phantom_stealer | e1420a9e6d6bd820cee7e88c9c50e67dd475d96df3069655426428a6d40dd18b

Analysis

max time kernel
149s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/05/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
Size 1.6MB
Sample260504-pcltesex4p
SHA256 e1420a9e6d6bd820cee7e88c9c50e67dd475d96df3069655426428a6d40dd18b
MD5 01f31ba800e33ba567d9a097dd530157
SHA1 8f41ac6b09fcbe9a34f480807c493d21d91dc30c
SHA512 c7084168e62fbaf4f2f526d667794d33d1c85826542c7926cd9d39f105964e4b275ff1e67529715579a24f590fae335dc47a738c910b7e7415083a41adee3f4b
SSDEEP 24576:QSLfgyXqe/ZbSMI5HNqw7fWxu2rT+IN6NCqo28ZfLOZJL:QSL4yXV4M0HNqtcW/NW8lmL
TLSH
T19D75220D271EEE02D8811AB45C21E3B907744ECCE515C253AFF9FC8FB8B9695A8642D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution phantom_stealer persistence spyware stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

Mutex

TS3MOP1QLB9XY0OOH6ZM

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 1 IoCs

resource	yara_rule
behavioral1/memory/4416-20-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2852	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OxGIsizVFz.lnk	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
366	icanhazip.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4732 set thread context of 4416	4732	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	103

Drops file in Program Files directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\msedge_installer.log	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\10766029-3668-41f1-af41-0ad7a044832e.tmp	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\7a1a28bd-eee7-4b71-8ef9-7c3bf7785060.tmp	setup.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\msedge_installer.log	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\e4d01319-a4c8-4636-9772-8e6e6864837c.tmp	setup.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\msedge_installer.log	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Program Files\msedge_installer.log	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\2156_13422370344398565_2156.pma	setup.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\5784_13422370337030554_5784.pma	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\b252c81d-d19b-40d5-8239-8e1ff6d60def.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\1380_13422370337077881_1380.pma	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\5552_13422370344303785_5552.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6836	msedge.exe
4824	chrome.exe
536	chrome.exe
4356	msedge.exe

Checks processor information in registry 2 TTPs 46 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134223703366544416"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-914486190-3969805341-592249730-1000\{F575D741-827C-4964-867A-A2ECE1C32CFF}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-914486190-3969805341-592249730-1000\{02B3DAE6-C746-416C-937C-F791974936D2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4732	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4732	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
2852	powershell.exe
2852	powershell.exe
3804	powershell.exe
3804	powershell.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
1060	chrome.exe
1060	chrome.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
5596	firefox.exe
5596	firefox.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
6352	firefox.exe
6352	firefox.exe
6352	firefox.exe
6352	firefox.exe
6352	firefox.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	4732	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
Token: SeDebugPrivilege	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
Token: SeDebugPrivilege	2852	powershell.exe
Token: SeDebugPrivilege	3804	powershell.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeCreatePagefilePrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
1060	chrome.exe
1060	chrome.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
4128	msedge.exe
6472	msedge.exe
6352	firefox.exe
6352	firefox.exe
6352	firefox.exe
6352	firefox.exe
6352	firefox.exe
6352	firefox.exe
6352	firefox.exe
6352	firefox.exe
3880	chrome.exe
3880	chrome.exe
1100	chrmstp.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5596	firefox.exe
6352	firefox.exe
4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 2852	4732	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	100
PID 4732 wrote to memory of 5208	4732	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	102
PID 4732 wrote to memory of 4416	4732	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	103
PID 4732 wrote to memory of 4416	4732	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	103
PID 4732 wrote to memory of 4416	4732	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	103
PID 4732 wrote to memory of 4416	4732	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	103
PID 4732 wrote to memory of 4416	4732	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	103
PID 4416 wrote to memory of 1060	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	106
PID 1060 wrote to memory of 4200	1060	chrome.exe	107
PID 1060 wrote to memory of 2084	1060	chrome.exe	108
PID 1060 wrote to memory of 536	1060	chrome.exe	109
PID 1060 wrote to memory of 5684	1060	chrome.exe	110
PID 1060 wrote to memory of 3232	1060	chrome.exe	111
PID 1060 wrote to memory of 5460	1060	chrome.exe	112
PID 4416 wrote to memory of 1060	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	106
PID 4416 wrote to memory of 1060	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	106
PID 1060 wrote to memory of 4960	1060	chrome.exe	113
PID 1060 wrote to memory of 4384	1060	chrome.exe	114
PID 4416 wrote to memory of 4200	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	107
PID 4416 wrote to memory of 4200	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	107
PID 1060 wrote to memory of 3284	1060	chrome.exe	115
PID 1060 wrote to memory of 3368	1060	chrome.exe	116
PID 4416 wrote to memory of 5460	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	112
PID 4416 wrote to memory of 5460	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	112
PID 4416 wrote to memory of 5684	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	110
PID 4416 wrote to memory of 5684	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	110
PID 1060 wrote to memory of 3756	1060	chrome.exe	118
PID 4416 wrote to memory of 536	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	109
PID 4416 wrote to memory of 536	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	109
PID 4416 wrote to memory of 2084	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	108
PID 4416 wrote to memory of 2084	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	108
PID 4416 wrote to memory of 1060	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	106
PID 4416 wrote to memory of 1060	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	106
PID 4416 wrote to memory of 4384	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	114
PID 4416 wrote to memory of 4384	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	114
PID 4416 wrote to memory of 4200	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	107
PID 4416 wrote to memory of 4200	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	107
PID 4416 wrote to memory of 3284	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	115
PID 4416 wrote to memory of 3284	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	115
PID 4416 wrote to memory of 4960	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	113
PID 4416 wrote to memory of 4960	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	113
PID 4416 wrote to memory of 3368	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	116
PID 4416 wrote to memory of 3368	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	116
PID 4416 wrote to memory of 5460	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	112
PID 4416 wrote to memory of 5460	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	112
PID 4416 wrote to memory of 5684	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	110
PID 4416 wrote to memory of 5684	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	110
PID 4416 wrote to memory of 536	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	109
PID 4416 wrote to memory of 536	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	109
PID 4416 wrote to memory of 2084	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	108
PID 4416 wrote to memory of 2084	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	108
PID 4416 wrote to memory of 1060	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	106
PID 4416 wrote to memory of 1060	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	106
PID 4416 wrote to memory of 4384	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	114
PID 4416 wrote to memory of 4384	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	114
PID 4416 wrote to memory of 4200	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	107
PID 4416 wrote to memory of 4200	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	107
PID 4416 wrote to memory of 3284	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	115
PID 4416 wrote to memory of 3284	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	115
PID 4416 wrote to memory of 4960	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	113
PID 4416 wrote to memory of 4960	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	113
PID 4416 wrote to memory of 3368	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	116
PID 4416 wrote to memory of 3368	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	116
PID 4416 wrote to memory of 5460	4416	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe

C:\Users\Admin\AppData\Local\Temp\MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
"C:\Users\Admin\AppData\Local\Temp\MBL & HBL ADJKT2411000812 - BLJKT241180900.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\MBL & HBL ADJKT2411000812 - BLJKT241180900.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2852
- C:\Users\Admin\AppData\Local\Temp\MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
  "C:\Users\Admin\AppData\Local\Temp\MBL & HBL ADJKT2411000812 - BLJKT241180900.exe"
  2⤵
  PID:5208
- C:\Users\Admin\AppData\Local\Temp\MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
  "C:\Users\Admin\AppData\Local\Temp\MBL & HBL ADJKT2411000812 - BLJKT241180900.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4416
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oglkfmm0.zi4"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\oglkfmm0.zi4 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\oglkfmm0.zi4\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\oglkfmm0.zi4 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe5515c728,0x7ffe5515c734,0x7ffe5515c740
      4⤵
      PID:4200
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oglkfmm0.zi4" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1788,i,17619086805348739034,14280888747351499313,262144 --field-trial-handle=1944,i,67024164923250018,17605033339953527026,262144 --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:2
      4⤵
      PID:2084
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oglkfmm0.zi4" --force-high-res-timeticks=disabled --metrics-shmem-handle=2004,i,4189350735911554073,10162153126344440554,524288 --field-trial-handle=1944,i,67024164923250018,17605033339953527026,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:3
      4⤵
      System Time Discovery
      PID:536
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oglkfmm0.zi4" --force-high-res-timeticks=disabled --metrics-shmem-handle=2108,i,10371539911209531851,10906433937063267226,524288 --field-trial-handle=1944,i,67024164923250018,17605033339953527026,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:8
      4⤵
      PID:5684
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oglkfmm0.zi4" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2892,i,857650161572686784,12067991779861431498,2097152 --field-trial-handle=1944,i,67024164923250018,17605033339953527026,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:1
      4⤵
      PID:3232
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oglkfmm0.zi4" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2948,i,5941595550890404914,6712986950027665666,2097152 --field-trial-handle=1944,i,67024164923250018,17605033339953527026,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:1
      4⤵
      PID:5460
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oglkfmm0.zi4" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3036,i,1740830618159222363,15961740204621658283,2097152 --field-trial-handle=1944,i,67024164923250018,17605033339953527026,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
      4⤵
      PID:4960
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oglkfmm0.zi4" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3048,i,11425641102728644233,11349226498908068278,2097152 --field-trial-handle=1944,i,67024164923250018,17605033339953527026,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:2
      4⤵
      PID:4384
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oglkfmm0.zi4" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3628,i,12448213619140318286,218251588928285254,2097152 --field-trial-handle=1944,i,67024164923250018,17605033339953527026,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:1
      4⤵
      PID:3284
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oglkfmm0.zi4" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3948,i,5720282889749866180,5893537808543261548,2097152 --field-trial-handle=1944,i,67024164923250018,17605033339953527026,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:2
      4⤵
      PID:3368
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oglkfmm0.zi4" --force-high-res-timeticks=disabled --metrics-shmem-handle=4452,i,7128900395449380706,10489394674684303126,524288 --field-trial-handle=1944,i,67024164923250018,17605033339953527026,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
      4⤵
      PID:3756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t4nc1ggt.ozw"
    3⤵
    PID:2460
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\t4nc1ggt.ozw
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:5596
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {0dea40be-5d05-4bd6-939a-49c1bb451560} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:888
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2572 -prefsLen 27135 -prefMapHandle 2576 -prefMapSize 270279 -ipcHandle 2276 -initialChannelId {9e36476d-ed32-4a94-a76b-77fb3d7980bf} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:2444
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bfc62fd1-1430-49f7-ab30-45765f25387e.dmp"
        5⤵
        
        PID:1096
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2328 -prefsLen 27135 -prefMapHandle 2856 -prefMapSize 270279 -ipcHandle 2348 -initialChannelId {cdcd69a1-47ae-4899-aadf-c45910fa9112} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:1928
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c60270f4-73df-4682-abc1-91cb930ef292.dmp"
        5⤵
        
        PID:1296
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2968 -prefsLen 27135 -prefMapHandle 2972 -prefMapSize 270279 -ipcHandle 2960 -initialChannelId {ddf3b3e2-4a38-418c-b0e4-bd8646cc0c08} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:5252
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\68dc9919-2085-4c18-b686-61b27229014b.dmp"
        5⤵
        
        PID:4376
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3680 -prefsLen 27249 -prefMapHandle 3696 -prefMapSize 270279 -ipcHandle 2968 -initialChannelId {63893274-372b-4b6e-bfe2-d6d1915513bf} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:5304
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3980 -prefsLen 27325 -prefMapHandle 3984 -prefMapSize 270279 -jsInitHandle 3988 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3996 -initialChannelId {2f22f2e6-f16c-495d-a69e-f48a4aab6098} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:3948
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\7bf50862-771e-4f5e-8ba5-272ada8ca78b.dmp"
        5⤵
        
        PID:4168
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2888 -prefsLen 27325 -prefMapHandle 3956 -prefMapSize 270279 -ipcHandle 3900 -initialChannelId {c44d7460-a1e8-465c-b97a-99a584ddfdc4} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:5976
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\67735939-fe8d-4f5d-8867-672d9d6b5a0b.dmp"
        5⤵
        
        PID:2852
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4328 -prefsLen 27325 -prefMapHandle 4324 -prefMapSize 270279 -ipcHandle 4312 -initialChannelId {2cb47cca-c304-48e7-9c9c-3af9fe98794c} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:4340
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3036 -prefsLen 34824 -prefMapHandle 3128 -prefMapSize 270279 -jsInitHandle 3132 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3084 -initialChannelId {59daab8c-8fd8-491a-bacf-d87b5a9a2d2b} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:5552
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4956 -prefsLen 34931 -prefMapHandle 3120 -prefMapSize 270279 -ipcHandle 3112 -initialChannelId {fe19f906-afb1-4ed8-92e7-8aff35470460} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:5312
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4956 -prefsLen 32819 -prefMapHandle 5028 -prefMapSize 270279 -jsInitHandle 5000 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3032 -initialChannelId {40082ac5-98d6-4463-9c35-b74d111dc7de} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:1744
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3052 -prefsLen 32819 -prefMapHandle 3720 -prefMapSize 270279 -jsInitHandle 2880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5132 -initialChannelId {ed23f727-0d23-43ff-ad9c-0b794b02404b} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:5248
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5536 -prefsLen 32900 -prefMapHandle 5540 -prefMapSize 270279 -jsInitHandle 5544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5524 -initialChannelId {9bbbcb48-734e-43d8-9b91-deb1ba9135ff} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:4128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2a4,0x7ffe5513c188,0x7ffe5513c194,0x7ffe5513c1a0
      4⤵
      PID:3744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1728,i,15754867358030300870,13294440706203586189,262144 --field-trial-handle=2212,i,12261868070896636603,18396003363721554268,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
      4⤵
      PID:2312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,11108790782145175059,9123259313284640914,524288 --field-trial-handle=2212,i,12261868070896636603,18396003363721554268,262144 --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:3
      4⤵
      System Time Discovery
      PID:4356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,6036708441971368444,4693451110304058967,524288 --field-trial-handle=2212,i,12261868070896636603,18396003363721554268,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
      4⤵
      PID:1828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3048,i,17678992283610123802,4131467472514325060,2097152 --field-trial-handle=2212,i,12261868070896636603,18396003363721554268,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:1
      4⤵
      PID:4792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3068,i,11755274265300442832,6810946760038108544,2097152 --field-trial-handle=2212,i,12261868070896636603,18396003363721554268,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:1
      4⤵
      PID:5068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3392,i,11970552790626510360,18171333019133063031,524288 --field-trial-handle=2212,i,12261868070896636603,18396003363721554268,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:8
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3236,i,13226653300379728531,7109704565344995041,524288 --field-trial-handle=2212,i,12261868070896636603,18396003363721554268,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
      4⤵
      PID:4372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3412,i,5344227032492096773,3202067032952474004,524288 --field-trial-handle=2212,i,12261868070896636603,18396003363721554268,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
      4⤵
      PID:1380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3484,i,10465352378120800744,13853004442513674561,2097152 --field-trial-handle=2212,i,12261868070896636603,18396003363721554268,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:1
      4⤵
      PID:4652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3504,i,14440533721143414634,12564702077768115407,2097152 --field-trial-handle=2212,i,12261868070896636603,18396003363721554268,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:2
      4⤵
      PID:6036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3572,i,17570523615170307440,6590586539833188758,2097152 --field-trial-handle=2212,i,12261868070896636603,18396003363721554268,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:1
      4⤵
      PID:5824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3620,i,8024485235285166023,13384557983734327920,2097152 --field-trial-handle=2212,i,12261868070896636603,18396003363721554268,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:2
      4⤵
      PID:8
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3692,i,6519957772409773876,4673824489119834298,2097152 --field-trial-handle=2212,i,12261868070896636603,18396003363721554268,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:1
      4⤵
      PID:5664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3704,i,3295121468081017758,3314550660581041783,2097152 --field-trial-handle=2212,i,12261868070896636603,18396003363721554268,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:2
      4⤵
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3716,i,6515533946702873567,3229169784183303837,2097152 --field-trial-handle=2212,i,12261868070896636603,18396003363721554268,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
      4⤵
      PID:1100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3732,i,15391509283212439062,8344596756232051319,2097152 --field-trial-handle=2212,i,12261868070896636603,18396003363721554268,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:2
      4⤵
      PID:3668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3736,i,17162614587389586332,1697801899358453414,2097152 --field-trial-handle=2212,i,12261868070896636603,18396003363721554268,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
      4⤵
      PID:624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3788,i,6086914352439596541,10640820747707850379,2097152 --field-trial-handle=2212,i,12261868070896636603,18396003363721554268,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:2
      4⤵
      PID:456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,8728099549862824090,16066806043298263811,524288 --field-trial-handle=2212,i,12261868070896636603,18396003363721554268,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:8
      4⤵
      PID:5836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,3161629073652504315,5277807574730731699,524288 --field-trial-handle=2212,i,12261868070896636603,18396003363721554268,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
      4⤵
      PID:5336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,13820950343171135478,9587881277473002022,524288 --field-trial-handle=2212,i,12261868070896636603,18396003363721554268,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
      4⤵
      PID:2968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,1175166655503845132,2050272202284962812,524288 --field-trial-handle=2212,i,12261868070896636603,18396003363721554268,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
      4⤵
      PID:1112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,1175166655503845132,2050272202284962812,524288 --field-trial-handle=2212,i,12261868070896636603,18396003363721554268,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
      4⤵
      PID:5896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:1380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7405204c8,0x7ff7405204d4,0x7ff7405204e0
        5⤵
        Drops file in Program Files directory
        
        PID:5852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        
        PID:5784
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x218,0x21c,0x220,0x1f4,0x224,0x7ff7405204c8,0x7ff7405204d4,0x7ff7405204e0
        6⤵
        Drops file in Program Files directory
        
        PID:4004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,10067295784878945814,2166859687835975504,524288 --field-trial-handle=2212,i,12261868070896636603,18396003363721554268,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
      4⤵
      PID:3232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,14549330188721871456,11831314544372863525,524288 --field-trial-handle=2212,i,12261868070896636603,18396003363721554268,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,1580624021130549394,2952918910797783147,524288 --field-trial-handle=2212,i,12261868070896636603,18396003363721554268,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:8
      4⤵
      PID:796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,5949081908783477738,5081250833457501550,524288 --field-trial-handle=2212,i,12261868070896636603,18396003363721554268,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
      4⤵
      PID:1420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:6472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ffe5513c188,0x7ffe5513c194,0x7ffe5513c1a0
      4⤵
      PID:6516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1940,i,2336369425153025521,15769926002836868057,262144 --field-trial-handle=2480,i,2728444031850941174,13988657417020013439,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:2
      4⤵
      PID:6820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,17195783148848740675,12409332809853940835,524288 --field-trial-handle=2480,i,2728444031850941174,13988657417020013439,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:3
      4⤵
      System Time Discovery
      PID:6836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,4017250134595829866,5708829239841530388,524288 --field-trial-handle=2480,i,2728444031850941174,13988657417020013439,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
      4⤵
      PID:6844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3304,i,1808435910179111565,15347368075461287209,2097152 --field-trial-handle=2480,i,2728444031850941174,13988657417020013439,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:1
      4⤵
      PID:7056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3316,i,7637191774998062669,13254940215537137839,2097152 --field-trial-handle=2480,i,2728444031850941174,13988657417020013439,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:1
      4⤵
      PID:7064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,8101988586704224463,10249644394283837556,524288 --field-trial-handle=2480,i,2728444031850941174,13988657417020013439,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:8
      4⤵
      PID:6392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,2290064204525657206,10136537658149899577,524288 --field-trial-handle=2480,i,2728444031850941174,13988657417020013439,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:8
      4⤵
      PID:6412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,16406912482317166993,4073499252942975066,524288 --field-trial-handle=2480,i,2728444031850941174,13988657417020013439,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:8
      4⤵
      PID:4828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3664,i,4668507208549301921,9888802390843383764,2097152 --field-trial-handle=2480,i,2728444031850941174,13988657417020013439,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:1
      4⤵
      PID:816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3688,i,6186322139212434280,10452492298631189879,2097152 --field-trial-handle=2480,i,2728444031850941174,13988657417020013439,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:2
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3704,i,13268628004259503340,3734689821848522381,2097152 --field-trial-handle=2480,i,2728444031850941174,13988657417020013439,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:1
      4⤵
      PID:2188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3748,i,739061979697628271,7121334312222676293,2097152 --field-trial-handle=2480,i,2728444031850941174,13988657417020013439,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:2
      4⤵
      PID:4192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3760,i,7871889718375274166,12013988226786707432,2097152 --field-trial-handle=2480,i,2728444031850941174,13988657417020013439,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
      4⤵
      PID:5776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3780,i,16319669154546522502,16757769026649970598,2097152 --field-trial-handle=2480,i,2728444031850941174,13988657417020013439,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:2
      4⤵
      PID:4952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3808,i,8611748304878932278,633770875930109451,2097152 --field-trial-handle=2480,i,2728444031850941174,13988657417020013439,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
      4⤵
      PID:1296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3824,i,6853711020281724998,13499440045506533737,2097152 --field-trial-handle=2480,i,2728444031850941174,13988657417020013439,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:2
      4⤵
      PID:1944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3852,i,7963523551920976679,15046234169410394865,2097152 --field-trial-handle=2480,i,2728444031850941174,13988657417020013439,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
      4⤵
      PID:4976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3872,i,10659324323255148010,17186674631051623020,2097152 --field-trial-handle=2480,i,2728444031850941174,13988657417020013439,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:2
      4⤵
      PID:4056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,1043362049168994808,6672857388388203679,524288 --field-trial-handle=2480,i,2728444031850941174,13988657417020013439,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:8
      4⤵
      PID:6244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,631844938461590062,9601392132207266911,524288 --field-trial-handle=2480,i,2728444031850941174,13988657417020013439,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:8
      4⤵
      PID:6276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,15124697660166791238,12597359635461495401,524288 --field-trial-handle=2480,i,2728444031850941174,13988657417020013439,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
      4⤵
      PID:2852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,5504935588599317907,9911205671653783952,524288 --field-trial-handle=2480,i,2728444031850941174,13988657417020013439,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
      4⤵
      PID:3936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,5504935588599317907,9911205671653783952,524288 --field-trial-handle=2480,i,2728444031850941174,13988657417020013439,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
      4⤵
      PID:5112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:2156
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x218,0x21c,0x220,0x1f4,0x224,0x7ff7405204c8,0x7ff7405204d4,0x7ff7405204e0
        5⤵
        Drops file in Program Files directory
        
        PID:3976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        
        PID:5552
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x20c,0x210,0x214,0x1e8,0x218,0x7ff7405204c8,0x7ff7405204d4,0x7ff7405204e0
        6⤵
        Drops file in Program Files directory
        
        PID:6116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,2719202299746898979,2383466910186630704,524288 --field-trial-handle=2480,i,2728444031850941174,13988657417020013439,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
      4⤵
      PID:1288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,11232403001698255452,6706337459418380587,524288 --field-trial-handle=2480,i,2728444031850941174,13988657417020013439,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
      4⤵
      PID:1928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2sfrxh0t.54a"
    3⤵
    PID:6164
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\2sfrxh0t.54a
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:6352
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27099 -prefMapHandle 2000 -prefMapSize 270331 -ipcHandle 2076 -initialChannelId {8228214e-2bfb-4b37-b917-83960c11af42} -parentPid 6352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6352" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:4372
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2216 -prefsLen 27135 -prefMapHandle 2200 -prefMapSize 270331 -ipcHandle 2520 -initialChannelId {2a2d217d-d52f-4797-98c2-f3296940856f} -parentPid 6352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:4408
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ebb591ba-6828-44af-a0be-0d301ecd5bfd.dmp"
        5⤵
        
        PID:6684
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2740 -prefsLen 27135 -prefMapHandle 2256 -prefMapSize 270331 -ipcHandle 2296 -initialChannelId {72708e0b-be16-445f-bcb7-f88d1a4a9d87} -parentPid 6352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6352" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:6136
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1a948312-2e59-4b73-a064-c75334722981.dmp"
        5⤵
        
        PID:1532
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2964 -prefsLen 27200 -prefMapHandle 3344 -prefMapSize 270331 -ipcHandle 2824 -initialChannelId {9dca1edd-e18c-49cc-97ec-55c1e3061faa} -parentPid 6352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6352" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:2552
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3908 -prefsLen 27276 -prefMapHandle 3912 -prefMapSize 270331 -jsInitHandle 3916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3924 -initialChannelId {5e82fbf8-0100-46b1-a096-ef9498bc9d72} -parentPid 6352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:3316
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\aad4bfea-c107-415c-b193-a726e5335bce.dmp"
        5⤵
        
        PID:6932
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3756 -prefsLen 27276 -prefMapHandle 3748 -prefMapSize 270331 -ipcHandle 2964 -initialChannelId {5e392dc9-a63a-419e-9de5-76d36a09da1f} -parentPid 6352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6352" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:940
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f6c867fd-ef12-4c6d-9b63-3be38e2abc16.dmp"
        5⤵
        
        PID:6504
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4296 -prefsLen 27276 -prefMapHandle 4300 -prefMapSize 270331 -ipcHandle 3424 -initialChannelId {d565e764-e3be-47bb-9aab-762a11e6d16f} -parentPid 6352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6352" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 rdd
        5⤵
        
        PID:7004
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3580 -prefsLen 34829 -prefMapHandle 3564 -prefMapSize 270331 -jsInitHandle 3568 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4572 -initialChannelId {9fff06db-8a23-42e6-a481-e6882bbf7e6b} -parentPid 6352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:868
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4772 -prefsLen 34878 -prefMapHandle 2792 -prefMapSize 270331 -ipcHandle 3544 -initialChannelId {b72e3aab-47b3-4c8c-ac81-4e308fc2770c} -parentPid 6352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        5⤵
        Checks processor information in registry
        
        PID:6616
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4992 -prefsLen 32818 -prefMapHandle 4996 -prefMapSize 270331 -jsInitHandle 5000 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5008 -initialChannelId {409b3a44-ee1b-491c-accf-b485661b109b} -parentPid 6352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:6736
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5104 -prefsLen 32818 -prefMapHandle 5108 -prefMapSize 270331 -jsInitHandle 5112 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5084 -initialChannelId {e359e460-bc51-4a6f-8855-11f5b7ba32e9} -parentPid 6352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:6748
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5408 -prefsLen 32818 -prefMapHandle 5404 -prefMapSize 270331 -jsInitHandle 5400 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5392 -initialChannelId {317a77e9-ee43-43dd-8bea-132647625c29} -parentPid 6352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:6792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30jtzpcv.1eu"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:3880
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\30jtzpcv.1eu /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\30jtzpcv.1eu\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\30jtzpcv.1eu --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe5ed1c728,0x7ffe5ed1c734,0x7ffe5ed1c740
      4⤵
      PID:4972
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30jtzpcv.1eu" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1708,i,5885317454938029479,2434975507696730955,262144 --field-trial-handle=2052,i,9348201990699485537,8939703274592473277,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:2
      4⤵
      PID:3944
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30jtzpcv.1eu" --force-high-res-timeticks=disabled --metrics-shmem-handle=1936,i,5050128647264403776,16365897464604306630,524288 --field-trial-handle=2052,i,9348201990699485537,8939703274592473277,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:3
      4⤵
      System Time Discovery
      PID:4824
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30jtzpcv.1eu" --force-high-res-timeticks=disabled --metrics-shmem-handle=2188,i,5210631982617355919,17494553723533359712,524288 --field-trial-handle=2052,i,9348201990699485537,8939703274592473277,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:8
      4⤵
      PID:3476
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30jtzpcv.1eu" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2876,i,6207755536366863309,16589296070388735054,2097152 --field-trial-handle=2052,i,9348201990699485537,8939703274592473277,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:1
      4⤵
      PID:396
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30jtzpcv.1eu" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2880,i,16322978306002063564,2795319818744099866,2097152 --field-trial-handle=2052,i,9348201990699485537,8939703274592473277,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:1
      4⤵
      PID:4648
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30jtzpcv.1eu" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3264,i,6999292767770482463,16889114975554596420,2097152 --field-trial-handle=2052,i,9348201990699485537,8939703274592473277,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:1
      4⤵
      PID:5804
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30jtzpcv.1eu" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3312,i,16035072340133721409,9234528406060909682,2097152 --field-trial-handle=2052,i,9348201990699485537,8939703274592473277,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:2
      4⤵
      PID:1572
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30jtzpcv.1eu" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3848,i,17354996244968938647,1540718557963645049,2097152 --field-trial-handle=2052,i,9348201990699485537,8939703274592473277,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:2
      4⤵
      PID:1884
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30jtzpcv.1eu" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3304,i,7270636551412499139,17105030516893943404,2097152 --field-trial-handle=2052,i,9348201990699485537,8939703274592473277,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:1
      4⤵
      PID:2264
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30jtzpcv.1eu" --force-high-res-timeticks=disabled --metrics-shmem-handle=4156,i,9828520275410535872,4489841790401130702,524288 --field-trial-handle=2052,i,9348201990699485537,8939703274592473277,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:8
      4⤵
      PID:3756
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30jtzpcv.1eu" --force-high-res-timeticks=disabled --metrics-shmem-handle=5024,i,3904454685419891857,18277152312891874670,524288 --field-trial-handle=2052,i,9348201990699485537,8939703274592473277,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
      4⤵
      PID:2020
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30jtzpcv.1eu" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5084,i,9327704444767473707,12885620283692048296,2097152 --field-trial-handle=2052,i,9348201990699485537,8939703274592473277,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
      4⤵
      PID:6204
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30jtzpcv.1eu" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5104,i,3918931847396514305,10245776219135276197,2097152 --field-trial-handle=2052,i,9348201990699485537,8939703274592473277,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:1
      4⤵
      PID:6264
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:1164
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff6a5c855a0,0x7ff6a5c855ac,0x7ff6a5c855b8
        5⤵
        Drops file in Program Files directory
        
        PID:6488
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:1100
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff6a5c855a0,0x7ff6a5c855ac,0x7ff6a5c855b8
        6⤵
        Drops file in Program Files directory
        
        PID:5184

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9f9c7c9f-e679-4bbf-a2e6-54816ce69dc5.tmp

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\9f9c7c9f-e679-4bbf-a2e6-54816ce69dc5.tmp
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_installer.log

Path C:\Program Files\msedge_installer.log
Size 128KB
SHA256 2796c6b5b2d7af8dc6385270dfdc3da72d0d60fa16535c1460072146d330b314
MD5 54ea5d06054209e6f958a8f47143d7a2
SHA1 2d2ea84018f8c59c833fb37c8dba352d426aa9ef
SHA512 315c2b4dabaeea7f565d5cca1df2f34bf4039e72e7430e59ac0e93c89448e140e819f7a9f417fe0691206d8fcfc1cd19b968eb450fc702d15d0f01e9cf3c86ad
SSDEEP 3072:nhqrBgJmDOj4snwdzKx7iHY/IM//M9nMnF:nhqrSnwk7iHqIM//M9nMnF
TLSH
T160D321A52F0A4157BF87BE9E2643393A7DEE1683D3C406E636BC1001B0C6E75416B5FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9hv4mshu.default-release\activity-stream.contile.json
Size 4KB
SHA256 358c72a2f5f8044a22cde6dda0d779ec1934f2aaa678309c355685661f40f50b
MD5 3b5aef5e2d65d4c2d0b364afeabc3958
SHA1 92e4782b2d536b1df808d76ded447339275a13e1
SHA512 b24ca7d94656da2a807dfab8be91584b4ebf870dd7a1a4cc2890da95ed2a159907e8ba621e24b25d97fbc4f504b824a2370677e92d84a8186e26636d65bb800b
SSDEEP 96:KA6tJja8yd50VvPizlYmGYBT+mR5kmCL8DlykNol:KxtpabdWVizlhZQmR5kp4lPNol
TLSH
T11CA13CDFA83CC54703326BE49C5F277DE047B14BEBF5D884F7954811A88914F81E9A84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9hv4mshu.default-release\activity-stream.discovery_stream.json
Size 76KB
SHA256 ca33fc53b5bb150271c1fb7796112b88b976b25dbbb17fb6e80a4669e7582de4
MD5 cc53401b858ca251a8ed6cc4a93af3ba
SHA1 e82f6c53814f549ebc9572f03adf1bfd87087b7a
SHA512 e37bd8c834c4680f534660affd97c7ad4b9638b7193e7432eef12a8fca78eb1adedecf21a9047660b9e412bcd499f8c84070a99e8f8913248c76a8ce58db44c0
SSDEEP 768:Lyn+3BE542ed6YF4e2Vug1CVlvf//keuAV0FtRO48JiGd/8iiuuaO9jSi:2naE56hn9V0jN8JiG58iiuurSi
TLSH
T1E6730AA397A8B2BB1B9037C72C0F766B56D2415AE78902CDFCEDCA1C81CC654113A5BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9hv4mshu.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 79a644cb0c6bbc618617e11ce1dd06e874f1dd857a480efd82cca3c8ec4a9069
MD5 0db24f230adc9482f1a9cfb009b4f7da
SHA1 159c53a1942250b46dd58c0771312dc5a2016eba
SHA512 fa249e3cf6ee41b4c6f2e20d984148da1f629aa15ce5e77bd64b703e1695018403316ad546032690fef1110652a312cceec5583af9c1f6a0d60ea45a0093f4cb
SSDEEP 384:HHMO0iO024YrFuhw+5EL1pPsac4j0lpDII+IXmXt:nrZYrFuK+5EB9sac4ID8Lv
TLSH
T10F527D7DAF1138A90A27D194DCEA5218CE08E6BFEFD2D16606143C45C680778B8F64EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9hv4mshu.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 170aca5e51acd8ceca776200a8944b97274ab39a40e9746805cf677a4b1ce54a
MD5 91a049583382ff738eb117dfd427f169
SHA1 5c7de212e944e132f35ef68fe0bc8b3abad7ca79
SHA512 dacda9be71ed66d443669bceda5249ab82cc5e3bf68da00c1a1a52eea6913d6828b5ccf025d880c16e260aae8d796b01466e3806536309d97d21549e4d02dda9
SSDEEP 1536:jTrliGj/DDqZQY9OO/P8UI0LWN4ExiP15S7a53K0oLkpsZw3OFhZ9UyXEjQv7suX:j3lEQYjF9y4EAnzpNOx9U70sqdJ3
TLSH
T110A3AFFACFA2CE3C55FFD02D5A82893EFD262404B3A73019C963671461C6BB87675648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\30jtzpcv.1eu\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 ccefdc2d816137b5954b591e8954c392e0cf27388fef2e437991e3999d9ad3d8
MD5 efa437b6fe5031994d5917a91c19990f
SHA1 d46a1115227ead4e92346b600c28e9ac72cce96f
SHA512 ab52261f15a3f21728b41b4765da5ec6c9e71051b720204ee2decf6f09ac8a0c9a5c12313d921f232f1e698a7425d34415eca8db21a37f423535806bcdf238bb
TLSH
T1F3310AC7644047BA52EDDAF37F6B0C57DC12210107D4A440599F56E17FEEEC86015478
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\30jtzpcv.1eu\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 bff87e21fa845d8ce3c266db6d904e9c7a3bf9fc2b95a1f1a5ca375f3fdb045a
MD5 097f67b0d583db3f8487ac27379c7eae
SHA1 18acf62fb9bc4e95899c4597cd72de66b6bef763
SHA512 0b6b323fa14e5b0dd6bb87fce791bbd0b7a867988d8332385ba76a35d93d4dd5b67f6be9be5a69fbdcd5da68c30bc840712daa83b9a0187b727d963dc9a9a045
TLSH
T15E514C54BEF34CB2EBC67C7254E65BF5A564C1E62D407A0C86B9CA1245BDD410CCD003
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\30jtzpcv.1eu\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 3KB
SHA256 abe4eaa1a6fa423bcef61b423dc72386a9cf1968b1041de5270c56a7780254ad
MD5 8e589c60e0ba95ca1b178bad0a8298db
SHA1 d981cd3f9eb63636471e3bd4c0fd7585460ad6fd
SHA512 e8c7b5d340e698f3b1b42d6c3b7653b666e0add095611c00f502782928eb788070ca977b54b42f9515127861e55138a3cc0f02540f0bc2e44694fb0ea595ee34
TLSH
T196517D1B4B8AC56A0E53770E02E57ED454996C569EF383CC2106E7C0081A99F43EBBE7
MD5 SHA1 SHA512 TLSH

Submit Download

cec872b5-c346-4497-9a22-b4d1b880e201.tmp

Path C:\Users\Admin\AppData\Local\Temp\30jtzpcv.1eu\Default\cec872b5-c346-4497-9a22-b4d1b880e201.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_outpx2db.zmk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_outpx2db.zmk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

e222138a-c811-45dd-af75-ac4643e2535a.tmp

Path C:\Users\Admin\AppData\Local\Temp\e222138a-c811-45dd-af75-ac4643e2535a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\oglkfmm0.zi4\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\oglkfmm0.zi4\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\oglkfmm0.zi4\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\oglkfmm0.zi4\ShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\oglkfmm0.zi4\ShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\oglkfmm0.zi4\ShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f\Crashpad\settings.dat
Size 280B
SHA256 97d528d8981dadc15844c157330d0571b7181207a4a507b8bac17f65f3c65a83
MD5 52970202d9f3c4b3f5e85b957743e659
SHA1 843e6ecd2b1274deac7496e51bbcaa4e6639b53d
SHA512 994627b381e9d57bed255ba7256f38a542f0dee2270f7cb5bf3d5f8aaf0263d62641b51c330a431c0539bb9321b0c178298b72aee73f134c5d1dcf8c4d70a364
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f\Crashpad\settings.dat
Size 280B
SHA256 da65b1747f40a9112e442a175d9dececf5c1a2392976eec99920e8aedc471b93
MD5 0c31ffe7f4c0931a31d745fd63f09324
SHA1 29fa7b997d67ac716e9d0c94513d5db53a04c4b5
SHA512 bacf7f891029329c3b54201bfb2e2cb212be75f28e4123c17465bfb005558ff6de0c84100b21284f16bb2c54e4ffb8dcd8b6a32b67028b06fe16f742276fc2f4
TLSH
T1EFD0026477946076D96D343EEF94DBA041B4CA63A10A8AE0C654230CAC5AD3239CAA97
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 5756c4b64b3c6d17c6df59c27db1c5247eeaf50d313dec22ddfef5e97efc91fb
MD5 ac561d7e074b9ab2f40004199e0731bb
SHA1 a8d8f20d2d78ed95912168175991d990bd17e194
SHA512 aa7f873c09328f81c684bea6680a4f5bfcaba15455a8c8e4ea155959e2351fe5677c68b10f3d8835007b57d5af68fc785ea916902032cc88b4573ef5be7684d0
TLSH
T109D02BFB1CA608508D7F83E2143154900606BC588D45AEAE101DB14738B121A3906C61
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 47ffcef8c3fa6db079205239653151714cb29f7e3ba105b5fa9f99b2f797b687
MD5 05898359cd9776233b77ab972decc413
SHA1 4923b6fb4f9a3920e12980a5dcc549f73a89bb60
SHA512 aa857fa9e5eeb1b1e549ca40c8d6cde0414259b25f590a79e25603e413d1e44f61bdd149e3f81239aea8fe3388d0a0e3eb4004cf37d614662d1fde2b762d07da
TLSH
T146E0D8BB2DE75850AD7F87D5183144E10645BC58CD006D5F542BF1A734B26592446C26
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58e337.TMP

Path C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe58e337.TMP
Size 153B
SHA256 9fdf0608ba8c31da7239981a8facfabfe1f4ef39dd628f4f67bd5b60c691750b
MD5 052b68216e1c21808da1f8896e6e9410
SHA1 0c41c7fbed7b730eb3b7f276c1be9a3e0731d309
SHA512 ad02f49620279646eafde792f4d848496ff4e7c47b9b692d804e7cc2837cadaf15112799a7a8f207f643e35448c2d231dff3beda7675ee4755d59c6a63466bbb
TLSH
T1E3C02BFF1C640440CE6742E1003154E542133CCC8D50AF79401EF1C378B01233216C31
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f\Local State
Size 4KB
SHA256 744635e82c9ba41808b1b0f5be65e4077b905c50a32bc8e23568903537d3c1af
MD5 93a2d5fbb4b5e1d111ced7fe8d1f8573
SHA1 4427c36eff0661a23773221585c47f60ab8034e2
SHA512 abf1271585d7547af9f57bf72fc1db0f970a5c30719096d4695311dbbf58a59a5d0c86ce2fd1f1a9b35f611266b6ec248d1a3069368ead05e3276a4558f3c438
SSDEEP 96:TqGNkH5sFfpTuNG1uIfDjfBDPIXvDj5sGw0eUngxNEq4a:2GNG8T5XNzI35svqgt
TLSH
T1BB81A5727824EC375EE6AA54B48A27939E3870B3DD02AF54F5D8431C04EB34C3B4A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f\Local State
Size 5KB
SHA256 9501889da3a0ab494cfe2f6c9b13693e4a66b91ac75e1e3852725b5a15b79625
MD5 3455b47831f7be3ee088000d060d156e
SHA1 9936507b888f2e1647c2fe32d52110abc9437a01
SHA512 0e5aa49b96da2c9395164eecb1886d9d4a49379887a8c8b80d570116dade999a784b14d4e66f7f5919198574acd8926d239c35d91375cda28cb180b586f95ad7
SSDEEP 96:TqGNkHOQsFfpTuNG58Frh/cInURoDotovVF8DjIBDPIXvDj5sGw0eUngxNEq4a:2GNG8TWooDUwqwzI35svqgt
TLSH
T1FDB1C8726874EC375EE6A915B4CA27536EB83073D985BF98E5D84B0C04DB38C274AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58d944.TMP

Path C:\Users\Admin\AppData\Local\Temp\pqcaxuzp.j0f\Local State~RFe58d944.TMP
Size 1KB
SHA256 a390d6e073be2f10420ef2cdcf03bac0b7fc4f30c85767d00e0c323316b7b9a6
MD5 cedbfe5f4fe32b19af341499f3de2f47
SHA1 7c1486b6caa52b9671566dd2f909e8fa4d9d07fe
SHA512 71a3dc1d9ce5e5919dc9294a50435b0216b5c8fb37f7eab8f74a8721f5fa149196343520c95f215ee320198577d19d64707cba481544da479260ceb275c0a259
TLSH
T16F31C8717C643D73EC91D663A24DAB531D355572C2429E44A1DC871C01EB39C324AC3B
MD5 SHA1 SHA512 TLSH

Submit Download

39ae320a-41af-4b5a-b8e8-2ead393c249a.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3880_67674304\39ae320a-41af-4b5a-b8e8-2ead393c249a.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38bcc28b-9db8-4045-8d5d-29d8f788e983.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4128_106100385\38bcc28b-9db8-4045-8d5d-29d8f788e983.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4128_106100385\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4128_106100385\CRX_INSTALL\manifest.json
Size 962B
SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
MD5 e805e9e69fd6ecdca65136957b1fb3be
SHA1 2356f60884130c86a45d4b232a26062c7830e622
SHA512 049662ef470d2b9e030a06006894041ae6f787449e4ab1fbf4959adcb88c6bb87a957490212697815bb3627763c01b7b243cf4e3c4620173a95795884d998a75
TLSH
T1661121366E2FC4260AE00698DC51308AF92453ADD380850E35BCE42E5B744FA430631E
MD5 SHA1 SHA512 TLSH

Submit Download

b53f7024-ab67-44ef-b76f-f9329f48e1d2.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4128_476229897\b53f7024-ab67-44ef-b76f-f9329f48e1d2.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd\Crashpad\settings.dat
Size 280B
SHA256 629487af6afa49d4773ac31ac09dbd2f03564a354752a25ee950f79ff426a435
MD5 d87083300a909779ea78fd96c1bce3e6
SHA1 4ccbbcd3446ddd6fa37e7fd74f69af5b51cef7dd
SHA512 c36dc60e3970c123d7d4f02b948c3e6f030ea535b5d998bf6cd6e59cdd75f92c84c0c8ded29952cd6cb0f2fdcf8955e534f00944158325696abc85320e6e60e5
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd\Crashpad\settings.dat
Size 280B
SHA256 34ffa6d7071344fe31cbe61dcc5ff0097e5a65505a579dc2dc9e9d96591f2c25
MD5 983f34e70f701c64e748fa2089cd06e0
SHA1 a7d0db0eeb64f83d345a46861b186bd40a56020e
SHA512 5af50751392d5cedb901b405929620965662cb76eb077ec64f897ba526f586cda409590b3327743fa5c9272fa76d767820a520e7dcd5c77e0d57fdd8ad38bbd7
TLSH
T174D00268B75256D8C8991A3F8675860E151C9B54805E71CDF523A44D1E48607261BCD7
MD5 SHA1 SHA512 TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd\Default\Cache\Cache_Data\f_000001
Size 34KB
SHA256 afd4782e0b7442187ef3334e0dd04804eec2f7e78b66f2486e9aad0e2c0f415d
MD5 86838477fc764344efbfb59db3377e02
SHA1 975ba960ae9f272dcbbffa0bb4846ae66a217bca
SHA512 c070be0783368b0cfc2c82c404a77b3d3a54d4fa7276947675c29af0c0f1596c0820ab6b7f55ffef78204b6270599e52685c465a5e5a14719affedfcc6e5171c
SSDEEP 768:UyU08MPVeXS+IFU8EHGmvKhcxSDctxyvsi0PD:IsdeCV5mG3hcwwLyX0b
TLSH
T1AFF2E1309D56284B8376EC684F46B9E2D4953252873AB157063E974835F13ECB3899CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd\Default\Cache\Cache_Data\f_000002
Size 97KB
SHA256 08c1ade001a530f1e243f27f19e1b070ac4b43ed38dd3bb1d7c40715dc4c87f2
MD5 171a26291b479857a5abeaece2104b09
SHA1 82a1796ad885412da94a5f0f15e91f3e07ca888d
SHA512 9ca77cc7db39ee4dffae42300e1494f9f8fbd6233d7740e9e9d5679b7d8979a58bc8ea510262719af0b4941a62584cafc404f0e8a875fa90baa0a9c1a5af93ac
SSDEEP 1536:wq/tCttbQz328dc9mqGiTLFu5ptbSOcOL1Rnz/Cl0jMHweWcPJsD/gPG2wMpatK:wq/tCjbrYUmqGiTLc3BBHMHweEkw4atK
TLSH
T10CA31289F732DB1F9313943896AC73046FC80367244986FE104FB9D32EDA55B2276D6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd\Default\Cache\Cache_Data\f_000003
Size 401KB
SHA256 569664398afd2d61516d4e79e6e62738f2f03a3d8821bcdde9b6268c8dbe9f75
MD5 4ff5bd70179ef5269c1728dbdbf74a07
SHA1 4de4e59a7b27a5d9905cabdbc4d0a7981241739b
SHA512 b3a2bb243f6c5ef34e2b2eae052b0d4c2fa9037b55e9038f5b76bc376b746f746f1cac71ab74b9f2d6353e24f808b549b658ad9954f1ed6d63e03db651c5cfa8
SSDEEP 12288:P6JUnWUGAop/SfI4Gl97/aGPVM0LB2mMSj:PZW3AtQ597/9tP4ij
TLSH
T1D7942370883BAE4C1D5F3738986FD93005A4ED37606B02C9D25DE969E8043977FA9E0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd\Default\Cache\Cache_Data\f_000005
Size 68KB
SHA256 10b42aed09380e9e8dbbff509acea3e1a3d5dec55ad67a7762d0ad134aa73e6c
MD5 4a93e1e7966665fe1c220053539f24ad
SHA1 f9068912a5c403d85a47a070c8245d9d85b055de
SHA512 238c07f8a77eb2403d9ccbf66435f3d2732430fff02ac4569a5c580d7575d22be0f3bf356f46ea70f8ee88fd3ee09d8f2b86af195c333ae868ddcf1517bbdd10
SSDEEP 1536:kv7iX/3S9HHJYdpdKl0wgwHMVFn85E7B3k+g2qiyyyg:kmv3fdG0wqVFn6g0sUE
TLSH
T179630207769844C18ACFE9DF121EE523A52073A09242A7DE331DEBF4D7B369358A51B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd\Default\Cache\Cache_Data\f_00000a
Size 27KB
SHA256 d2fc1c6ebd88fb175be2c5dc3c27741e32df41e8c05e92184b3cb9ace6753782
MD5 ea242e020e5e5815ec0941667295bd2a
SHA1 78ec8f478a64a4c373db8295d378efa0d6a79684
SHA512 df022556ed72994d5d6ebd480c826ef722812e0b4e00764f74833a24aa6fa8ff1ca4c776fed06ec6823942082926e1a2afd9016589c82298c811031f345989ac
SSDEEP 768:XWm0HR/ESa4tuUsaCGIbZhLLsaETud7yj:GlH04Ypd9xLsLTfj
TLSH
T1F4D2F28F866AC96775CF29143B5D8BD71859F35094483A832F0369D86F9CB3B173B884
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd\Default\Cache\Cache_Data\f_00000b
Size 77KB
SHA256 cb717ed58ef63cb1a17e6baf2f0b65323ee6ef4eab45f4bc6418a49ab041f616
MD5 91d8b2b71cc4844e7b112d70950130ba
SHA1 4ff393a5143703e1efbca1c88dabe70c09ab8641
SHA512 6487ab19079d37682a53b8771ce62dcb0a8d0c04833ef41fbb9fa6479131aef8dd799b04f3912324ad877ce11a95aee9a547f12fe252fd0f1305d23094129538
SSDEEP 1536:3RJ61f+DTQZNEeSIawDgnyIew4EmN9dKj6iRWTKKnDUOusR6CZ:BJOEQZqeKmhIeXpfdKJRW7nA+oM
TLSH
T13E73025ED0C1E372192B5B63C59E7BEE97D910CB426A6FAA3D1F091236090302E55F1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd\Default\Cache\Cache_Data\f_000011
Size 19KB
SHA256 273db3d2dc34bc331aff134de65ef398456d47c846d8b48e53ce635ec85e1710
MD5 a004ec3830a6fa499ffab8684d528624
SHA1 0cf23548fe52319b3f101339eeb61d0de51ceb68
SHA512 96796228d76de17ee74720d53b8b2c6406a854b1b4475dfb2a08a36e2dfdf5ae28d88fcfe0e4e15e9e89c06236c0fb40577fe08528dcfefb8961c7ee7803e7a0
SSDEEP 384:1wWSHCxqRXm5+W3sARIm9VmhlxAJyicv+ElHUcZXvNx/NQUJzAr1DUkT3lg:bSH1RWlImOxviq+El9ZXFx/PJzi1DUwg
TLSH
T1A692E0FE95EDD2940CCA5CC64AD82A09681DFBD24D6A34C95A6E2D9DC0272C18C4FCE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd\Default\Cache\Cache_Data\f_000013
Size 59KB
SHA256 221be090e69a654c8fb404247bb6a9c791b91fdb2d844866699d88e3776de089
MD5 7fc3f92cc0b3de86dd761b413ac7208f
SHA1 43c65aff43313e43d3eb2dd3318371e8908cbd1b
SHA512 5cbd3bfa6abbcef92b261082358ce7dcc4de8775de3e3ec18cd018acbadd700358ea051706cc290e0ac378fb7d845889ccd9427161c63fca06969a56262831b1
SSDEEP 1536:iNsJI2JNsN9rHAA5rwSyVRGo0APMS9VIu1KY0qel/6ga:7I2Jm98A5kSiRGPA5VIu1H0F6v
TLSH
T14553013146EBCB352B6C97B50FB0AFB466A349449F039A25A4ED1B1FF35347F85090A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd\Default\Cache\Cache_Data\f_000015
Size 72KB
SHA256 d7d0ee585178d3c2c548e6c645a9af427c25d020ae71f3269a6c9736117d5b08
MD5 f4205b30278168c499efdfa4c2fd039b
SHA1 efabb5375bb73dc2ca6de38b6171612c439b8ff3
SHA512 ca5144c8b7afb2aba659da7e98fa0663c6ca5159e9cfdfa915c15d17facac890fc74150d8b99cbe27ea9d0539bc51c5dae954a69471284f3056d10e9e8f1f39e
SSDEEP 1536:RxOmCwT27LfWP5fP6dq0FD9LM6DCf8AXTvtauLIaX0gaooP/u3VTnFZ:amCs+WBfpOS6wRa0IalK2
TLSH
T1F77302DD912B3A0BE5FECA1DDD996B3D3C17AC89B71948A54F88C183C6B4F019299C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd\Default\Cache\Cache_Data\f_00001a
Size 18KB
SHA256 d645c80c34c1a6404a01cf74be50231a154b4dc4c17712db70df4eca4adbb1ff
MD5 ac669633b65fef2019145f850da9440e
SHA1 1eac2a10d5792035f8562931fd6a9f3310b968c3
SHA512 b8a7b85b098620d4fe1f01032e00d3cb536739bf6b559e217f60a033865573a81161ea5ea29507cb418724a43f3c24d2fd6f567cd9a00147eff6d1cde6818844
SSDEEP 384:0emvopU1i2sJHUmpaPOXBjd0VU6HSpeUF2NEGr3inG:0CCBiUmYOL0q6y4UFGV
TLSH
T16182D025B888B5E1ABBC9E4B1D66A507746B09C560F1F8F181081BFB7ACB293F478419
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000022

Path C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd\Default\Cache\Cache_Data\f_000022
Size 16KB
SHA256 843b3f1b0a72146f062df1e089b868bb7c96c0713c022eb1dc44270dc81a833b
MD5 b8968455b2d831a310ad58ec94c33891
SHA1 c6bdfbd402f5f4657c31fdbd0546cd5c7bdd2fa1
SHA512 ae96aa8f29fd26687cea3fcc5702e6a1262fcb82edc1bb562bfb724be34fda8c50ba786e7955757253e2745a86324258a0a078d04893d6a195b5bd2724073893
SSDEEP 384:2aZnY9eHIJJnk6uYMUsbUVnCbmwQNQf2BkV+yozA8XtdGiqbQE:2aR/IHKtYVnCCrM2BI9GA8Xiiq0E
TLSH
T11172D04BD93F447A04D47423ACB2C725FFAE6E4A2D49ADD0BEC1AA18C1FB1E02144591
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002a

Path C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd\Default\Cache\Cache_Data\f_00002a
Size 36KB
SHA256 e1d3f50d63dd8ded01a9955ccad5a4ba07b0a2ca974f51783200a324bd0b2c0e
MD5 34dc0e84591f4337a78cc9a157736dc3
SHA1 11ab3af6ac0fca4fe1f32f604c7e4d6fda05732d
SHA512 fd5f816913561c65834315fa768b7aeaaa265df1ac0126649f79cd083c432828301e6f65bd795943ccb0a27ff8fecd1446deb7d01c86e13bff678fb525d30701
SSDEEP 768:a7JJnE1ukVvee1vVo+SeVgkXGGG+IPfDsijr2MsCBqiO8PgiWDa5mJ:mXnE9VBo+YDB5fDJ4CBqiO8Pgb2YJ
TLSH
T14AF2F1468867325905DB8BA2F6413EA4322F6D5BD71B39BD3F04DC2C2F0987FA93154A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002f

Path C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd\Default\Cache\Cache_Data\f_00002f
Size 16KB
SHA256 e58af8601c2a4845672dd0023e4e1c437a3aff7aa9c9b1b2a905313c63e184ef
MD5 a7ae8d2f1ee86238a47e549eded08cce
SHA1 b6ad443b7ff156161fbca64a455ad61854bdbfef
SHA512 1ce92da506fe30bb1577a06bb86675e5a5c5fdd733b35b13f6289586390d9f7dd01eb78390b266a1357b3e96d4867ab627f3c7430e926c314211d991b6bd286a
SSDEEP 384:hQ5lJeu2wteTABEtp+SE09e/JuScVrgvT9PQUNc/s:hkj2V3ef/JuXM9RNKs
TLSH
T13972D183C80C1ED1D04EA01E4773D63ABC296C446A541F1D7E8AB9DE56E8BDE8C68D92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1a2c2ddf-8b3a-4e64-8555-c2f3f827ad4d.tmp

Path C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd\Default\DualEngine\1a2c2ddf-8b3a-4e64-8555-c2f3f827ad4d.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 44b4a6a16b01548d8be8163d4c72c4ed42945357d04f1f01ef7985f104980abb
MD5 05d0ad9c5da9a22783c0188511e288ed
SHA1 deeef9dba476ffbc8106fe8440baca58d0e76e8d
SHA512 9f10562244c991dbcfdb00f6f6702309f986c100a58a355a9745d017d9ab55023c4422ebf9ac4cca9730362795abd79153382ed441b4ca084cc5bc952e46cb12
TLSH
T1E8D02BF718EA0830ECAF43D3887284D904523D948E49AECA142DB6C338713627426C61
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 373B
SHA256 3b7af30ff964610676a70768fab4260b0bebf285d9aa2ed7389e3c4af45307ef
MD5 53dfde1bf5fc18a0e9fe757a6c7755b5
SHA1 8a69076a2524a4fa1120c779786bf49b1b8ab95e
SHA512 98adb0ebd45567793c119780a17652d664c5dd01019fa02bc5abcb3deadce30af1eab440e72e5fa55ebde3d06055b79eadc1dbdd88b455141f78f107bb602b30
TLSH
T107E068F728F72430FC2B43E3443188A904023C94C905BD8F142E72C774712A9342AC36
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59047b.TMP

Path C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe59047b.TMP
Size 153B
SHA256 65ecf183b5e8d9cbb73424dbb4ecbec75fa79ce54d4f63c80eafa5c1a14e6210
MD5 6c66a6894f5c4f214c1dbd26d9ccacec
SHA1 d150fe529b4b0c141b3d621f2178c43b30f0c233
SHA512 18057c5f7bfca4786715380edddae54f8e26302bdb1c66f4c1541ec819e4f539b05711cf47061b3bc5a0359f55d7e48e416102e30d8c5da18fc01c8f1ada90b4
TLSH
T190C08CFB18A90800DD4A02C6803288E941263C888944BC8A002EB5C33030262B012D21
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd\Local State
Size 3KB
SHA256 65880a062fc332e484113334e2f58a3f8cc1add158214321cf5515ca750a7c56
MD5 7518f8d159f57587218c9f8d6b354f48
SHA1 bc77119a43e7a70870f090e82c5cad19a7f4a559
SHA512 87e5af9891e340228d00197d580158004993eebc005c34bfe5e493b6e313e97432a6d669e8125a9624ece71f830d9804732ddf7ac6574fda272ba8ca3ed2afd1
TLSH
T1B28195726465ED7369E65A54B4D936935E7831B3ED02EF88F2C9130800EBB4C3B4E827
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd\Local State
Size 4KB
SHA256 18da28f102bad49f9b685d1ba8c05f551030d8421ee18970cd12e1aab3538bd8
MD5 613b4ff3bf5bb51c0122723ed9c73469
SHA1 231f65c57af65423acb7037027979beb95746c8c
SHA512 c618100252057439a250cb852578530d297bc13a856b1875f44e4c6914362bcbfbcf9a1afdb548135c45ac739fb956b0de3797db008a6a4f44fe53f3bea04fef
SSDEEP 96:rqGNk9QsFfpAtW58Frh/cInURoDotovOBDBB15HvRihbgw0eUnysFaq4a:uGNl8AHooDUwC3KbVqys9
TLSH
T102A1B5726475EC676DE6AA14B4C937436EA83173E885BF88E6D81B0C04DB78C274AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58fbb1.TMP

Path C:\Users\Admin\AppData\Local\Temp\ypdrtgcs.wtd\Local State~RFe58fbb1.TMP
Size 1KB
SHA256 ce63b37351cbe7070920dff4add15a1232fdb97c656fb483a1190bd89a4476bb
MD5 b57ee7686910cd8acabca2462d995a6b
SHA1 ac92409a52e76d5992ad3a7234c001546a2bbd40
SHA512 1f757c13c34c130daef81f3c4151c9354685c76c8f6fa9c1735fe25f2771d7bc4836f4bc0cbb62a08924920c68bf521888551bc45fd7a3bba9ecfe116af52d1c
TLSH
T1E7317372B4A56CB3BCE24A26728D76071E343271E0569688A3DD060901E7ACC630BC3B
MD5 SHA1 SHA512 TLSH

Submit Download

FV1F13HAI0O7J1FJG4MF.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\FV1F13HAI0O7J1FJG4MF.temp
Size 4KB
SHA256 71ebbb7fffcd5969fd6d9ead1c5c58059b2c5f6a95ca87e5971d65f245520e4e
MD5 cf8fc6a2a9ecd79511e313933ba7f6bb
SHA1 9c791f2c280153b6a2e271d75d374e9adc4e6530
SHA512 b45ff8b71bdff601a394f51d67151633a4a5c0f78d770fee6cd41af5713b2c0c473ba6f5c5ce942490beaedd484754eeadcfbd7c21e600393b3211dc0647f263
SSDEEP 48:Ji1docdOD2SJb9QJ9zCNYudLXuHUpJi8docdOD2SJb9QJ9zvYNgdLXuHv2L:YYb+Jo/u0WNb+JviIu6
TLSH
T17B91AD11ABD61A96F3F7997195B36721ABB7F90559189E4D008442480C73B088A7FFB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 6bc8872ddd001b4ebd1cfe518c91513c6115649219ff0e9be68219bfe46b8097
MD5 06c3305c6bda9b9996e7007f3104e586
SHA1 6866bfc45683f226cfa9300512d8295ae4983a71
SHA512 a1efba9e422ffc4617c810935337b0d50eaae269bac44e1e9010c5b821b1a1bd0ef0dd89b58995c55c081f4bf61701663ca614c896848e95d3787d9a9aa087fb
SSDEEP 48:r1docdOD2SJb9QJ9zCNYVdLXuHUpr8docdOD2SJb9QJ9zvYugdLXuHv2L:rYb+JoKu0NNb+JvxIu6
TLSH
T12391AD11ABD61A96F3F79E7195B37725AB77FA0559185E0D008442480C63A088A7FFB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OxGIsizVFz.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OxGIsizVFz.lnk
Size 1KB
SHA256 1e40a6e3cace912ed423dc1ef508be8c8a7fe3c48e54683db0a84809f406a018
MD5 c171fd66c31950462f9b227debe9b8a8
SHA1 7fdd3c00b7cba3793824c9a48e1d788d78ca9279
SHA512 b1ea7237aac23074cf4c4c459568b635b2c012d4c2b310aaa1020bd0a8d0e392f55d2adb467dbe3913905f0706d8ec7312e99e16bcfecac551c67cde0915c25e
TLSH
T17F31B8261BF12B19E3F38A3CB8F7233586B6BD00EE556F9E004085884C64624DC20F2F
MD5 SHA1 SHA512 TLSH

Submit Download

67735939-fe8d-4f5d-8867-672d9d6b5a0b.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\67735939-fe8d-4f5d-8867-672d9d6b5a0b.dmp
Size 64KB
SHA256 4c8f6c6e882f526757fc17b4eca0d498006240b3fe1b9484b5ba8da84497a516
MD5 9b9362ec76735f9f9e79bac191fb3f32
SHA1 da94fdec334bfb75028eebab07ed2f8c75f7a433
SHA512 b3e5884e3bb0a2a1e8c4038a77ae0cab7ba0dc44965d9ce004f41592695414ef3e0e50501520a7b91a841326f530dc152b3fd5b1b2aac3fabc86928a1e8d4eae
SSDEEP 384:TH4TqUS13Zx353kUGzezwbTc23e4YAMDilWKini//BLwBOnjJDyArdHlnG8orcEg:T2qUvXfyi//Y58dRG8oJWJJzAllI
TLSH
T12C53B766B7D11832E5669A311BEBB7203BFAF4A51B53435F1230A27A2C737616C30F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67735939-fe8d-4f5d-8867-672d9d6b5a0b.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\67735939-fe8d-4f5d-8867-672d9d6b5a0b.extra
Size 10KB
SHA256 d167539ddbb82a5fba4b8b292a28060a2536a6f006f645ccf3d3d8ae8c358ad7
MD5 0f8bc284c7870af8679cf88ea746d376
SHA1 a87913864a67bccc7d5e23edd948de187b7abd7e
SHA512 a745372c22468d90506aefba21494ccc1d69803f011a13dec922d602eb4ae1e11b0f064c37386b18b24af432b1f312f186701c1769165358cea1f978a0e7b072
SSDEEP 96:S7WCOlETpsY6pw6FFFdW6H0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7aNcBvtILI5qS:ShOlYcFLG7uvZ8RLuxsPpwlrBfo8
TLSH
T1EB228353874724B7AD5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA4A8F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67735939-fe8d-4f5d-8867-672d9d6b5a0b.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\67735939-fe8d-4f5d-8867-672d9d6b5a0b.extra
Size 10KB
SHA256 87692ae99e51e3864cdcc435c4db71b2035daa450fd2fc91f1df168dbfa00266
MD5 345e543d47fe9d30c03d85ae5f565ea8
SHA1 1a283dd936265cc553fb800faabc9cbf4eceaa3e
SHA512 c9141fa651db01284aa3ed0eb187baafde39bff94c37dfb2b6d13f6fa4196635734bc5848396a22dad8104f99c8f69789ffb4d84bd44a109d7f0c5e7c901447c
SSDEEP 192:ShOlpcFaiR4pmnTYapdVxzPjWBH/4TofKNdaljBfo0bLTSG9/P:eOvcFaiFz1LWBH/4T3aXA0Td9H
TLSH
T19132F831182CD837E7E7AC8DFB392D3AD66D7B1A00E6389C40CCCA4AC1A5478A779553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68dc9919-2085-4c18-b686-61b27229014b.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\68dc9919-2085-4c18-b686-61b27229014b.dmp
Size 64KB
SHA256 b1ebee84b1bbc0e693bf2eedc2225e8558a00d807b867c31e4798f3ba716a3c4
MD5 b32107698902427c759ee51381c54a2b
SHA1 046b8b88998574f204123236241e4c00a3568b79
SHA512 a1b6a28df5ac2df51ae540eef249fcb974854bc9d6f8a04d09ec8313140b01eb494d3557b049aac1afe147b804b7b1684ae53da9a2af8a70c785c2c83bed0a33
SSDEEP 384:0hPV1T5cAjg6j/3w7/3mn/3+Upa98eJhv6/uwDA748JBuolhm/qtpNTF91moTb9a:0ZX5NjX+4eJov8+wb9Q57zbJJzAllI
TLSH
T12753FEA2A3D21835D5A99BF55BD777203BF6E4691B97439B0200A6BA2D733407C38F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68dc9919-2085-4c18-b686-61b27229014b.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\68dc9919-2085-4c18-b686-61b27229014b.extra
Size 10KB
SHA256 a18787a710e040258abbefb2418c6ebc6391213a4a4c94cd85f2aaa2ac51da51
MD5 8d134655ff9a7fd885af350b90f33585
SHA1 40939c9389f674b6b4dc210d46d5a00511beb328
SHA512 d4b4d66c85605863aa7601b743568e3b3aa33467e4c3ade723bd5fcb0364485cee04a80b03b81d0995be51b1f6385b5831dc74282f9d6839397b5b848dee7116
SSDEEP 96:S7WCzTpsY6pw6FFFdW6H0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7afcBvtILI5qwvk:ShncFLG7uvZ8RLkxsPpwlehfoe
TLSH
T1E9227153878724B7AD5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68dc9919-2085-4c18-b686-61b27229014b.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\68dc9919-2085-4c18-b686-61b27229014b.extra
Size 10KB
SHA256 963a02bf804030fc013b1d80a3dd8598e04241f06113925dcf8ea35e2828d3ec
MD5 c693aeaaf6fb0d1b0091e0dcea744305
SHA1 d4e5a2edcd35ce73eaebad91d52f706e47021686
SHA512 0dbc8e886ef39ad540b3d9678b7b1311e97f63b6e2921dd996aeaf0fb8c6c02fd0f7f65f3b98eb92b848cef45b42c7c85295ced7fc5cb098ec7edb388df6b516
SSDEEP 192:Sh8cFaiR4pmnTYapdVxzPjWBHT4TofKNdalGhfoGbLTSG9/P:e8cFaiFz1LWBHT4T3aMAGTd9H
TLSH
T1F732D831182CD837E7E7AC8DFB392D3AD66D7B1A00E6789C40CCCA4AC1A5478A779553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7bf50862-771e-4f5e-8ba5-272ada8ca78b.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\7bf50862-771e-4f5e-8ba5-272ada8ca78b.dmp
Size 60KB
SHA256 e9cb618d8a1458bcd371d20c236368d2dc71fa61010578c1db0f5c5e077466cd
MD5 ca107947d5097bbe6c71c3a44a3e2bcc
SHA1 89ef6ac891731b27f4f3544531dde7c21862d1cc
SHA512 aaba927ad82bc488a217f14d3e89522ce73b07f089bb1be75b8be2b8581358081fac7cb5a1c4ba5a992cb63f84e08951ba1d854ad2f31373a0d270c1f1468a04
SSDEEP 384:3ocQgnYNn3kn3ln3eU4eQH9swP8Ok5kMmDbXpNnEZ17RDL3cbXnJJ7fAllEv:3nQGO+bO5XpQpRDLGJJzAllI
TLSH
T10C53CA22ABD01571D5365B755BE777203BFAE46A1B53835F2212A2BA2C733C0AC30F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7bf50862-771e-4f5e-8ba5-272ada8ca78b.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\7bf50862-771e-4f5e-8ba5-272ada8ca78b.extra
Size 10KB
SHA256 863639c14d36af7e291f3259419b7ab4c5e77639d9fcaf3eb6793afbce2d9ac2
MD5 b6a2ea1d0bd3c1aefd074663ef3b1af8
SHA1 e8a002f996e8752f697f71328a175d0dcc443c62
SHA512 3dbcffa0161521da1701d3fdcddad985235e1aed5e21ea45350dac4198edb51a7e171ec677c5c41bcf2c29561d6050d8a755a7713fb4966203863e0dfee939c2
SSDEEP 96:S7WCOxTpsY6pw6FFFdW6H0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7aEcBvtILI5qwj:ShOBcFLG7uvZ8RLvxsPpwlfNfog
TLSH
T182227353878724B79D5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7bf50862-771e-4f5e-8ba5-272ada8ca78b.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\7bf50862-771e-4f5e-8ba5-272ada8ca78b.extra
Size 10KB
SHA256 35ed8f8e08137addfdb98ce89b4d40a95757353a1c11b22de13853035bbac6b4
MD5 9c7a77877ff61c7b8d192cb99836cf75
SHA1 e1a5245873807b6fa93b22fe055c2935a0b43274
SHA512 11a3df6375ac9aa9714e82d9ef7d9f719cef637a98148f5c75ae04d7b9e7bb9f47db1b80e1c08a9909e36a5ed199ff239868b5700c389de813e8b1d396a94330
SSDEEP 192:ShOicFaiR4pmnTYapdVxzPjWBHS4TofKNdal3NfoAbLTSG9/P:eOicFaiFz1LWBHS4T3a3AATd9H
TLSH
T14232E931181CD837E7E7AC8DFB392D3AD66D7B1A00E6789C40CCCA4AC1A5478A779553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bfc62fd1-1430-49f7-ab30-45765f25387e.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bfc62fd1-1430-49f7-ab30-45765f25387e.dmp
Size 65KB
SHA256 def38bacf5bcc05a0237c24c6dc3d7479e260450f4d63b4bf68f9260fb9ab795
MD5 3410ca8b1b7c3f00a8db8b5d760eff2a
SHA1 3ee373b6540ac429abb3b4bff69accbecf2e6398
SHA512 6a6ac4fafaeb2d811559523c0f61a4bb2f84d05b40270bafae56063dd04145a077a7e5e9cc8f3b463f45baef95ec062b5417a8b72d8dc8d6ccfc56a8f172f2d6
SSDEEP 1536:DAoC72SbcO4YWY6iq4AgXVUutb4Y/jP4BJJGI:UJFVi4I
TLSH
T17463B822E7D01932D9295A751BE777203BF6E52A1B93435B0624A2FAAC723807C70F75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bfc62fd1-1430-49f7-ab30-45765f25387e.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bfc62fd1-1430-49f7-ab30-45765f25387e.extra
Size 1KB
SHA256 39e3899f641fd920fa50bb50c06052990e1258832e50195d159d074068d9da77
MD5 3a7e905e2efecaa7049b33e9f1c1b105
SHA1 dbe7ca66d0fbb87fa4dbeddb24e3c3c512a5352c
SHA512 5117d85c149ce3a46df6ccb97bba975fb7f6de2b96e4337ed55feeea5bc4030f7e3e06f59a9dc0c78b8cdcc07facd15a0793a459c1821c1597f60f3f810b6681
TLSH
T1A83172B3C1AC2D2689578A98B63B2303CDA9B32705D35E0D28CD0A0C818E4DD93669C3
MD5 SHA1 SHA512 TLSH

Submit Download

bfc62fd1-1430-49f7-ab30-45765f25387e.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bfc62fd1-1430-49f7-ab30-45765f25387e.extra
Size 3KB
SHA256 a4d15eb61c91f430bccf28549fef67d14d5024c63bc8eceea479b1e58a28dd70
MD5 5af85baf49eca3692046e5aa32bd61da
SHA1 29574d9bc52451242c9120d8ef1c9a58ab3b711a
SHA512 431e7199650ab290c86fc13c2f11b35af453fb4ce8e1c64c8e4052e3444b43258762e8206e229245c679988ec014884cff2efb7bfe1e952bde511f045c7b265d
TLSH
T168812631106CD9375AEF9C89F3376D0D9D9F735998A22A8C90DAC35D01B8CF46386183
MD5 SHA1 SHA512 TLSH

Submit Download

c60270f4-73df-4682-abc1-91cb930ef292.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c60270f4-73df-4682-abc1-91cb930ef292.dmp
Size 63KB
SHA256 ace5146879ac95d641fa8ca97bd76133aea0db92721752fd2a3cb81eb6621d38
MD5 3a3f06aec5b98c9a393d2b16bce41686
SHA1 7ebe3a007ee73b2e97bb18079e27ed8387f70ebb
SHA512 97cdceafd7a6207e615b84638333186ed8b37f9f964c2fd003c485b687a907fc9fe16b0dfc21f917c44b5311330cee6f49e7db5c2fddceacd13e4e9de0908a27
SSDEEP 384:ATHOzha9D3nD3TD3gU59AKh53BH2rUkIEj9DQZBXAwCLrR/nJJ7fAllEv:ADO9payKh538+3CxfJJzAllI
TLSH
T11553DB22A7D01A21D8396AF55BE377603BF2E5650BA3935B4210A27E2C773587D30F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c60270f4-73df-4682-abc1-91cb930ef292.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c60270f4-73df-4682-abc1-91cb930ef292.extra
Size 10KB
SHA256 ea320f4a927a31b5073b9e56bdefa03257067ad6a11a7ff1f29a5e672c5d4400
MD5 904c99a1cf95ff7f9e8ed83f1a660a21
SHA1 f4a875854e16c06653b4994720ccb361b1ba8f35
SHA512 afe3bb666770e62b35f3baea1fc310039597fec657973adb7c64a244f9fc256e4c3238b4974fa4eca53dc5ecd93ded61d880f7635ecc40d8f91bcb9e782af4b6
SSDEEP 96:S7WCSTpsY6pw6FFFdW6H0Rh7CTvBb1d0FjMLlIrLlhTLlaXv7aWcBvtILI5qwvEk:ShCcFLG7WvZ8RL9xsPpwl8ffop
TLSH
T131227353878B24B79D5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c60270f4-73df-4682-abc1-91cb930ef292.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c60270f4-73df-4682-abc1-91cb930ef292.extra
Size 10KB
SHA256 b4786fe34843e0ef1240884ebc692716cfa313b1f39f58d2bc9f427b79c48599
MD5 a95719942a5f176101f2745522ed723b
SHA1 c9bd0eb5563e2e7a0118e8bef6a7f0d0ccefc62d
SHA512 3fd47c71db105466a2dc50a8fb4b1c941a2db0b6e2c68d3e7dbb11c8e107aa6ffacc791eb6a3f756342ed3482003003dd3501e8ea9db2917aa678515d8358bc3
SSDEEP 192:Sh3cFaiR4pmnTYaVdVxzPjWBHW4TofKNdalUffolbLTSG9/P:e3cFaiF/1LWBHW4T3a8AlTd9H
TLSH
T17122D831182CD837E7D7AC8DFB392D3AD66D7B1A00E6789C40CCCA4AC1A5478A779553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 ec1775174c2a5fa35dc246f4549a5d8cca0cf04957a36cb4054d53f818d5b05f
MD5 464773e073882d56b88cb50af2de6907
SHA1 60c535adcefc8da20743426f1297ac96c3bb5285
SHA512 9178938055c584cc1435d7c79eabcbf8a1083cbb26b621f1ed5c495ad7bea26970800b6e2aefb2978c3a0a3646daef77984403de2e2ff27fbc687fbfdd19473f
SSDEEP 192:t1/66JozGzgCl6mc0da6mOv5zboPWHLfyjWoiD:L/66JozGzgC1jo6dboeHLfyjWD
TLSH
T11FE120A4EA28863BC404127BDCA51F450F7A389A9C4E3F19359C741C2D5B2DD768E2BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 096005a9cb3858b9201fc7638b5fb9a2f26b5b8041235b6f0c491fd1928eab76
MD5 a26337a331dec2b59daf8170ee53f566
SHA1 d08edf155359bc10c12e4f42af0b5cf6c14c6aa7
SHA512 8d8cf92b48a81df6d446bc94abfed01cfef591c5e96248229e649b65dbb3c586f28bfc9b13e2572a509f7a50a031d016033f78878a14797ed09f80fea0a78aa0
SSDEEP 192:Q1/66JozGzgCl6mc0dr6mOv5zboPWHLfyjWoiD:K/66JozGzgC1j96dboeHLfyjWD
TLSH
T1BFE11FA4EA28463FC404127BDDA61F440F3A389A9C4E7F19359C740C2D572DD768E2BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 40e2ab2a238806facd8d1b972832b22f955217581e4463bc8874a9a6b5a1c413
MD5 fa0ff4074b28925653fe6b43dbe90de2
SHA1 f08bb516dfa598eb1030aa912a2c71e5e9d1186d
SHA512 c4c33723d4ec991389f5f198cc50e86554f3a3e81ffcd1a9cfde7aeb949097634aecaa006d84ff2e5984eae8598ebcda01422b1a617e3116a37380cb99dfa5d1
SSDEEP 192:k6mOv5zboGbHLfyjWcxoC1d66JozGzgCl6mc0d:k6dboGbHLfyjWJMd66JozGzgC1j
TLSH
T143D1ED64E638463FC804023BDCA61F400E76799A9C8E7F1932DC740C2D6A6DD7A8D27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 22f9a25132befa0e461870711544cbeb90b1e127bc4f88fe2f9a2ec40f2bab1e
MD5 daa851d0ffdf33e16bab2ebfc28f8dc9
SHA1 54ade968f96733c1e5918fb39517a36712c53d06
SHA512 bbac7a4795881e762b32eb91320113dbd619a10edaef400984cd52f3cdfe128e21eea6df0c4773a845094dea1d0f5d0ada027b410bb3e4eff2be3d1b90dca3ea
SSDEEP 192:W6mOv5zboPvMHLfyjWcxLm1d66JozGzgCl6mc0dz:W6dboHMHLfyjW8Ad66JozGzgC1jd
TLSH
T1C3D1DC64E639463FC808023BDCA61F400E76799A9C8E7F1932EC640C2D562DD7A8D27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 8a255913dcf9ff40fc35db0aee2e350098d470c791cbc8e8d3c290b941e15392
MD5 aa2b7302619854a22c243d1be8e42014
SHA1 9cb1edf0d3cc68202337f44d745f655f52dbc34b
SHA512 e1f4fb40333034c27ed73d56fa92415b3708ab5b89a742ac7b8798d895666de6cc9c0eef9008110866159b13044dca2720bd5eaf31c8f4c215483fd087e626b4
SSDEEP 192:p6mOv5zboPvZHLfyjWcxoW1d66JozGzgCl6mc0dz:p6dboHZHLfyjWJwd66JozGzgC1jd
TLSH
T1CBE1EE64E639463FC809023BDDA61F400E36799A9C8E7F1932DC741C2D562DD7A8E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 5f68e3a8327a53c2b410353d1da0b30bbb4a545c954d6996c57b9f561a9609d8
MD5 27b6ebc10eb515a3cbe767eed844b6aa
SHA1 da3d81b9c32870ecc7c828fe2714628a2b695ad0
SHA512 70c0b314c2b7c031f4ed1892f7fe47b8422e8a574963d3ca1496c9af77a33fa4c0579e6dffafece18e4800c6994922385cd57a2591b6f08ebe16736459f1742b
SSDEEP 192:+6mOv5zboPWHLfyjWoiI1/66JozGzgCl6mc0dz:+6dboeHLfyjWi/66JozGzgC1jd
TLSH
T116E110A4EA28463FC404127BDCA51F440F3A389A9C4E3F1935DC641C2D972DD768E2BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 53b431e1ce914882ca6318b6d6fb544722a8db688c0a2c61a27cbc0290896462
MD5 64bec5698da8ce30b725866ac49fabf2
SHA1 bb83bbfab1b7a753f066f9818546c954be71235d
SHA512 94181a775bbcd436988d1b56b910e245fc9c68f833f922ee5b6801c108de21a710e93005f2dcbf4b6e7582a557974616bab597187d1faa0f34bcf490a8df67fd
SSDEEP 192:k6mOv5zboXbHLfyjWoySF1d66JozGzgCl6mc0dz:k6dboXbHLfyjWiDd66JozGzgC1jd
TLSH
T10BE11F64EA28463FC404523BCDA61F400F36799B9C4E7F1932ED64082D5A2ED7A8D27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 bffd37bca15742977f4f4d06630273103c873065bd4756aa06df0fbdf9146b21
MD5 3e03d90c85b4cc7af6d7e4b28c4255df
SHA1 baee1b2f41fea5539649f6c83c512d8a36952d14
SHA512 0cb0e8666fe91122ecfc508c94d9ca57aca2863dcafff4893b4429c595c64dbb8601575fd6604dcb09de443a6310c3ecc90a7bcca627581af92318721566dcec
SSDEEP 192:B6mOv5zbowbHLfyjWKox1d66JozGzgCl6mc0dz:B6dbowbHLfyjWvvd66JozGzgC1jd
TLSH
T105D1DC64F638463FC808423BDDA61F400E72799A9C8E7F1532DC640C2D5A2DE7A8D27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 f127ff2e71c9ef5988399a4646fff563bfd9d9d246265785e873027012775e71
MD5 3e05f37b9361e3a805b628db794bd2df
SHA1 754fee7d9dd52603d66541a90dd289923ca89015
SHA512 01e448ef9c2523dfebc77c5fe3f379661e4f37ee27c9c16accbed0d089860d429a516fafa0db3852d3ca7c0ca3f28f62668323f328dd4c4177e8f607367d8b3c
SSDEEP 192:n31d66JozGzgCl6mc0dY6mOv5zboPSbHLfyjWoyV:nFd66JozGzgC1je6dboabHLfyjWl
TLSH
T12FE12064EA28463FC404523BCDA61F400F35399BDC4E7F1936ED64082D5A2ED7A8E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 8612e3990a51983a2c488692577ea0d6a2cce07cab4cc6a0527163f5b562874f
MD5 951e43ac3637eb1cecda8e4d3f993994
SHA1 d58f18fbf01a024bb0bd16a22805f49d8ccd1069
SHA512 22b4e1fb77336fe3ff9d9a90ed9d374d7332ce0681a8781cf68e91aaef6db8223539bfd2c6742f377191f321a01407225af42f533ab4b08d183ab2aac5d849c1
SSDEEP 192:W6mOv5zboPSbHLfyjWoyHP41d66JozGzgCl6mc0dz:W6dboabHLfyjWX6d66JozGzgC1jd
TLSH
T138E11064EA28463FC404523BCDA61F400F35799BDC4E7F1936ED64082D5A2ED7A8E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 3653f9bca8c9eb2eec656188be04f8b860c728e67962ff73f6556e11cbde8a41
MD5 6b3eabc6c1ae36c584d0b3d53a08387e
SHA1 d2e5acf18b0627ee8226baf90c74d8bb047fae98
SHA512 31094e4a26b61c713250d1053cfa76378e3ab5881881a836f768322ecf907805db4208a68da1d6d5453b876a8adee1f1a44b658dcbafe6ce300311e5b8080d1a
SSDEEP 192:+6mOv5zboPSZHLfyjWoySX1d66JozGzgCl6mc0dz:+6dboaZHLfyjWild66JozGzgC1jd
TLSH
T1E8E120A4EA28463FC404127BDDA61F400F35399A9C4E7F1936EC640C2D5B2DD7A8E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 fe5341ebaf38c09b8aff67b568607bac241ff6c5743f8639b9f9b6aff89452aa
MD5 219e82997777c3a79ce0c57b3b03335a
SHA1 07bcc139bb76c8fdebbdba80f3c787e060e4dae1
SHA512 f9843721e981cd2bc4a78a14ad34f567441a8a749f384d7c73d7c39a195cb3dee111babd8eb158d6aaffcaa5fad978393e3e232d57c647f867e16f3fa593054b
SSDEEP 192:nX1d66JozGzgCl6mc0dX6mOv5zboPSMHLfyjWoyV:nld66JozGzgC1jJ6dboaMHLfyjWl
TLSH
T1A5E11FA4EA28463FC404527BCDA61F400F35399B9C4E7F1936ED64082D5A2DD7A8E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\events\events
Size 1KB
SHA256 90ffa190523826a13f1bbfeecc2e5dc027d9489628124b8db6728bae2f06997c
MD5 33970adfed8fe3c43d73ee3f9bb795b6
SHA1 98bfaa543256cec32312864edf9dcd93dc5c387e
SHA512 64569a96c1a3f267f52e2eacbf85acf6a624d5e02bd0db9db5d13e26b49c86432c724dd5747071c8142568f5949f0c6f2df73f96c7cc8f0ecb5b608a58c0f528
TLSH
T17B21225C3DB84D3BA9DBE29CB895028E5B558A0708C71D530D02DF8DDDC5ADE326A83D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\events\events
Size 1KB
SHA256 8909ff43e40a0595bc9b1ad8674cc6d24adf8076712a48a87499504d1b031fe2
MD5 e5709b0e663a6b5ab5f51b13f3392060
SHA1 ffd1694ac38b500dad0a801275b6fa47339ddc05
SHA512 da49900b8968ebc42ddea5bc412a054e5702bbfd1d8e9fc1675e90344b9eed007c9ee7e0232f555480cc7e6e9aa1315867e5c43429f3518cab0e391a3e894578
TLSH
T16321285C3AB94D7A6987E2E8B44A038E5365CE0748871C534D03DE8CDDC5AEE316A839
MD5 SHA1 SHA512 TLSH

Submit Download

0bb13fd2-5603-4049-90ef-17a2c4eb9a5e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\0bb13fd2-5603-4049-90ef-17a2c4eb9a5e
Size 16KB
SHA256 81e9f0eefc81863ecda61b653b57d205d176faed3ec8a97558c4983ae4a6f72d
MD5 86abc53d016ca5029ef4ab18bfef272b
SHA1 1bea3e23e1cc9d2619c71db23cbea656e904785d
SHA512 4b5a167b6bdae2b6d724635e37e4146133bf46a6ee21f12241f6740b0511436eeb7e23bf7bdfe3cc18a642d11f4239608857847031bbda6346bbac2536242633
SSDEEP 192:NYTJ1h4WQyCeKUdmbFZl2GyWBPWcguM8OjR7alhR2yEt680boQBAG1LDXg8biUzs:iCWPKUmbl8OR380boQbg8biUJuRz
TLSH
T14672CA56182044BA9251E368D4ECBFC3E5F62CCF4C419FC99BE47D086DDE06E512758B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

140938ad-969f-4871-92e5-2fd8f47ed32b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\140938ad-969f-4871-92e5-2fd8f47ed32b
Size 2KB
SHA256 14cf52ef369b0af602605d1ed09005dd616179a63d9e4b72865bb0c91c3319bf
MD5 cfc75887b363cb5bc76815fff7d5dde2
SHA1 7141afe84f9db5541b1588608a42f393bc438dc5
SHA512 2e78a573f2eea3d0101eac8cf8cb12e713c04e6ccf91976e9f417b68b2516bec5be704e08800b3a862e994a4227cd1dbbbeb35c7a548f15dd00a7db7eb45ca42
TLSH
T1F141465C35744CBB5C9AF15DD08133CD97A18A1340C62D432E91DF0CDC966EA336A52F
MD5 SHA1 SHA512 TLSH

Submit Download

2d371b72-1dac-4f9e-a310-6cd418a58c48

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\2d371b72-1dac-4f9e-a310-6cd418a58c48
Size 2KB
SHA256 1aea427b46e7e00331f26480d773396b4e7c2c0a4a60df258f9fa14a2a202809
MD5 59a4c7c1255501f584f5646ad2f6800f
SHA1 19dfcf2fb99a6f7cd7c5e9f631e7d6eb0c348a65
SHA512 f469d379ed63e5720e4931403ec914bf41b24fbee8db7cbe208cd47fff67f351bf32983c852cc20a081316bbd9ba7863be19dc2def6656a73b5933beaf033656
TLSH
T1BC41315879785C375CEAF15DD482338E4BA48A0304C518532E41DF0CDDDA6AF336B92B
MD5 SHA1 SHA512 TLSH

Submit Download

3d068875-2ab6-426c-a2c8-69e35dc457bd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\3d068875-2ab6-426c-a2c8-69e35dc457bd
Size 235B
SHA256 27e5afcf05f4f6fc202af410dc89c7f6d752bedc9d6c6fa97bc24fe35c5739eb
MD5 3fe2f529e70e59142037132e7b687953
SHA1 dda3b92ccd07d56c08bec4c4433f1c97b4d33ace
SHA512 0c8b003d1f30f7465e57504c0f72c80491e72df9bd82181cfc1f5d7c47f2dd09c778c0dedde3e1c94a2e7b2f858f6830f20e295c1135397be5fa174ea8854feb
TLSH
T137D0978038C8339F18150F07B0E039CA30584C33107D6810DA62863899F8DC841E280A
MD5 SHA1 SHA512 TLSH

Submit Download

534a7098-d33d-4072-a4f3-4721c66c747b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\534a7098-d33d-4072-a4f3-4721c66c747b
Size 235B
SHA256 8c6e0c6a3bf75545bc825e01d577ff5863b0733e248a1d26c70bcd2c181de39e
MD5 559b010be16a10d054493fbcd9044853
SHA1 469ced8b40cae182d0dcba0359d2bc4a2a87a769
SHA512 ff6f8075b224063657fffa9a1c0b2096812c13db47b20a58ff68988613fe1206a628472fb903bf1c44149e95ac4a711bd37763bdee52c5c427fbeee70300d6b4
TLSH
T10AD097C42898B76E0A080F07B0E029C2B14A8C3328B45810D9615874DEB9EC8026182B
MD5 SHA1 SHA512 TLSH

Submit Download

57aa1dc8-6cba-46bb-9134-bac55f928a52

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\57aa1dc8-6cba-46bb-9134-bac55f928a52
Size 3KB
SHA256 baa112c53e83a4a3189016813784a2552915408844c61084acdd7eec0af4f5ef
MD5 375a3de0b61b2f713a5f135c0b955638
SHA1 15dca5006cfd02278c2d0d872857ae6e2aa0560c
SHA512 47f6a104929513215566f2f7850b12bd8d2024705e23693d219928a797999e52a15da74cd5871d34da8c760ce179cf9c613066311e2237ada0fdc717ab2977e3
TLSH
T1726134211564A5738FF8F041E3376D498BDF33CF58970BCD21A9892646F8464878B36B
MD5 SHA1 SHA512 TLSH

Submit Download

7eff77c7-c391-4d0b-94f1-aefe17443aaa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\7eff77c7-c391-4d0b-94f1-aefe17443aaa
Size 3KB
SHA256 f8b4624eae6f3a2b278246bc9dcc559e85a4a9a28c67d5054fe7124d8a38244e
MD5 204ece42aaf1378cb8c61dfa4b8b5c7b
SHA1 d4ff2f7c7d99e6a3ad2789d67224818ffca73907
SHA512 c0355df4e1fdcf34d19ddd2ad6fab3054947c31087a5319f0d92b23ac077beb02b805a360e433cdcf61f12306ef419a18c88478cb45ec66ee2d7e4ac188efc38
TLSH
T1DA6111315564A9738FE8F041E33769498FEE33CB48870BCD21A98D2546F84689B8B35F
MD5 SHA1 SHA512 TLSH

Submit Download

8067d6b2-bfeb-4e4b-a3e9-898979fdeeaf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\8067d6b2-bfeb-4e4b-a3e9-898979fdeeaf
Size 235B
SHA256 6b903e71d546bfdc5ea40031c5f9b5695952c3b02dc0cc44256d94c90923c327
MD5 5ff2300adc76b903d6e492f3bcbad8f6
SHA1 8e8c3464b986f40b4cd9e363dde2df95a024f578
SHA512 6c0d68bdd6b68aae168500f10f6d841dfecb4cdcff5e1ae4186da32e4f4bdf708beade8870005eb50fd829fd081bae06316bc09372d0e2ee0b1746537996b061
TLSH
T1EAD097802888A35D08000F8FF0A47AC731584C3358A66820C9A1803489F9DC801329C7
MD5 SHA1 SHA512 TLSH

Submit Download

9549470d-1e16-4186-a809-2ee85058a08f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\9549470d-1e16-4186-a809-2ee85058a08f
Size 235B
SHA256 9d8f4845ff9e8a13e0400da6c8a849bc8c7ed51a0640974c221ad2185e1ee0bb
MD5 cc311fab226b880f0307cebc2a714750
SHA1 bb1e6f7089c21b8cd55d3f0d89872526938395ed
SHA512 137447b2fd2428048e93dab4b194d3a3dbbbe62154116843e31d37ce5c7ba753b09a92babc1b0b28ad1884ff99f449c88d753b473c8f5848465744b0e973fd17
TLSH
T15DD0978434A82B6C08000F46F0A1AEC230898C33A4B89824D5A14578C9B9EC90262C0B
MD5 SHA1 SHA512 TLSH

Submit Download

963844e6-c76a-4ddd-afea-67a21d4b7d6d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\963844e6-c76a-4ddd-afea-67a21d4b7d6d
Size 3KB
SHA256 72097889858816feb13d25d18dfa0859dee5dd1b81c4558dd4e81d06bae9a52b
MD5 6f69d50fdf2abfa9a4cdb0936e0c56f1
SHA1 458c0f1aa2d41379dfdd1e1e762fa5a8efae79c4
SHA512 6c891b794390abc6d757f9393bbda9ba8dc97d7478cea00458eef2833b729c5b347a1c70784d832c475b14245ec54d135403fdc911f829a496c2bc88b1c4d304
TLSH
T1E86132311964A9738FE8F040E3376D498FDE33CB58970BCD25A98D2942F8468478B36B
MD5 SHA1 SHA512 TLSH

Submit Download

9a961651-7702-4d98-b9b3-2cd816004020

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\9a961651-7702-4d98-b9b3-2cd816004020
Size 871B
SHA256 d08ed6e99fae1e77845cc2c4f69132750d4d6061925aa5b3dfbfc3b101d1afb0
MD5 8435ce44277496eade02cc46a692545b
SHA1 bda16ecb7666d52d5107aa3d9b7a218f6411e598
SHA512 29dd384cee03c4cfd7acdf511cc9fd5ad96372cd2218914ad762faae5f6e062a9549491eb9c0f13be0988a4fed3834ecb00bda6fd5f7d8a82e72fa64e7777bab
TLSH
T1AD110081C63075B3CD29E21BC58537418BF57523C4C645043EB41A085DBE929A75634B
MD5 SHA1 SHA512 TLSH

Submit Download

a5c0d096-be3a-4e59-b4ee-3f1c712c83e8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\a5c0d096-be3a-4e59-b4ee-3f1c712c83e8
Size 3KB
SHA256 a9cdb27861d178201cfeea17553aaae9ae2ef14f113048f98d579c3a7310cc81
MD5 2f90303641041e5fa86730a5381024d9
SHA1 51fa30c7998a0b9f61654185f74f282234063d37
SHA512 7e5b4ed72a160e98367cae024c1882d9a280b0e21953bf05778ed0cd97b011c6953d48ff7ae015913a6840d3e69f66210f3e77270ca8f175d1162f20a361c2a8
TLSH
T1256122315574A9738FE8F140E3376D498ADE33CF48870BCD25A98D2946E84649B8B36B
MD5 SHA1 SHA512 TLSH

Submit Download

aebdf926-e375-4673-becf-f9caa43c8f81

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\aebdf926-e375-4673-becf-f9caa43c8f81
Size 896B
SHA256 7d62e48294acfa006b1a9b41b304709a4f5c6b06339c6495b44e2c5203e9314b
MD5 c94d9d288453cbeed9ddc70ac7e24aac
SHA1 f88a05e3c23c1d36c6955658196d4efd4f7c61b9
SHA512 67275fa1a4dc22afd53e35114cb153ec3dc0ea33461f67cfa450033458c81dc2908c8c3992af9fe5c7937b7680d7a16058c1018442b3e6a22c18726fc47fbb12
TLSH
T1ED1140D1D67478B38C68D26785D03B428BE0B223C4C64E043FA01B182DFE82AE76731B
MD5 SHA1 SHA512 TLSH

Submit Download

b30517ce-0675-4bbf-9625-6a0b98a117aa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\b30517ce-0675-4bbf-9625-6a0b98a117aa
Size 883B
SHA256 1db6fad307c7494863cde6339230e840024cb9041217c680a844183795cfc0b4
MD5 522042d04a2d25c478220192e0b96f1e
SHA1 464cdd624419e32d6312fb25a720e2c112641bb9
SHA512 b712cebb8e054b9ee29bc07ea85283d63e58e5e42d9d38dd37a3cdc50db1e54b5c6d682ef7a1d518ed2293fe1fda00548cdf462ac5f6e9a151d9ca3c3dd0693a
TLSH
T1CF112741D63475B3CD6CD25BC5953B414BE9B523C4C544083FA11E185D7D92DD35770B
MD5 SHA1 SHA512 TLSH

Submit Download

b417fa09-489e-4da4-a8b5-1cce5ad08fb4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\b417fa09-489e-4da4-a8b5-1cce5ad08fb4
Size 3KB
SHA256 751dac31ff6cb0d42f24610a4294626263bd039b8ba225322317a5b5444cfe3f
MD5 ea40f45593e29fb1a65a3a5fc03f83ff
SHA1 9b53a842c18fcdfa141e1dbbf9d72b68d5e7025d
SHA512 3fba33915ff0c604e79534f0acfd6535ac313b7827481c6cf551a1f5d89ff7a96b4414c1deb9447312df7164329ba6975737e8284bf11628dc1722b1bda62b9a
TLSH
T1DA6130315974A9738FECF040E3376D499ADE33CF48970BCD25A98A2546F8468478B25B
MD5 SHA1 SHA512 TLSH

Submit Download

b5ab4493-92c9-48cb-bbd5-4bc2453b9de8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\b5ab4493-92c9-48cb-bbd5-4bc2453b9de8
Size 3KB
SHA256 ed03bd639dc60755cb20ffc74ef6844528e329ef82d858abc60f8c1f31911133
MD5 26ff83862dfa93e5aa7d358c73e0c25b
SHA1 49f50a3ef7a8f2fe4f25ea354d460b76ffb27c46
SHA512 b29285705951e17bd9df5fe286a33dbc4271e20b0a601e3bed4836fc7d69a4980b521f795d8f364059e5564a900177634fcf39299f386377f148759fd4e657aa
TLSH
T16D6130211574A9738FF8E000E3376E889ADF33CF58970BCC25A9892946F8464478B35B
MD5 SHA1 SHA512 TLSH

Submit Download

d597b973-3b1f-40b6-bb0f-033e1ff3f4fd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\d597b973-3b1f-40b6-bb0f-033e1ff3f4fd
Size 3KB
SHA256 7aced18a5bf76393306983146df552a74e65ec0b9f82dd84e3334ff2f55b5eed
MD5 e193aa1d9c1f1c03c6d90e29fe2fa384
SHA1 fcbb0c1757d8cc7574ce25d85bc11a8b49ccfb85
SHA512 348d8481b6221d4e5627e229cc9eeca0d99a9fd1f6151e9a6ebe7b3f292e4189748091ef88ac455ace81f06f651d150940d100d8300eb6fa891c8ac633ce85bb
TLSH
T1626161211164A9338FE8F040E3776E499BDE33CF58870B8D21A98E6546F84644B8B36B
MD5 SHA1 SHA512 TLSH

Submit Download

d7ea6071-7eb3-4db6-a3db-c15cced28b42

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\d7ea6071-7eb3-4db6-a3db-c15cced28b42
Size 3KB
SHA256 a5deec1065d816a76b9469c0c36433a18f5914fd48fff1e6be8491e7f0dcb68a
MD5 d02d347a941d475dac9ae9528a26b82c
SHA1 a4aa6db991d35fb16bad5e298305990eecc4cd12
SHA512 010f7c423228347b929dafd98f72580c0b717f0b320e0d413cc165dbad94a92411abf91d4b7e022e3395c410b61280aa820c9db606490cc2100a2f202c2c2f71
TLSH
T1816140311574A5739FE8F044E3376E489BDF33DF58930B8D21A8892946F8864878B36B
MD5 SHA1 SHA512 TLSH

Submit Download

ddba3b18-0abd-40e8-b79c-346798fa9125

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\ddba3b18-0abd-40e8-b79c-346798fa9125
Size 896B
SHA256 daddf46326a60c16058695cf909d4e0e7f812946cc24ee19f1dfa32e7c377330
MD5 a65831981de7d40f5c361cded0d8df82
SHA1 91b08b6276b92cf6a3e84882d260810e07f7fbaa
SHA512 454c14a4792f574dc0203163ee0a1bbdd8428a523cdd5602c541684f3c5d66c3e6fef1c1c21902b18c970cc045dfada41cdc5c0e14b43025847ea375f6c164ff
TLSH
T1AC114082DA3479B3CD28E257D49137028BE57123C4C60A083EA05E085DBA52AA36770B
MD5 SHA1 SHA512 TLSH

Submit Download

f9ced463-036e-40de-8b0c-3ae4c4344f69

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\f9ced463-036e-40de-8b0c-3ae4c4344f69
Size 3KB
SHA256 c7fd4b94d62b04cb344685ac783ed6cf15bc4dc007cc13fe9d1326438da6ce43
MD5 2e1ab0aeb622c718e6cdbf7b81d68f0a
SHA1 4e1bb1ef51572d8abf2206ec4c2021d9566b77b9
SHA512 bdb2ff20dbc0aca30a12ca1e0aa3347e6376101bd8ba23ca321fd373452e7e3db996036ac110b2f122e05e9c78c5694d0aa36a9317f99a8b153624a28d13ba1e
TLSH
T1FA6121211574A9338FE8F044E3376D499ADF33CF58930FCD21A5892546F8464478B36B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs-1.js
Size 6KB
SHA256 1de4f52a5af5c5b49deaf84a53ecfe3c9ae41516c7f64254990b75f711eaa4f3
MD5 dbf4927d74190236b061ea60cf204810
SHA1 a69e2c7d2febe2addd4f52b0d68eb6de47ebc231
SHA512 a321cd287821c8f8c7720e903aeaa6369e626f00303aae6ff747a658b69cbf874cbd9d75314ba8dd863034289e7ce11196b51654f40116db31d0181440d5d016
SSDEEP 96:xH89UTUfqGq8fCqVYU1zSySSl8pdv9jknFIH6OBw88n8L4cnoV8YLFHn:2CR8fCqVYU7SSGh6OBw885yuH
TLSH
T1F3E1107895088B7F68B677ACAC688C715AB2413B77BF68D750B54484050CF3482FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs-1.js
Size 6KB
SHA256 0323941c835f46d64357f2f71fcef24322d60024ec8b94bc76d8eee16d8ff3b3
MD5 2b520bc944111b660ff35df8030c05e1
SHA1 c938bc25ecd86eed5c3c9cf75dd5e28cafd5522b
SHA512 c030071bbf98323945a2cd34bcbfca98a6baadb39eebb9c46ba89b28383188933dc9f736ea9a236a92d5aeee723c3a5854f5d43c9409792095407f7cf5050429
SSDEEP 96:xH89UTUfqGq8fCqVYU1zSiSSl8pdv9jDcnFIH6OBw88n8L4cnoV8YLFHn:2CR8fCqVYUzSSGl36OBw885yuH
TLSH
T1A8E1107895088B7F74B677ACAC6888715AB2413B77BF68D350B54484050CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs.js
Size 6KB
SHA256 c124b2fba4dd1db304508808636594b5428f445e95216e44cc2040182f1dc314
MD5 57ad34c0b8b916213be512454e3c96d2
SHA1 2d4cf5451b942dd62e3e1ac48a7483c0130c7287
SHA512 f218f301c2342cecf99f7e539b7d75572451f25b77c3d40cbab75b2ffe30be35a8cbeb65d3da9e935efdbcc37c3a8a7723812498c225109c24e5ff0e5c4f1f9d
SSDEEP 96:xH89UTUfqGq8fCqVKjfnjz1zSpu5SSl8pdv9jaPnFIH6OBw88n8L4cnoV81FHn:2CR8fCqVYvou5SSGEk6OBw885y3H
TLSH
T1DFE12E789508CB7F74B6766CAC6888319AB2413B77BF68D350B95484050CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1060-94-0x0000023D76580000-0x0000023D7671A000-memory.dmp

Download

memory/1096-413-0x000001E775820000-0x000001E775B75000-memory.dmp

Download

memory/1296-444-0x0000026132360000-0x00000261326B5000-memory.dmp

Download

memory/1380-1795-0x000001CEF92A0000-0x000001CEF95F5000-memory.dmp

Download

memory/1532-3215-0x000002B313A40000-0x000002B313D95000-memory.dmp

Download

memory/2156-2820-0x000001B4A16E0000-0x000001B4A1A35000-memory.dmp

Download

memory/2156-2797-0x0000000000A90000-0x0000000000A91000-memory.dmp

Download

memory/2852-35-0x0000000006160000-0x00000000064B4000-memory.dmp

Download

memory/2852-51-0x0000000005090000-0x00000000050B4000-memory.dmp

Download

memory/2852-52-0x00000000065E0000-0x00000000065F8000-memory.dmp

Download

memory/2852-17-0x0000000004B30000-0x0000000004B66000-memory.dmp

Download

memory/2852-19-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

Download

memory/2852-18-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

Download

memory/2852-37-0x0000000006840000-0x000000000688C000-memory.dmp

Download

memory/2852-36-0x0000000006790000-0x00000000067AE000-memory.dmp

Download

memory/2852-50-0x0000000005950000-0x0000000005F58000-memory.dmp

Download

memory/2852-27-0x0000000005FD0000-0x0000000006036000-memory.dmp

Download

memory/2852-698-0x000002163B040000-0x000002163B395000-memory.dmp

Download

memory/2852-25-0x00000000051C0000-0x00000000051E2000-memory.dmp

Download

memory/2852-22-0x0000000005320000-0x0000000005948000-memory.dmp

Download

memory/3804-427-0x0000021123760000-0x000002112376C000-memory.dmp

Download

memory/3804-45-0x00000211251B0000-0x00000211251D2000-memory.dmp

Download

memory/3804-46-0x000002113DB00000-0x000002113DB44000-memory.dmp

Download

memory/3804-47-0x000002113DBD0000-0x000002113DC46000-memory.dmp

Download

memory/3976-2897-0x0000000000270000-0x0000000000271000-memory.dmp

Download

memory/3976-2903-0x0000023628EE0000-0x0000023629235000-memory.dmp

Download

memory/4004-1944-0x000001B5DA110000-0x000001B5DA465000-memory.dmp

Download

memory/4168-678-0x0000029B85F90000-0x0000029B862E5000-memory.dmp

Download

memory/4376-465-0x0000020E3E4B0000-0x0000020E3E805000-memory.dmp

Download

memory/4416-399-0x0000000005F70000-0x0000000005F7D000-memory.dmp

Download

memory/4416-3696-0x00000000066D0000-0x00000000066D8000-memory.dmp

Download

memory/4416-53-0x0000000006180000-0x0000000006232000-memory.dmp

Download

memory/4416-3691-0x0000000005F00000-0x0000000005F21000-memory.dmp

Download

memory/4416-55-0x00000000062C0000-0x0000000006336000-memory.dmp

Download

memory/4416-56-0x0000000006340000-0x0000000006390000-memory.dmp

Download

memory/4416-3684-0x0000000007040000-0x0000000007394000-memory.dmp

Download

memory/4416-3701-0x0000000005F00000-0x0000000005F21000-memory.dmp

Download

memory/4416-54-0x0000000006410000-0x00000000065D2000-memory.dmp

Download

memory/4416-20-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/4416-3695-0x00000000056D0000-0x00000000056E1000-memory.dmp

Download

memory/4416-24-0x0000000005050000-0x0000000005060000-memory.dmp

Download

memory/4416-57-0x0000000006B10000-0x000000000703C000-memory.dmp

Download

memory/4416-3703-0x0000000005F70000-0x0000000005F7D000-memory.dmp

Download

memory/4416-58-0x00000000066B0000-0x00000000066CE000-memory.dmp

Download

memory/4416-26-0x0000000005FA0000-0x0000000006006000-memory.dmp

Download

memory/4416-397-0x0000000005F00000-0x0000000005F21000-memory.dmp

Download

memory/4416-398-0x0000000005F30000-0x0000000005F51000-memory.dmp

Download

memory/4416-401-0x0000000005050000-0x0000000005060000-memory.dmp

Download

memory/4416-400-0x0000000005670000-0x0000000005678000-memory.dmp

Download

memory/4732-8-0x00000000056E0000-0x00000000056F0000-memory.dmp

Download

memory/4732-4-0x00000000053E0000-0x00000000053EA000-memory.dmp

Download

memory/4732-1-0x0000000005A10000-0x0000000005FB4000-memory.dmp

Download

memory/4732-0-0x0000000000860000-0x00000000009FA000-memory.dmp

Download

memory/4732-2-0x0000000005460000-0x00000000054F2000-memory.dmp

Download

memory/4732-3-0x00000000056E0000-0x00000000056F0000-memory.dmp

Download

memory/4732-5-0x0000000005790000-0x000000000582C000-memory.dmp

Download

memory/4732-23-0x00000000015E0000-0x0000000001605000-memory.dmp

Download

memory/4732-6-0x0000000006BC0000-0x0000000006BDC000-memory.dmp

Download

memory/4732-9-0x0000000006D80000-0x0000000006EE2000-memory.dmp

Download

memory/4732-7-0x00000000015E0000-0x0000000001605000-memory.dmp

Download

memory/5112-2788-0x0000000000990000-0x0000000000991000-memory.dmp

Download

memory/5112-2904-0x000001AFB6E00000-0x000001AFB6F15000-memory.dmp

Download

memory/5184-3683-0x000002826BB20000-0x000002826BC35000-memory.dmp

Download

memory/5552-2808-0x000002F5708A0000-0x000002F570BF5000-memory.dmp

Download

memory/5784-1787-0x0000017996570000-0x00000179968C5000-memory.dmp

Download

memory/5852-1943-0x00000265BACA0000-0x00000265BAFF5000-memory.dmp

Download

memory/5896-1945-0x0000027383C10000-0x0000027383F65000-memory.dmp

Download

memory/5896-1835-0x0000000000890000-0x0000000000891000-memory.dmp

Download

memory/6116-2902-0x000001A2920D0000-0x000001A292425000-memory.dmp

Download

memory/6472-1961-0x000002359F200000-0x000002359F39A000-memory.dmp

Download

memory/6488-3682-0x000001BD54230000-0x000001BD54345000-memory.dmp

Download

memory/6504-3260-0x0000027063090000-0x00000270633E5000-memory.dmp

Download

memory/6684-2959-0x00000261B6560000-0x00000261B68B5000-memory.dmp

Download

memory/6932-3219-0x000001A23A650000-0x000001A23A9A5000-memory.dmp

Download