baa061f303
SHA1 b62d2009b7f154380e72f5b0d6bdde921fe61dec
SHA512 c97624159ea6edf1ed7674d96fa65de96dc2e337aa6f1185b6b69a6852a0930f92c9a1e8d2457f8d9b282e6878f0d69a616a6547878bc659a149d4df1f06a739
TLSH
T1FAD01138A2A2008AC20808BA0288E3808AE288808822000828AA0A8888C08A8308B222
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 ce61b7e650bbd6cd7ebd72917537e26f5d2d38f87a2096cfb230722ded7b2c30
MD5 7dc9a5724538a93b47bbebbe523a7377
SHA1 15fa87211bb55628705a82b31b4e43b0580edd9b
SHA512 79923d2feee2e454bdddeada66a2dee72b01c3b7dfebe68cc2862cf007642b6d2ea1c39a323c2dd624552f8bee36c865d838ee649b7dba196e7547d39195eca9
TLSH
T1B4E068BB2DE7082CEA3B93E1047218950A063C688504AC4E402BB1C3F0B02152046C21
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 66c99a4706b416c5fe851cc2e669cbc93cc5bec3dc73dd29de7d62cfed9d7b21
MD5 3225554c27ff577db387ef1d1e2632fa
SHA1 f2f609c66602700553f8d03e580c2bff2c394a45
SHA512 03e768019719e68f01a71ef8c9cefd6a29be10eb5b675ef0b6be5887401a38ae9c03f2a8ecc67f59528e24177b67b3750cd9aa04dcf21bcdcaa1ace76203c71a
TLSH
T12CD02BF718DA0868DD7F57E2447268D406173C9C8905EC8E402E71C370B02236817D61
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe589c4b.TMP

Path C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe589c4b.TMP
Size 153B
SHA256 be0c2d280810a6cc2e565907a19ec6ca5ba7342d57f4e637b33a06ec9ecaa209
MD5 2f9b3fab34662ac97e5d3fa5aa78eaea
SHA1 e56e7948e9440b4229ef4c144798ce445b6d2e32
SHA512 5296f8a50792d6865be2c01ee16752189b44bac4fc7a7592a8fc042e895bdfe951ae220b12060a6cca7a29cbc8ffb6e249b030e4be0888cb405b0ea035de5c09
TLSH
T102C08CFB0D960818D90F67D241326CE082232CC88940AC89802F70C3B070122B422D61
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil\Local State
Size 5KB
SHA256 8de0c4ec4d0cdb1f4b944d140361198764758c0737e108ae39f92d5c921e9581
MD5 9031828b6a26fbb5d299164ffdeec859
SHA1 d9962ef36936d838b3790e3500a28787487f3a0d
SHA512 424fa49c78344341a18aedbb43d0778e95b3ef9a99660ef1032b98231c771b7c34bc96856e85e2ea569a68b0cd7de9fca2f0753926eda7e9d962af4b8f2ea3d5
SSDEEP 96:rqGNk8QsFfK07KA4o6b58Frh/cInURoDotovVoDvDBfPlv6eeXtsl0eUnVKD2q4a:uGN4jiKGooDUwcvdHBeXtUqVc
TLSH
T157B1B8B66434EC674DE6E944B4C627936EA82077E845BFD9DAD85B0C00DB788270B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil\Local State
Size 4KB
SHA256 0830587fc0de1b9a25d703cb77bc2c62909b0042390cca9ba68a2728b668b126
MD5 c2703900b98792a3f766edfcda4a934e
SHA1 4f4ace54d399040be862937c2975b3cad9009995
SHA512 62ddc57ebb16ac0b768e9cc91b60804fb55e889c5cbbffbe74a00ecdd7340d5d90d4ef197a2ef9dd61eaba61bb2b87d4a64c51f4aceedf6ad52b96ac88a438bc
SSDEEP 96:rqGNkrsFfK07KA4o6b1u9DvEBfPlv6eeXtsl0eUnVKD2q4a:uGNsjiKpovoHBeXtUqVc
TLSH
T13981A9B2A824DC6349E6D948B48A26D35D783077ED01AF95EAD8970800EB7583B0F837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe588e9f.TMP

Path C:\Users\Admin\AppData\Local\Temp\0qeeko41.wil\Local State~RFe588e9f.TMP
Size 1KB
SHA256 3771ba93b659fe78ebd4c85b41d134e463bbed89f52751ae958a54d79007686e
MD5 8b9675f69fe54d15fab032571e502c11
SHA1 6d7affd6a2f518875c2f401c43e00b92d0244e4a
SHA512 4d26fb0b785494a801179a4aec0f973979bf02e4afb0a2b9bd4bc658c381c44ea1880f9d41a1ac51515b88c382c8227128f245f22b121e68b5ab24b5fc993036
TLSH
T17231B6F2EC241CA3ACA1CA49B28A6FD31D396539E1415EC456DC8A0D00E7B9C221FC3A
MD5 SHA1 SHA512 TLSH

Submit Download

14472c4c-9439-47ee-82c1-6b6b8f510eab.tmp

Path C:\Users\Admin\AppData\Local\Temp\14472c4c-9439-47ee-82c1-6b6b8f510eab.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Crashpad\settings.dat
Size 40B
SHA256 97084d989f537dce6da00827ba13f160e2a7dcb7cc2cde6e4b6cfc3474adb6c9
MD5 6d7d3d78601de1039bb38cb176c79228
SHA1 1af36fe6aae4109e3ccd5c37b3ce58f5c84151d9
SHA512 671d3603cc614d6ca1948c705172e33ae1ed30e4847d477592a01e864c909868ffbf5269125c6a36f7a5524b4071a78554d2f62ab131e7d087f7ba4f9df34d05
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\BrowsingTopicsState
Size 414B
SHA256 1c0838ff9fb63787e36644b204f1106413103a5d01646998a715a65e6cdafebd
MD5 fc25697116e1ec5a88e501bdba3061a7
SHA1 da820b0cc4aad0dc45c208a4282e7bf85f134241
SHA512 5e33cc45f10b0cbd7231135f46d0c6cb282c7c824f03d8cadaf09339357819921bacbec32f2c99a88fca10631c12105b33dc8f47fd9633cc803ab3a03b542a0d
TLSH
T14AE02BEAD821DD3709FD0F5D64440685E740135A37C0884F3E7C910C4FB4636458691C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 964d9c18b1fd4746c5515b98feb5e6f719d022a5c3fa4a3264f642aa22d0eb22
MD5 23c71185a584640497ee6e851794a353
SHA1 39a15fcdeb874f2ebcbf21f374059792ddbda6ed
SHA512 894b87e043b3b282d751dda8ef83c53c0438aee0f6452929d0ed62798e4b69d14bdb3d9b063236644f9dd22881ed13d544a62e9f2de2f98715367fca474dcad4
SSDEEP 6:/FoEXE5oWN4TT+vV+GaVlFllvg96mL+FP+EXkAskllZxWQI:d7Xc4H+NhaVlFllvg1Eb/Pf
TLSH
T19913176FFA90EB0AC596317C558B47F083B08492965ACF435370B874BA46322100AE84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 3dc7dee204f0cf2cd40e8bb2efdbd01f02a35f4a9b908fe18d1a1664da4190c6
MD5 66215874599d8c3b43155083f63f29c3
SHA1 c0ba0c779696a1a4b1b8d270edb9815ec533852d
SHA512 58a078df0468a2b71b32ba3ae0e85a1cbabf00c9c1ad26086769488001e5657f513d6e3f8dcc2aab759f279e5d0f00e88db67462298280909bdfd14ed63ba06a
SSDEEP 48:GlzvuYV8BP33M1Xg+XtstdkMmXfdVEPLVBKWwtl:yzvXV8BPnugetkdkjVVOLHKWol
TLSH
T1BA4497F72D01DDC7DB18DBF45C51933C8D3286222DE5EE75F52844A20590AE7212CAB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 d1f05aa583bc1dd7cbf739282cdbfc22267e584b938f9f4e365b86b0d3ae60cd
MD5 54d25a74e00cf3ba9b22b6e2479493df
SHA1 1c0b9037130a784a825d6168a5745a6ea893494c
SHA512 f6d5ae6b7f09824c7635b1e1f5502ddf9e7b29ab2fe41a95166330e60cea6392f8e3d8e8935da723497c94907c9b16361889e2d42db9f022449ad57043cbd99d
SSDEEP 48:pz8im3RmT06ach+qdRh30BIH2MM85zjo7ZwkB7SG9J6KKpP6VyoP:h8YT06ach+Ok+2MM8JMeK7SGb6KKpSV
TLSH
T1CD252CE1E6794616E1AD58BB0CF2E1302764347B78435C00A55C367E58AF9F29D01685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 36caae6adea95ecf5432f79c9a48c169c313208dfb0fa8ff1c4340920f69703b
MD5 2c2b5538fbd6fc5cf89ae78bfe293e4b
SHA1 1ed44c476d7df347d7851dfaab300af4b089ff27
SHA512 9debd5ba8ea245ff943a1a9dfc2327eeb4c518bd4b5d0696e9157ae1cd6fa2bead072732a91a120af2e76be8696f95f25e2ce475eca2316d426a001ec2fa0a79
SSDEEP 384:TdX0BS+hSmX1BS+hLkGdXMBS+hCdXZBS+hsd5dS+hSCdS+hAedS+h:TxR4SeO4dxp4CxC4oG4q4S4
TLSH
T10D164BA64E28B542EB86EF70BBCDDD0C7CB023D1ACC79892951292A945E0FC857C515E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Cache\Cache_Data\f_000001
Size 35KB
SHA256 aaaba8e1a6f9486d31dce45afd51e73461738473cd24b24b9f8f2450010c43c9
MD5 abadef89053d694b6e4560c744aca913
SHA1 52d5a5508be2342e89ff432aae7f6ae6119e8797
SHA512 ac2baf9eb749a71fe578483a495b7b3d591415c70460bf439e9fca9881099813baab378ca06108b97c0c6f63ea110a683a7eb285503c412cd5ce111b2c3a7102
SSDEEP 768:vcEb5sTB+nTcQ1XhO4lRQ8Sc62eo/mfzroftPNeq:vzuaTJNe8XeRfzrAJNeq
TLSH
T145F2E14284EDC1C86E0D60442F84D2BF886DF4DDC3A49CC616DAE42DB881B732DCB995
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Cache\Cache_Data\f_000002
Size 66KB
SHA256 398d2b08a7b49d285fe53ee0339e49113c125ee67c4a6fe51de27bcf138a2337
MD5 44334eab6971cbf5bda184b100196d0b
SHA1 5cb9b2a90f18ee997115f15666b75bc8ff4d054a
SHA512 fa7e3b85c0df77557d2efd5dc6336c7ff481e59d21c59b4412910c1d96e0515211fa04e8a8a64624897664f922c7792458dca81cc3886b75d5545490c1377cfd
SSDEEP 1536:oLz/FOUDvzeagJ1o+gH88rKWfSvawAzTmmQYku8q7z+6GqK97zln:oPFO2qagIH9tKvaw8mJYyq5Lg7l
TLSH
T15263026F4083DD104A7B0DF89927BC256687437A896E1773CC0BA0F97D29418AE94E9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Cache\Cache_Data\index
Size 256KB
SHA256 b177f0e31176edd1e9fa9d40b8cb7c7274194e336c3e0c02bcac896aaa723ab8
MD5 dcd7c7b1fa94d4de87e057498398073a
SHA1 2d7d1ea911ca81a7d27115de31c91e10f84e372c
SHA512 bad1c3377a2e15803d5836d3c65bee6c17608376ea58bc4efb6df7dae3145c5e46669891fd6228b1b176b2b815fc19b096aee78a9896538738a224bbba000618
SSDEEP 3:LsLllFlklNllklkXl54Nlillx/mltcll//Zllll/mNtlNlXl3Nl/lZNtlQl:LsRa3lPqlGeOltzllluNtb
TLSH
T16144112E83A0AE0AC2C802FC80038B202338C802CB8FCB032308AA302CC03802E0F0B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 d6ff67f0b8fd07198f0c74c74b0bfaf72daae03096936f5cfa8c4f55dd78d4ad
MD5 1ec0e461e66db342a80447b3c2f48514
SHA1 716772ffbba295d74c234fadeb80a6bc754d6630
SHA512 2afed02c2ec376ba9de34c08372f782a54aaad6e7dbce05c6fa70c8a5117b5ce9c008f26683d4bb1cad8e2b6e7bca92f8338e291ce1a0a0a833a5eee12f9e76c
TLSH
T1F8E02B82C28D0F0DD32D96F7CDF603454A0E52C82ABE3603A880C2C133524241248122
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 42032f18308d5bfb227399e9843f0c8ea5ace6a4365db314bb645ca019992eba
MD5 a98caed6ef2ada8889e1921b5ae47191
SHA1 c16ac47b2f02de1db03245c8c8027d0575c5625d
SHA512 3cfa79009ffa84c3288b2dc89006197945f8764895fd098aefe4b1ce76f52899d4679e615e03498598c7b70c180849faebefff88e2a8c374f0b2d607f84ca416
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 952587c52c47ae518fadeb8d24abf5b6e88423db7e874cfb50c4dbb12d8df9e8
MD5 713fc38789929daa8d1f650425917436
SHA1 28543194fc55bd2f97022606be2f087427311f8d
SHA512 6792157fdd07a4c86d8c99c9db77b26f2bdad6c9d82e88d867c3ec046c598aecf0040f8936eb1d1ca1466342baca0ddd004b0acbf675de7b578e91799fb8f3ad
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\DawnGraphiteCache\index
Size 256KB
SHA256 8bace6dc1d7e31e9033fc55e004a94e160b55536e97380fc82992bccb4b6d030
MD5 ee11c23965a60ce3063fa3ac67eef2f4
SHA1 19decaa6b34909a820238b42c4343e43908a4de8
SHA512 b136dcab22a02da2c0305ea9e271c61debcf83352a768fd62bcacfc18ea7f9c023b7f9ed45fbfcb2cead5618999dc73a09dacbb66d5e4b5c93296d721e466134
SSDEEP 3:LstlNllklkXlx3ja/l:LsX3lPxjq
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\DawnWebGPUCache\index
Size 256KB
SHA256 35e8de48d5cefe75ef3f50e1e96636a17956fb2537901a31928cd779333570cb
MD5 f87766702dd37af0619583d7b962245e
SHA1 8d814c301a9b2282e33834b5f63eb69e16c116f2
SHA512 f465c8c53f2cb4e094c7ef0af5dfb8b0447548bfc1b7f1472181e3785e05f1c314e53dab970c531fae21efc0da64e24dcbcf9f690fe4f77e8a9f456a4ec36ec0
SSDEEP 3:LstlNllklkXlt3ja/l:LsX3lPFjq
MD5 SHA1 SHA512 SSDEEP

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\128.png
Size 4KB
SHA256 41b21cd721317759a1391ec66ec4606b1f1b0a66fc6542ec3e69f9a6ba9a60d3
MD5 a6e517fba00c44d26f516d2bc473042f
SHA1 bcedbf549056bfacff8820cac38713a1eacd95b9
SHA512 8c58b58a05b60420ff187c2dc8b71e019fc36cd6bcec050257b5532f131ba50ecd00fe2ca734805753a39f6911125d2d8684286207b1d1d039e862904279a145
SSDEEP 96:4niq7dWteEb8MsIhE+bf+rgEPQCGJxc4bOdpI0xeblJpzSkLqdsQ4pXnW3P:e97kteEnJEu+rxoi4b3RJpfhQ45nGP
TLSH
T14AA1AFFA12E3DA94303E91711B20659B4D7909385624364DDBB2AC7140C7A0D9B7CF63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\manifest.json
Size 2KB
SHA256 4375dfec1feb4295bdee57adb32a4cbaf351904be807160eabe87ca692b2b5b2
MD5 a60bd7255f6a78622887303990f4b4af
SHA1 61d77694628cdaf7f5ace1332a01d05e79f13772
SHA512 96b411c6b37e927de84cd363e37d0203bd692cbe2cc1aea56780830f23889562a8a512a07316c2c0ca7909a43a7ab879d9e908421ba6e7b99fdbeba1202e2282
TLSH
T173516DFBBC10AC634BB08594991A710EF729735E45CFC4DBB2BC60734BE4CAA1D60598
MD5 SHA1 SHA512 TLSH

Submit Download

offscreendocument.html

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\offscreendocument.html
Size 97B
SHA256 b9fa2d52a4ffabb438b56184131b893b04655b01f336066415d4fe839efe64e7
MD5 b747b5922a0bc74bbf0a9bc59df7685f
SHA1 7bf124b0be8ee2cfcd2506c1c6ffc74d1650108c
SHA512 7567761be4054fcb31885e16d119cd4e419a423ffb83c3b3ed80bfbf64e78a73c2e97aae4e24ab25486cd1e43877842db0836db58fbfbcef495bc53f9b2a20ec
TLSH
T132B012EE6C03C10004551E8A38E092146412638870D1A1445CDEE0334D4075C9C0B44C
MD5 SHA1 SHA512 TLSH

Submit Download

offscreendocument_main.js

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\offscreendocument_main.js
Size 115KB
SHA256 f6b3a786b1178d0d853f37559c83a4b5e40e2af451dca20af583137416af8416
MD5 5c3d8dc7447cc707f8da55f8c3b7d2b9
SHA1 1ff4cf8647c578a29a7b75c56d3dad86fce729a0
SHA512 0c09e9b71e0721e45ea3cc8797eb1e9b2bd2d762c0939eeb63b4bcb2c2508d4f09c5dd8c54fd51fa422d621a848367219f3bde8ab10a9e9a3dbb5e5fc22433ce
SSDEEP 1536:bdcu4XPM3pxqVv3AZWN4pI6PfRYPCf/JKIcAemoa1mAXC+4UKSomSWmmqekWdsXU:SApA34cmI6Pf3JKICnaPXC+BmmxkQbN
TLSH
T1D7C3FACDB6A574624363A5F5002F010BB23AB8AAE44C81E8F189D9E97DB446D4377F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\service_worker_bin_prod.js
Size 121KB
SHA256 ed3803ef5bac39e8b153d283695ee3562398e5d771a6c7fe5d1a85805672ab3e
MD5 aac97879e3f1c5a71cfb46b0fdbb29a1
SHA1 0cb02f7bbcbf207606888361be551e6d682c4c05
SHA512 8878736f8500a668e51e1f543ad7fe13eb7b4e19632918714dc64e952cb1f8400fa2026cfdac9ec757f4a285eacf6ce89f606a395500c56d2f2f39f8a64aa760
SSDEEP 3072:L3zCum5nHBRKbYK2ANj6a/4rxMwDLE2sk:LwB34GASx/DLETk
TLSH
T15FC3E9CCB7A574664363A5B6002F000FB23AB8AAE44C85A8F188D9E97D7446D4377F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Preferences
Size 11KB
SHA256 d33114d787a59f492d6d98a4ff78c85bc23edae774bf1cd876c204eb4f39808a
MD5 7a5bdc8b859c83626207cf8642dd1ac7
SHA1 c333c90c8de9461d9f5f0ccaecaaa374fc10c1ed
SHA512 6694683384706c40e43250f06f46c0a2d3d4afb98be88016e4345bffe535790fdc72b740a9c091ee17714cd5403c71f7a771d322bb314bb462d706397b98da15
SSDEEP 192:qRHdxjg0v7hvAPRp2wXsb+WNn/U2nubHexxwW6eimkiyIsnAUgR:qR9xjgwl6XbXwM20He7k6R
TLSH
T16432C62EAA14B63B4CCBD219FA657B83E3F2102535D12D48DBF8DA2C15D79CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5855ad.TMP

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Preferences~RFe5855ad.TMP
Size 3KB
SHA256 3b8ee621b3880e35b1e2f0e519c1456af86ea3a17ee120aeafa66fca244c8e36
MD5 1dcb91627e71e7ce281a224e00502712
SHA1 faab270b2864c72e004bc601ac95e15c354e047f
SHA512 22f62c059ca38caf66a4920c5ca71b6c8bce94d47012b3ec2aa537d07426c068389ee6a34f10d248617f72c5d03429daf6fd4ba1531584de5b84de8f90e2dee2
TLSH
T11A61505ED5901CA72EF6B36A786E1342F852473F1465181A397E0A8C0FB7863C541F9E
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary\cache\index-dir\temp-index
Size 48B
SHA256 93913a960367d3652c37d6ff4e73ca413d876098e63706f84c563a1f0fa1183d
MD5 a4272cc607bae4d9efa58376629832fd
SHA1 59d72af57f5ff079b4c8defeccc738db04160295
SHA512 61772d5d6be7e3b97cd37cae8ff4e74af6cc9f531a32893f9db33a42ef3693dc8b9e9ff2659139074ab96546cbb4b4611f0d740e96b20b88b2c4eb6659145c50
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png
Size 1KB
SHA256 bff3a19327fd09a24c1aa4e7f34c508d7e668a8eb32f2cc7c33bcaa7e9ee2319
MD5 2f1881da261cfaea89605ee7a5e33e40
SHA1 fe61ed428aa3636adcfbeb66162f43f0ee091d25
SHA512 a9d8a4172c83030bf4472e900540b2ef3bbbb5e565c39f278cb8aae355354f063a4723c5ed8c3b32dcea45c70903271d170e56879a096b169697fc28dc768494
TLSH
T1FC413B2333F81ABFD81CD69BE465C8A50F395483DA39060706031CE8116343B19DDAF9
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png
Size 2KB
SHA256 afbfdd55b59a6385a28bfe27ef81ffae07f9d77b8c073dc299c6060b5d964a89
MD5 4d5d17c7e7c06b887bb383077131f50e
SHA1 8b29cf29af8358672e31bee5472025b7b07e7df8
SHA512 ccb20424ba2566e11a359bd04cbcb54bc21947bc254f4939c334f7db8c784a1da35461f60a1fc559ab5bde5cda443c82b633b8cc5bda89f5019b391148050be3
TLSH
T179515DED0389C698FB6F764206866917621D39F824EC51E09AE816A3EB101AC1CC1FD2
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png
Size 3KB
SHA256 02bd0f5d045eb5247e576d8151da19d36dc0eee7746c9a426d4dc92ee83125c8
MD5 aceb6eccca82014c9472e49e8b4b6eb4
SHA1 91d2c703fe33ea1867dd3d87b760aa2e5e68a55a
SHA512 b18d0edf51fb6245dc730b5aca21601dc40c762d6c3d96c950b38312406bce16fe7165e786bd0d6ee106d95c90139094bfc4fca08b0f37eb88c086606821ade4
TLSH
T111814D53467373A8BC788965CBCDD0EA8D732D594E4244F884CAD93429D54049825BDF
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png
Size 1KB
SHA256 23fb4d1613fb426612119928a7222ca84a9cba4ba081a8b1be7f2565c013c590
MD5 520121a67f0bdc7a327bd49d50090dac
SHA1 648e3fbcbbffa431fd2480edf0a342b6920fb3b5
SHA512 36a89b73c4de9d9ef98becbbd31f286014163617063600ed22779e1e87ac35cbfb8341f9e4300994352570b1223719256c0d698dfa4aeb38e7d3907927a79a92
TLSH
T12D11E5B643275C67A2B3011708E03ABC8D605898F02B4A9C90148799360BBAAA4ED3DD
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png
Size 1KB
SHA256 7b1aa50219251762867246b79677fac99c1b61a4ef4e471ae3473c10ada2c50b
MD5 c633806d580f67b98743782c74dde9fa
SHA1 8acb5f35cd7ee2e7d3174ce06d399d46dd275ccf
SHA512 04cbe1571369525f4aab0b2a9fddbb425e9a935d9307d3b4fd2623899644e15419d0f7e0d33372a46442778043c03448e8130d892b4978aedbbcc0a785eaa9e7
TLSH
T1A9210BF662715F4EC79B05AC1FC14A676310122D665033AC5C2594047E4BCE78DB4D17
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png
Size 1KB
SHA256 2a560cdee5965876269d30cf82a85b83aeac16903d4f325209ca3354b971c25b
MD5 310d0edac146f7ce3e4394c066348637
SHA1 b1f1be49560ccb7007700fdf86a5121eb99eaffb
SHA512 1db1aebc30d4912eb9f3474476a2ca3683d078e3e141fbb7964402d01cc5fa5c2e24a1af7b4fad2f19b731d4b26ec9616f5406bf84d66d164a716e9084921156
TLSH
T19C3187F0F47B2D96DF75AD3427028960E6559E962D93DC109D482EE94B0C70981CE163
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png
Size 952B
SHA256 e566796c18517e7084e3a892b3291cc189b85e7830800503c256998ab697a507
MD5 bf7aa030f9cbc7aba123d10adb3ab321
SHA1 d210f3194a494a65d1e32ade703e24fbbef7b444
SHA512 3be8123811222e1d5aa92e7144d41a8ace20ea1d5b082aa51d11df8f573c17f294ead72ee9e94b31259035ebd0eecb904686cf4bb22f0e5313a02756e210b8a6
TLSH
T1E311889E6EAA8CBDD1C3AE4FBD2D22904F13CE54C534BA1B4C4759573A26E54704B501
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png
Size 1KB
SHA256 6a379d8e9545ee7885dcff4c53f1ca553dc9fb0cbaa18a0c71c0b75c8883d044
MD5 c053b2219c4c9e7e7080cbe4e6e3981e
SHA1 0470cf45babbbe1fad32b4dec3593e8ab7a8ac39
SHA512 1271ac3ef670f3b7104c3f4e678ef4bc9990d9427826b104bfa8d31f904895da50ed0f1b673727d39355428f6270d015c0953521b26d8f10f842854b79ec5525
TLSH
T1E021B7BE5B25DE1B97EEA61F72DA9900D89221E27183A6052ECFCB6057145A33C24172
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png
Size 1KB
SHA256 3772d9c9a6fabba60ac0c7b9c93bf230e3c99ebac9af480efc6c778d9881dd85
MD5 cf9a569f60db18903e86e6612cf90efc
SHA1 379dccdc92399b0e4e658ad8f04276bf99501836
SHA512 58f0b5130318069511452b11b1fbdfd898577c714150f5f88a4a4ff80320b33c287c103e464ef24c8543d90de71713f2ee293f538fb078ec2099f9871cef2caa
TLSH
T132210853AFCF4AAE5834129F565C460FFBA3623E2952D409DB2A41AB08CDC14E8462C3
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Local State
Size 3KB
SHA256 f24104d895eca0b588872ef77298e6aa95f5dd382d4e93027d735204bc35e8f3
MD5 6c0908ec07fd6767a7dae3d384189c8a
SHA1 0ad10b4b468d4dc79e209f80d976e8cac34d8c5c
SHA512 eb194143aa800202b7aa33ef7d0eea3e18f41f1c1aa303abdd63d0196edbc6435f257dc967d35af79b87e4a17a1d73aea34c1928e7ccfc85be11771774eeb3ac
TLSH
T1B681E6B2B469ED7709B6C685F94339839EB42067B541BFECD9E94F0C11E749D1302227
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58557e.TMP

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\Local State~RFe58557e.TMP
Size 1KB
SHA256 bea3e4a332c7450a97a157cdb709c17277c944693179f11783c27e0e1a428999
MD5 1c2df261e52dc0d319383b2931229a3f
SHA1 6aecc412fd31cbdb3715add925a44e508b9bc448
SHA512 e2216c7b292b3aa90337b263d8aa34f0a699755f3331260e7f781d9bb4a4b4686b997e5a3dc6b4fc7bb1be96cf7f9dfa7479fc80b35652a54107121177f4a17f
TLSH
T1501175F47C3837375F614B89AE92C2E32E76621BC485EE1D29D90E090DB159C2201938
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Temp\h0heo5ne.3mz\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1696_1722336165\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

0c0b2404-ff79-4256-8b37-6de7e02fcf94.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1696_781788144\0c0b2404-ff79-4256-8b37-6de7e02fcf94.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dpnhupnp.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\RasManagement\dpnhupnp.dll
Size 10KB
SHA256 7cf4535e85ec02365c54bf460992344fe1e319381e794e51a7ce0f9cb0438929
MD5 ba32bb24b7da23bd7ee7ae4b576338cd
SHA1 17731367250361c6b1aaf24f988b8dd1150b1e92
SHA512 4317c083c491e74ef7e1ad30d79164b3d6ba360f3b83a88d220b21385837049a33c3023c5f9d10c42980c45fecc747d271263242976435abab7612c26e486be4
SSDEEP 96:FjxR3HUNj9fs2Qz6IDyBTFdesMH3aLbJ0lq5/sEWRuWwl:FtmzzyyBJdQH3aXSlSWRuW
TLSH
T1CE22A80AB7B809ADF06602F8876A5D5AE1757110536266EF0230C35D3F2EBD1BD34BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundll32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\RasManagement\rundll32.exe
Size 70KB
SHA256 b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa
MD5 ef3179d498793bf4234f708d3be28633
SHA1 dd399ae46303343f9f0da189aee11c67bd868222
SHA512 02aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e
SSDEEP 1536:J8qpnO/qRUNReI3fu6Uw2mTARPw2cm+YRQln5IUmDjoX:C/YUNRBfukTreXRQln5I
TLSH
T16B630BC9A66460F4E077953444734E099272BC22D7625ADF54F0F17C0FF36E0A93AAAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 ec5eab634d15902a52770b01a9d1bdac56e651cec30a7d3c8f12f216515e9c7c
MD5 377081bb1a0fb8384b806fe1f1e7b7f5
SHA1 bd98940fb7834c2a52033b432e025b42ddc37077
SHA512 708608d8f63b456e573bfcfdec6b655b87e4455849f6af4479f98b4140d5b91e6bd9b1f2593c45c3ca1ab3c058cb4a46eff9b6c0fede81079413c4b8c1e33f03
SSDEEP 48:J1kVTdOLp9AMVkJ9zCNY+mdLXuHp1pph8kVTdOLp9AMVkJ9zvY+VgdLXuHp1A2z:JI1JoguJP/N1Jv7IuJR
TLSH
T1BA91AC01BBEA0A57F3F7DEB295B37A115B76B905DA044A4D0090420C1C73B18966FFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\crashes\store.json.mozlz4.tmp
Size 6KB
SHA256 eddf498f98a0ac4298f192c09a05ee1583fcd068a5ea5afe43a713bd0660ace9
MD5 d558800ca7e3740abe0d64158df50eff
SHA1 ac4718d0b5dc2a908af7c1068816d2b45bbaa79e
SHA512 d42252105bac256db17b130c7d6a6ecb92cd9c0d1fe2831cb459d686c6611a7f37fa28cad1de843d359e89d76ddc223f65b2a9251a33f0737125f44b1d9d27b0
SSDEEP 192:cla7B7sDqvcxiCBHH4G1VU33d/Hjdb/naOCmlPN5nzC6:N7VmqMYoU3N/Hd9dPNh+6
TLSH
T16CD18DA3FE6961F08F81CD5020F38F4923229D53A05886C2788836D788F2ED82B3D319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 7da46c2b5d47c2689ec7042705091ae6862468bb5be64c5c6459ae22b246d4b2
MD5 b91c0ff18a49890436c2a7a28d675919
SHA1 b82d9825d3973114937ed02de385ef1061f00f10
SHA512 7c134870123394476592de1ee1529669727c5f964bb2cbbd0a047257419833431bce74bc49cf16d8062b14de5a2f3a244e5dfc2f9b140cf14b6109570be0106e
SSDEEP 192:VOv5zboPkZy0yjghMn61d66JozGzgCl6mc0d:Kbo8Zy0yjRkd66JozGzgC1j
TLSH
T1ADE1FD64EA29463FC408437BCCA61B804F39398BD84E7F15359DA11C2D5B2DE7A8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 4be2a811dbdc0aa6e996470e7426615177813cd8c6288168980f3c44248e8b41
MD5 54792781a4728addf682a6e97f422452
SHA1 6046f0faa0690282ec59cb66f6a994d4e2f72572
SHA512 16bdccac6bcea0c6a6bb74e1aa5421b8375530bf99da465ed72ab32cf5311f365d700a910161eea8db4343f36543b91b5797dfc8dbb6021d21692790c22a368a
SSDEEP 192:UOv5zboPkZy0yjghMnCd1d66JozGzgCl6mc0dz:3bo8Zy0yjRMd66JozGzgC1jd
TLSH
T1C1E1FC64EA29463FC408427BCCA61B804F39398BD84E7F15359DA11C2D5B2DE7A8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 fdb49b7ad7a4e601600983e6d316cd52b79ba91670c92ea3193e518934f4da9d
MD5 757837b3ec028c24db17d2c42b79ca48
SHA1 6813a523bed5547297aff9c460c350e12bf90cf2
SHA512 ec80a8ff6377784d3c2bc891dc0e745e9228edf736d1fbc1d6d1ff3c8be25b3068d24ee050d8a1b9e7329890650abdae7fa3b1d63a0450638049cd4336e38a03
SSDEEP 192:7A1d66JozGzgCl6mc0dJOv5zbotby0yjghv:ud66JozGzgC1jMbotby0yjq
TLSH
T1ECD10D64EB28463FC444437BCCA61B804F39394BD84E3F19359DA1082D5B2DE7A8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\events\events
Size 1KB
SHA256 db11e5aebc1c551293b92308a89642b5e920b5b27bb7e9fa05a8006537889a89
MD5 29adcc5c6342b21766af6f6420cb7085
SHA1 e7f9720efff0d659b8cbf1e3ebd86ce17e6d6f11
SHA512 a26ae14d038bde15f0c06c49b37134c9fa45118a3bf0c3e58b991e08f108e4d73a488d1e8aa39901781bdb940af41d8008785f1167447154b1dd9d07e3799b2b
TLSH
T12521AC4C39B84D2E9C9BF29CB44502CE53954E0625C72C831E42DE8DCCE5AD9326E43A
MD5 SHA1 SHA512 TLSH

Submit Download

01dc7f5a-a5d4-4d70-b43f-0991861d34aa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\01dc7f5a-a5d4-4d70-b43f-0991861d34aa
Size 16KB
SHA256 b3c82dad33a59f7af84beaf69d70856870d646c7201c2ce263a288b67f20abf6
MD5 6ef19d9479eb588d9f11658ed1ba7182
SHA1 0da6c8f30a8419a4f0e6151c6952b8197fb1fb21
SHA512 352ccae4a8453305dfd6b70dcd248f16ad6d740d5854c1c51ea6cc0168e7bb3bb041023e05fc9ce382c861f3b7c3cb3600b211937869aa8c08073ce9e173a0d5
SSDEEP 192:iKxTKWT0OCuq3TEV/8BrODu45XTUbSXt6ej7hUwz1Gb62u7USeflTJr7wpxo8jly:fKs0Yq39IiwBGb6h7USYlJUpxo8jIcTw
TLSH
T16072CA16682045BAC291E36894FCBFC3E6F538CB4C415FC99BE4BD086DDE06E112798B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0a522d9b-dce8-4470-a652-c34bc1cb3ae5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\0a522d9b-dce8-4470-a652-c34bc1cb3ae5
Size 883B
SHA256 fcc4153adadfa9fd852fe0aa36ebc6e5d7590cd84dc69bd7a563498e40d097e1
MD5 1e66ae29aaabf90cbb2f094e9d2b6c97
SHA1 e98d5974c719b26b7f9018fe00e498c25b5a2ddc
SHA512 ecea8b12dc2cb601025503380fc764617e5e6f470512fd2ca83615e51e57b869f6477d320d494373915f64c4270d63c66179c61a5c615dfc0d464ceb198609b6
TLSH
T1D111DC40A73578B2CEAC838AC5A176424BE4751380CB84043EA18D240D7E12EA76B30B
MD5 SHA1 SHA512 TLSH

Submit Download

12cefef7-dec7-436d-acb3-3816522461ec

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\12cefef7-dec7-436d-acb3-3816522461ec
Size 3KB
SHA256 7bfb7fb4420171abf96276f5f12f0bd458c3cfb442aaf718fbecf046323eedfd
MD5 4f84d4061265c63eda5b0864b2949962
SHA1 3fbae6b80369b2d8ee26292e5acfbcfb423a6091
SHA512 c69912f69f96fb5a5270cfe81882a8b1027b25be89da1bbe6a4f4aa1ce4d08a6f38342f6e85e27a16f40409cbc1b892505806082ec66ded0553d7967a94c7ac7
TLSH
T1556154719664A9338BECA004A37B6E419FDE33CF584B0FCD21A9996406E8468478F35B
MD5 SHA1 SHA512 TLSH

Submit Download

1d685df0-28e6-4e61-b283-ec5b9c25b378

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\1d685df0-28e6-4e61-b283-ec5b9c25b378
Size 3KB
SHA256 ba4f9b5bb90ca15daaf83d31b59a468ecd0025932b4fa38d19d58c1fa85c07fe
MD5 a5f7dd23c9e1d8d5ec27e261a5abccc2
SHA1 6aa1dd71f59f09b59c21dd4daf7ba29d4e6df095
SHA512 78d583e186cea6b61042cdb4c13eaf36e189c140b77bb12d09d0b6aa626250b366c7e585ab625dbdb1183ff3e9e05bed336819586243f2c5884bfa4b736e6a5b
TLSH
T144615471966469338BECA045A377AD809BDE338F484B0FCD22699D6446E8868478F25B
MD5 SHA1 SHA512 TLSH

Submit Download

2b475bb3-d82c-46b6-bc18-bc9f261d8ff8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\2b475bb3-d82c-46b6-bc18-bc9f261d8ff8
Size 2KB
SHA256 b9bdbb03d217e83748768fd4a994e2334fce3cf0d684b8abe661f9e2564308d8
MD5 3a7717545fab325dde91eb0f096c013c
SHA1 1027a96fdda02e6e6c262cc8a8e38ae41c1a1c60
SHA512 5f4498245285d6d0862524c3d8abcbe535ce941bbcba91781230a7d713956253afee838609d66d5594bf061153e93371da825abfe51c31b67f476a6a2eadf4a9
TLSH
T1A841215C36B84C7B9CCAF69DD493328E5760CA0740C719436E52DE0C8C967EE736A52B
MD5 SHA1 SHA512 TLSH

Submit Download

50f477b0-3a90-4f2e-b4a1-b06a2d97202b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\50f477b0-3a90-4f2e-b4a1-b06a2d97202b
Size 235B
SHA256 43e17f19b13a86ee3a667e2e7569acba33e627ea0d1817396bd4f3529e469d04
MD5 ac0c589d7ccef69ea572345055ddd488
SHA1 2c6592e2080f2c63c1600b89d567528d84d9d47e
SHA512 44bb05114fffddb837b6bf16defffa5ad0973c10b7c168820a25e9dcb0e9722611f143dc6d668daaca47bd622627600e703a17e98c0813befeb8882599b34992
TLSH
T148D09784289823AE09041F0EB0B07DC230588C33147A6810D6B20174CDBDEC4821182A
MD5 SHA1 SHA512 TLSH

Submit Download

b5b52ab0-6888-4442-b6e6-ebb8f4412929

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\b5b52ab0-6888-4442-b6e6-ebb8f4412929
Size 235B
SHA256 9ad83d28dc3f4e5f7f18b9474f21a49ce969fd941e4f12638bc2d402012398bf
MD5 63c52995c53188e7a7282dec9ab666a4
SHA1 27c0aa1029c510e7797fb1257790572af51a1061
SHA512 f758c3dd8efa242f9dfa15905dce7a386f7409649eeb9e76aa85b1ea64af2cbf6ccd4b4192f991f0012aabac4f9a0a252cde21e4cbcad5739b9bfbb2bb2b117e
TLSH
T14FD097C028AC636CCC140F8BB0A029C230464C3350A45820EB51867889FCEC40221C0B
MD5 SHA1 SHA512 TLSH

Submit Download

c2227b3e-b741-4319-b951-d3b73eb90d94

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\c2227b3e-b741-4319-b951-d3b73eb90d94
Size 3KB
SHA256 95943bd79b17f7d4f2cb15fff9041515af9ef76c88af3426693c2aabe9768920
MD5 aed092f5632fa54c7d97a7d386f4075a
SHA1 8ebc064307fb9626f04bb71c6737af8a21a5db1a
SHA512 32b603fded5bc72d31ca39a9043036ddb3f6bade74362a2e5da42ee96ac955d6de4043c6e65100e0ed3cdc7fa0383b57a0c8f1b52728128ad17655820a9746a2
TLSH
T170616471966469338BECB045A3776E418FDD33CF5C0B0BCD225A9D6406A84684B8F35B
MD5 SHA1 SHA512 TLSH

Submit Download

c625edc3-0d8b-453d-98a3-27cb00836c5f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\c625edc3-0d8b-453d-98a3-27cb00836c5f
Size 3KB
SHA256 31d677b9b9ffc023c3e8be003cf0eaddfcee4428829e3f232ffdb0fb29c1dab9
MD5 d4abab81596400dad2c7eaaab2deeded
SHA1 71f28250e241eb41d90f79ce0e00b864dc4a5ce5
SHA512 92b531f923c9a5dc76ebffc502b41c0af2919bca5045623ba35eaadc230bfad088867ec89021d89772683a60d2e79824d94e1b8f06218a7cdea5259a83ace6ac
TLSH
T1C161556196646D338BECB145A3776E848FDE33CF580B1FC9219A996406F8428478F35B
MD5 SHA1 SHA512 TLSH

Submit Download

ccc0d360-896a-4d44-a770-34a9a74f8d15

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\ccc0d360-896a-4d44-a770-34a9a74f8d15
Size 886B
SHA256 8c5865168048273f9bea83973974e9ae378bae35201d59d67226b976defb73c3
MD5 168c0863fa7bc9bb24981044f4af7121
SHA1 524e2f371bc2acab786718d01c1c7f061bc59800
SHA512 cbe12e0afcda7042ef8ba1c2680b5c62c8f1e74c2c7cad9648925a0778313cff910a4caf945803ddb7c0695d13960778240db04aa1747ba07eab4430fcbaf685
TLSH
T1C41100509B74B4B2CC68D39795E176824BE4B41380CB49147ED19B180DBE62FAB9B30B
MD5 SHA1 SHA512 TLSH

Submit Download

d9d4a9fb-9e84-44e5-b32d-0fc4559848a9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\d9d4a9fb-9e84-44e5-b32d-0fc4559848a9
Size 3KB
SHA256 6f63f9db3df541a9675780cb562551ffc3f6ffe09310564878a8e1cfc919f2ed
MD5 34f6feafb82d8043e4b0d7389f588be3
SHA1 0c2516fe98755e14e2151bcfb816671bc488b8b9
SHA512 1e218609799ced05704ee739dbc964cae750ae7dffcab666537ac82439ebaef1dadef5a0b49f0fb6612be49fb45848b01f0fe3f25b0996e8370776082997a1e6
TLSH
T16D616361955469338FECA040A377AA809FDD33CB480B0FC9216A9D6446E8468578F35B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\prefs.js
Size 6KB
SHA256 9ae19c9e7ddb325b9890090244eb4d8172d91b2cdf780c3c5c4067d8f1184afb
MD5 417fc1ac289039ce6c6567fb117aa348
SHA1 b78ec5f8028e55f755abb988430c3ff79ab2f536
SHA512 a26b8c773cd26956e51e23886c3063d19861c64609f037cc58455d28a2a16faf0fc5bcec307d04be7a9464a751ae80b189ce287a3b1e38658d50c033a6e07cc9
SSDEEP 96:xHNUTUr4qGqOfCyKjcnjl1zSpfqcSSl8pdv9jHffn5HDg/GY9Bw88n8L4cnd88Lg:TnROfCyvBofqcSSG9dMeaBw88Z9
TLSH
T1AFE12F789408CB7F64B677ACAC6888316AB2413BB7BF68D750B54484051CF3445F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/212-5994-0x000001DB272A0000-0x000001DB272BD000-memory.dmp

Download

memory/1696-1851-0x0000019541960000-0x000001954196E000-memory.dmp

Download

memory/1984-5992-0x000001E374E50000-0x000001E374E6D000-memory.dmp

Download

memory/4256-4705-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-2256-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4700-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4703-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4702-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4701-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4714-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4721-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4698-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-0-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/4256-4111-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-2664-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4129-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4130-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4720-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4719-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4718-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4717-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4716-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4715-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4713-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4712-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4711-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4710-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4709-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4708-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4707-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4706-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-2663-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4704-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4131-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-2665-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-2666-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-2298-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4132-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4133-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4139-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4140-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4141-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4142-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4143-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4146-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4135-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4134-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-2309-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-2306-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4117-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4119-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-2288-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-2293-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4120-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4699-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-2262-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-2246-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4121-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4122-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4118-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4115-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-4116-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-3405-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-2009-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-1893-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-1881-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-1862-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-3406-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-1826-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-1837-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-1589-0x0000000006480000-0x000000000649E000-memory.dmp

Download

memory/4256-1455-0x00000000069B0000-0x0000000006EDC000-memory.dmp

Download

memory/4256-1441-0x00000000061E0000-0x0000000006230000-memory.dmp

Download

memory/4256-7002-0x00000000010E0000-0x0000000001200000-memory.dmp

Download

memory/4256-3412-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-3414-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-3430-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-3431-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-3429-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-3413-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-3409-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-3407-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-3388-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-3387-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-2846-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-2847-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-7001-0x00000000010E0000-0x0000000001200000-memory.dmp

Download

memory/4256-2848-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-7000-0x00000000010E0000-0x0000000001200000-memory.dmp

Download

memory/4256-2849-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-2850-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-2792-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-2793-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-2794-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-2795-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-1433-0x0000000006160000-0x00000000061D6000-memory.dmp

Download

memory/4256-1427-0x00000000062B0000-0x0000000006472000-memory.dmp

Download

memory/4256-1152-0x0000000006030000-0x00000000060E2000-memory.dmp

Download

memory/4256-2704-0x0000000000B40000-0x0000000000C40000-memory.dmp

Download

memory/4256-239-0x0000000005E50000-0x0000000005EB6000-memory.dmp

Download

memory/4256-193-0x0000000005170000-0x0000000005180000-memory.dmp

Download

memory/4256-136-0x0000000005730000-0x0000000005CD4000-memory.dmp

Download

memory/4256-2658-0x00000000010E0000-0x0000000001200000-memory.dmp

Download

memory/4256-6993-0x00000000010E0000-0x0000000001200000-memory.dmp

Download

memory/4632-6079-0x000001F2A1080000-0x000001F2A109D000-memory.dmp

Download

memory/4696-5746-0x000001DBBEE80000-0x000001DBBEE9D000-memory.dmp

Download

memory/5244-5747-0x0000021EA0670000-0x0000021EA068D000-memory.dmp

Download