phantom_stealer | e1420a9e6d6bd820cee7e88c9c50e67dd475d96df3069655426428a6d40dd18b

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
Size 1.6MB
Sample260504-pcltesex4p
SHA256 e1420a9e6d6bd820cee7e88c9c50e67dd475d96df3069655426428a6d40dd18b
MD5 01f31ba800e33ba567d9a097dd530157
SHA1 8f41ac6b09fcbe9a34f480807c493d21d91dc30c
SHA512 c7084168e62fbaf4f2f526d667794d33d1c85826542c7926cd9d39f105964e4b275ff1e67529715579a24f590fae335dc47a738c910b7e7415083a41adee3f4b
SSDEEP 24576:QSLfgyXqe/ZbSMI5HNqw7fWxu2rT+IN6NCqo28ZfLOZJL:QSL4yXV4M0HNqtcW/NW8lmL
TLSH
T19D75220D271EEE02D8811AB45C21E3B907744ECCE515C253AFF9FC8FB8B9695A8642D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution phantom_stealer persistence spyware stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

Mutex

TS3MOP1QLB9XY0OOH6ZM

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 1 IoCs

resource	yara_rule
behavioral2/memory/4016-22-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4328	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OxGIsizVFz.lnk	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
Key opened	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
Key opened	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
33	icanhazip.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3924 set thread context of 4016	3924	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	81

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\1a67e6f1-d779-4446-8664-1da2de68a68d.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\4040_13422370332850323_4040.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\4678a66d-a2f0-46fb-9e5e-5c5f2e6a25b6.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\1364_13422370332919231_1364.pma	setup.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4884	chrome.exe
2156	msedge.exe
6840	msedge.exe
3768	chrome.exe

Checks processor information in registry 2 TTPs 38 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134223703178470324"	chrome.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650218026-1419908266-2856590055-1000\{AD90AAD0-805C-456A-8CAF-B07B9506BCB6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4328	powershell.exe
4328	powershell.exe
3504	powershell.exe
3504	powershell.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
6020	chrome.exe
6020	chrome.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
2240	firefox.exe
2240	firefox.exe
2240	firefox.exe
2240	firefox.exe
2240	firefox.exe
2240	firefox.exe
2240	firefox.exe
2240	firefox.exe
2240	firefox.exe
2240	firefox.exe
2240	firefox.exe
2240	firefox.exe
2240	firefox.exe
2240	firefox.exe
2240	firefox.exe
2240	firefox.exe
2240	firefox.exe
2240	firefox.exe
2240	firefox.exe
2240	firefox.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
4224	firefox.exe
4224	firefox.exe
4224	firefox.exe
4224	firefox.exe
4224	firefox.exe
4224	firefox.exe
4224	firefox.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
Token: SeDebugPrivilege	3504	powershell.exe
Token: SeShutdownPrivilege	6020	chrome.exe
Token: SeCreatePagefilePrivilege	6020	chrome.exe
Token: SeShutdownPrivilege	6020	chrome.exe
Token: SeCreatePagefilePrivilege	6020	chrome.exe
Token: SeShutdownPrivilege	6020	chrome.exe
Token: SeCreatePagefilePrivilege	6020	chrome.exe
Token: SeShutdownPrivilege	6020	chrome.exe
Token: SeCreatePagefilePrivilege	6020	chrome.exe
Token: SeShutdownPrivilege	2556	chrome.exe
Token: SeCreatePagefilePrivilege	2556	chrome.exe
Token: SeShutdownPrivilege	2556	chrome.exe
Token: SeCreatePagefilePrivilege	2556	chrome.exe
Token: SeShutdownPrivilege	2556	chrome.exe
Token: SeCreatePagefilePrivilege	2556	chrome.exe
Token: SeShutdownPrivilege	2556	chrome.exe
Token: SeCreatePagefilePrivilege	2556	chrome.exe

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
6020	chrome.exe
6020	chrome.exe
1808	chrmstp.exe
2240	firefox.exe
2240	firefox.exe
2240	firefox.exe
2240	firefox.exe
2240	firefox.exe
2240	firefox.exe
2240	firefox.exe
2240	firefox.exe
5652	msedge.exe
6496	msedge.exe
4224	firefox.exe
4224	firefox.exe
4224	firefox.exe
4224	firefox.exe
4224	firefox.exe
4224	firefox.exe
4224	firefox.exe
4224	firefox.exe
2556	chrome.exe
2556	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2240	firefox.exe
4224	firefox.exe
4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 4328	3924	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	79
PID 3924 wrote to memory of 4016	3924	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	81
PID 3924 wrote to memory of 4016	3924	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	81
PID 3924 wrote to memory of 4016	3924	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	81
PID 3924 wrote to memory of 4016	3924	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	81
PID 3924 wrote to memory of 4016	3924	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	81
PID 4016 wrote to memory of 6020	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	85
PID 6020 wrote to memory of 3300	6020	chrome.exe	86
PID 4016 wrote to memory of 6020	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	85
PID 4016 wrote to memory of 6020	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	85
PID 6020 wrote to memory of 5844	6020	chrome.exe	87
PID 6020 wrote to memory of 4884	6020	chrome.exe	88
PID 6020 wrote to memory of 5332	6020	chrome.exe	89
PID 6020 wrote to memory of 3944	6020	chrome.exe	90
PID 6020 wrote to memory of 3952	6020	chrome.exe	91
PID 4016 wrote to memory of 3300	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	86
PID 4016 wrote to memory of 3300	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	86
PID 6020 wrote to memory of 3268	6020	chrome.exe	92
PID 6020 wrote to memory of 5460	6020	chrome.exe	93
PID 6020 wrote to memory of 5732	6020	chrome.exe	94
PID 6020 wrote to memory of 5544	6020	chrome.exe	95
PID 4016 wrote to memory of 6020	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	85
PID 6020 wrote to memory of 3920	6020	chrome.exe	96
PID 4016 wrote to memory of 6020	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	85
PID 4016 wrote to memory of 5732	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	94
PID 4016 wrote to memory of 5732	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	94
PID 4016 wrote to memory of 4884	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	88
PID 4016 wrote to memory of 4884	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	88
PID 4016 wrote to memory of 3300	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	86
PID 4016 wrote to memory of 3300	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	86
PID 4016 wrote to memory of 5460	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	93
PID 4016 wrote to memory of 5460	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	93
PID 4016 wrote to memory of 5844	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	87
PID 4016 wrote to memory of 5844	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	87
PID 4016 wrote to memory of 3268	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	92
PID 4016 wrote to memory of 3268	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	92
PID 4016 wrote to memory of 5332	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	89
PID 4016 wrote to memory of 5332	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	89
PID 4016 wrote to memory of 3952	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	91
PID 4016 wrote to memory of 3952	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	91
PID 4016 wrote to memory of 6020	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	85
PID 4016 wrote to memory of 6020	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	85
PID 4016 wrote to memory of 5732	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	94
PID 4016 wrote to memory of 5732	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	94
PID 4016 wrote to memory of 4884	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	88
PID 4016 wrote to memory of 4884	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	88
PID 4016 wrote to memory of 3300	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	86
PID 4016 wrote to memory of 3300	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	86
PID 4016 wrote to memory of 5460	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	93
PID 4016 wrote to memory of 5460	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	93
PID 4016 wrote to memory of 5844	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	87
PID 4016 wrote to memory of 5844	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	87
PID 4016 wrote to memory of 3268	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	92
PID 4016 wrote to memory of 3268	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	92
PID 4016 wrote to memory of 5544	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	95
PID 4016 wrote to memory of 5544	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	95
PID 4016 wrote to memory of 5332	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	89
PID 4016 wrote to memory of 5332	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	89
PID 4016 wrote to memory of 3952	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	91
PID 4016 wrote to memory of 3952	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	91
PID 4016 wrote to memory of 6020	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	85
PID 4016 wrote to memory of 6020	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	85
PID 4016 wrote to memory of 5732	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	94
PID 4016 wrote to memory of 5732	4016	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MBL & HBL ADJKT2411000812 - BLJKT241180900.exe

C:\Users\Admin\AppData\Local\Temp\MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
"C:\Users\Admin\AppData\Local\Temp\MBL & HBL ADJKT2411000812 - BLJKT241180900.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\MBL & HBL ADJKT2411000812 - BLJKT241180900.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4328
- C:\Users\Admin\AppData\Local\Temp\MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
  "C:\Users\Admin\AppData\Local\Temp\MBL & HBL ADJKT2411000812 - BLJKT241180900.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nc5beo1m.qvv"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6020
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\nc5beo1m.qvv /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\nc5beo1m.qvv\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\nc5beo1m.qvv --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffce6f0c728,0x7ffce6f0c734,0x7ffce6f0c740
      4⤵
      PID:3300
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nc5beo1m.qvv" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1660,i,11842677214634426441,15373747715458407427,262144 --field-trial-handle=2136,i,14027857201534560399,2996536442762441715,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:2
      4⤵
      PID:5844
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nc5beo1m.qvv" --force-high-res-timeticks=disabled --metrics-shmem-handle=2224,i,8171152422776114629,7106252860458364777,524288 --field-trial-handle=2136,i,14027857201534560399,2996536442762441715,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:11
      4⤵
      System Time Discovery
      PID:4884
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nc5beo1m.qvv" --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,6224624824000045086,11239268553762240857,524288 --field-trial-handle=2136,i,14027857201534560399,2996536442762441715,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:13
      4⤵
      PID:5332
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nc5beo1m.qvv" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3064,i,1787327565566443998,14949307865336864825,2097152 --field-trial-handle=2136,i,14027857201534560399,2996536442762441715,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:1
      4⤵
      PID:3944
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nc5beo1m.qvv" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3068,i,4923758229520964346,994427141675492942,2097152 --field-trial-handle=2136,i,14027857201534560399,2996536442762441715,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:1
      4⤵
      PID:3952
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nc5beo1m.qvv" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3288,i,12595102820576170920,9165208628441355531,2097152 --field-trial-handle=2136,i,14027857201534560399,2996536442762441715,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
      4⤵
      PID:3268
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nc5beo1m.qvv" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3296,i,12921399060994529694,15993760914734352190,2097152 --field-trial-handle=2136,i,14027857201534560399,2996536442762441715,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:9
      4⤵
      PID:5460
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nc5beo1m.qvv" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4212,i,4996684358964251299,5871673840763899273,2097152 --field-trial-handle=2136,i,14027857201534560399,2996536442762441715,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
      4⤵
      PID:5732
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nc5beo1m.qvv" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4328,i,10556143906179475326,2532871636259036684,2097152 --field-trial-handle=2136,i,14027857201534560399,2996536442762441715,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:9
      4⤵
      PID:5544
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nc5beo1m.qvv" --force-high-res-timeticks=disabled --metrics-shmem-handle=4384,i,8581061107721077793,6094827306497906286,524288 --field-trial-handle=2136,i,14027857201534560399,2996536442762441715,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
      4⤵
      PID:3920
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nc5beo1m.qvv" --force-high-res-timeticks=disabled --metrics-shmem-handle=5012,i,13976911803221931613,12159238579053236277,524288 --field-trial-handle=2136,i,14027857201534560399,2996536442762441715,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
      4⤵
      PID:1052
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nc5beo1m.qvv" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5068,i,17684215767793654249,2081966518041426194,2097152 --field-trial-handle=2136,i,14027857201534560399,2996536442762441715,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
      4⤵
      PID:3364
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nc5beo1m.qvv" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5080,i,2146702145966840468,830466675016393146,2097152 --field-trial-handle=2136,i,14027857201534560399,2996536442762441715,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
      4⤵
      PID:968
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      PID:3664
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7f50a55a0,0x7ff7f50a55ac,0x7ff7f50a55b8
        5⤵
        Drops file in Windows directory
        
        PID:3152
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:1808
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7f50a55a0,0x7ff7f50a55ac,0x7ff7f50a55b8
        6⤵
        Drops file in Windows directory
        
        PID:2056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2mm4uizq.u5u"
    3⤵
    PID:3052
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\2mm4uizq.u5u
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2240
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {34e7f1cd-ccb8-4572-8145-4e5aa2a01c14} -parentPid 2240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2240" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:5572
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2324 -prefsLen 27133 -prefMapHandle 2328 -prefMapSize 270279 -ipcHandle 2320 -initialChannelId {5c406e61-d11c-479d-a291-d7e5ce3a7033} -parentPid 2240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:1488
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2c5a3333-5a84-48e0-884a-a3b8232c4a73.dmp"
        5⤵
        
        PID:2100
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2096 -prefsLen 27133 -prefMapHandle 2808 -prefMapSize 270279 -ipcHandle 2840 -initialChannelId {2a5b2d4e-251a-43dd-827c-7c21f647b8a3} -parentPid 2240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2240" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:5672
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\86f4b790-09d6-4ec5-9cdd-b773700475b5.dmp"
        5⤵
        
        PID:1740
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2840 -prefsLen 27133 -prefMapHandle 3000 -prefMapSize 270279 -ipcHandle 2932 -initialChannelId {091fac48-9d23-4b16-875d-069e75ec6137} -parentPid 2240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2240" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:3336
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\5d143665-03ee-41f7-a3b5-bc73517b84bf.dmp"
        5⤵
        
        PID:1812
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3284 -prefsLen 27198 -prefMapHandle 2932 -prefMapSize 270279 -ipcHandle 2908 -initialChannelId {663f0958-0d5e-41c2-8379-e6e49ddbdf78} -parentPid 2240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2240" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:748
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3824 -prefsLen 27274 -prefMapHandle 3828 -prefMapSize 270279 -jsInitHandle 3832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3840 -initialChannelId {a974fe22-b61d-42c3-9b22-83d39568cea8} -parentPid 2240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:5464
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\50db9854-a850-4f0c-98c8-b408291e0d4d.dmp"
        5⤵
        
        PID:5260
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2908 -prefsLen 27274 -prefMapHandle 3444 -prefMapSize 270279 -ipcHandle 2884 -initialChannelId {0f9515de-e5fe-447b-b8ca-9dfe58864cd9} -parentPid 2240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2240" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:4712
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\06f3c452-5c49-4a93-b2b6-66389d63be6f.dmp"
        5⤵
        
        PID:2992
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3900 -prefsLen 27274 -prefMapHandle 3912 -prefMapSize 270279 -ipcHandle 4292 -initialChannelId {2ea8e8ed-2c3e-4c97-ab0a-32709ceadfef} -parentPid 2240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2240" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:5028
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4560 -prefsLen 34773 -prefMapHandle 4564 -prefMapSize 270279 -jsInitHandle 4568 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4576 -initialChannelId {227eb396-8b5a-4db5-87d4-cbea9b3cfc09} -parentPid 2240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:3152
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 1520 -prefsLen 35010 -prefMapHandle 1656 -prefMapSize 270279 -ipcHandle 3424 -initialChannelId {a6ddd510-6bf7-40d1-ba6f-068bf4607f6d} -parentPid 2240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:3096
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1356 -prefsLen 32952 -prefMapHandle 3196 -prefMapSize 270279 -jsInitHandle 3200 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5112 -initialChannelId {3104a512-b159-4ffa-b00d-1dd1db2928db} -parentPid 2240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:4056
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5256 -prefsLen 32952 -prefMapHandle 5252 -prefMapSize 270279 -jsInitHandle 5248 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5240 -initialChannelId {24e9ef4e-5374-45aa-b0b2-bd9679b530e7} -parentPid 2240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:444
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5476 -prefsLen 32952 -prefMapHandle 5480 -prefMapSize 270279 -jsInitHandle 5484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5488 -initialChannelId {0fb61f0a-fa9a-4266-aec8-2cfc63aaaa8e} -parentPid 2240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2ec,0x7ffce503c188,0x7ffce503c194,0x7ffce503c1a0
      4⤵
      PID:5192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1636,i,14279956488118192937,11104280438566271334,262144 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
      4⤵
      PID:2432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,2201469479624168174,2394308432840556467,524288 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:11
      4⤵
      System Time Discovery
      PID:2156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,5399462421048153042,16503910761364165030,524288 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:13
      4⤵
      PID:4296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=2984,i,14722053269561404116,6241946324490880588,2097152 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:1
      4⤵
      PID:3196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=2988,i,10823528916486685990,2667938729506700369,2097152 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:1
      4⤵
      PID:3852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3256,i,14133118695516130564,17825291129637821641,524288 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:14
      4⤵
      PID:5472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3288,i,2568984193982038107,5705032952156310131,524288 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:14
      4⤵
      PID:5496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3292,i,14116571583069266362,12127176588330352755,524288 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:14
      4⤵
      PID:3552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3220,i,15371359193376192898,18123108110357322458,2097152 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
      4⤵
      PID:3348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3344,i,18051685463419112327,10137239107687922227,2097152 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:9
      4⤵
      PID:3296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3412,i,9412466447247713611,9491646692702453671,2097152 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
      4⤵
      PID:1060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3436,i,16380629909348538454,16738807333092102458,2097152 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:9
      4⤵
      PID:2976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3448,i,7207983778905886423,7433128261106486341,2097152 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
      4⤵
      PID:3896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3488,i,11513015967035418197,1485788053813092716,2097152 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:9
      4⤵
      PID:3244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3504,i,14159871691185837873,7438387304836808602,2097152 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
      4⤵
      PID:3124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3524,i,16966987965388095129,13940121057832538319,2097152 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:9
      4⤵
      PID:1208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3544,i,7322711508233740425,5539118861918566469,2097152 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:1
      4⤵
      PID:1492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3564,i,14566412975140650654,12496434991707059225,2097152 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:9
      4⤵
      PID:3560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4136,i,3336997626768229854,10718943399193674270,524288 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:14
      4⤵
      PID:6056
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:5752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,16549829034355601796,14647397898919851370,524288 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,16567199929898463866,4423081703548792269,524288 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
      4⤵
      PID:4212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,10158197226100086983,116875820467419488,524288 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
      4⤵
      PID:2824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,393765003017301256,14740142485672835748,524288 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
      4⤵
      PID:2280
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=592
        5⤵
        
        PID:1152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,14735277363964030541,2545624067750354527,524288 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:14
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,14735277363964030541,2545624067750354527,524288 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:14
      4⤵
      PID:4480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      Drops file in Windows directory
      PID:1364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x230,0x234,0x238,0x1d4,0x23c,0x7ff795da04c8,0x7ff795da04d4,0x7ff795da04e0
        5⤵
        Drops file in Windows directory
        
        PID:4740
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        Drops file in Windows directory
        
        PID:4040
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff795da04c8,0x7ff795da04d4,0x7ff795da04e0
        6⤵
        Drops file in Windows directory
        
        PID:3776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,2721233379794247436,7054694730259058590,524288 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
      4⤵
      PID:6024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,2719054434147538439,12091938424565803312,524288 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
      4⤵
      PID:5172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,11821918766044383562,18382584369507747439,524288 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
      4⤵
      PID:996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,8623437005042622887,2308414562470409329,524288 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
      4⤵
      PID:936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,3067961218617207388,1794819791038919573,524288 --field-trial-handle=2284,i,10354615313794977693,11378479236471178246,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
      4⤵
      PID:2768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:6496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffce503c188,0x7ffce503c194,0x7ffce503c1a0
      4⤵
      PID:6536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1752,i,4643959991582793669,13498253712517085923,262144 --field-trial-handle=2540,i,7034035635273134162,1923444188308051763,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:2
      4⤵
      PID:6816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,17558500464639479311,8146788039200745302,524288 --field-trial-handle=2540,i,7034035635273134162,1923444188308051763,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:11
      4⤵
      System Time Discovery
      PID:6840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,8009665036189482651,393758455995727719,524288 --field-trial-handle=2540,i,7034035635273134162,1923444188308051763,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:13
      4⤵
      PID:6908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3260,i,13120661934567251505,253030219828485589,2097152 --field-trial-handle=2540,i,7034035635273134162,1923444188308051763,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
      4⤵
      PID:7044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3264,i,7514358629087313754,18262801140209858998,2097152 --field-trial-handle=2540,i,7034035635273134162,1923444188308051763,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:1
      4⤵
      PID:7140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,14469715554062508185,12414781308060805952,524288 --field-trial-handle=2540,i,7034035635273134162,1923444188308051763,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14
      4⤵
      PID:4760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,10866250471592841745,16774581638289019466,524288 --field-trial-handle=2540,i,7034035635273134162,1923444188308051763,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14
      4⤵
      PID:4972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,13853223854226149957,593451644011413335,524288 --field-trial-handle=2540,i,7034035635273134162,1923444188308051763,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:14
      4⤵
      PID:1608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3636,i,10705240105248165058,7510815614954134218,2097152 --field-trial-handle=2540,i,7034035635273134162,1923444188308051763,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
      4⤵
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3668,i,3042839178894643563,3694369665052342978,2097152 --field-trial-handle=2540,i,7034035635273134162,1923444188308051763,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:9
      4⤵
      PID:6152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3688,i,2801500561081911917,993654875338082851,2097152 --field-trial-handle=2540,i,7034035635273134162,1923444188308051763,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:1
      4⤵
      PID:6196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3748,i,12235582610088419307,18112793138627079358,2097152 --field-trial-handle=2540,i,7034035635273134162,1923444188308051763,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:9
      4⤵
      PID:6296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3724,i,10552394292975537039,16200631155830754486,2097152 --field-trial-handle=2540,i,7034035635273134162,1923444188308051763,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
      4⤵
      PID:6384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3796,i,3379064489480637267,9353283236044651790,2097152 --field-trial-handle=2540,i,7034035635273134162,1923444188308051763,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:9
      4⤵
      PID:6392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3792,i,18190263623290024828,13795131373210185456,2097152 --field-trial-handle=2540,i,7034035635273134162,1923444188308051763,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
      4⤵
      PID:3356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3808,i,5608114491346761512,2504946602020876416,2097152 --field-trial-handle=2540,i,7034035635273134162,1923444188308051763,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:9
      4⤵
      PID:1456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3820,i,7603842556556534306,16891916938675717387,2097152 --field-trial-handle=2540,i,7034035635273134162,1923444188308051763,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:1
      4⤵
      PID:1724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3876,i,5646581812653128391,7932091133058675379,2097152 --field-trial-handle=2540,i,7034035635273134162,1923444188308051763,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:9
      4⤵
      PID:6004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3252,i,2246934208334918669,17765359361595931127,524288 --field-trial-handle=2540,i,7034035635273134162,1923444188308051763,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
      4⤵
      PID:2236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1112
        5⤵
        
        PID:2524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,12030008886405224509,16191178826509012620,524288 --field-trial-handle=2540,i,7034035635273134162,1923444188308051763,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:14
      4⤵
      PID:6232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4136,i,13901735723434352778,1149095315694824643,524288 --field-trial-handle=2540,i,7034035635273134162,1923444188308051763,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
      4⤵
      PID:6292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4664,i,6847908228409360720,3648343851053272918,524288 --field-trial-handle=2540,i,7034035635273134162,1923444188308051763,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
      4⤵
      PID:4888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,13069717624832348291,14098384018679659854,524288 --field-trial-handle=2540,i,7034035635273134162,1923444188308051763,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
      4⤵
      PID:2356
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=596
        5⤵
        
        PID:5504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\diw1fp32.kyo"
    3⤵
    PID:5644
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\diw1fp32.kyo
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:4224
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1932 -prefsLen 27097 -prefMapHandle 1944 -prefMapSize 270331 -ipcHandle 2032 -initialChannelId {5827c4a0-a7ad-4edc-810a-a8cd49da1667} -parentPid 4224 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4224" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:6344
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2488 -prefsLen 27133 -prefMapHandle 2492 -prefMapSize 270331 -ipcHandle 2116 -initialChannelId {25400834-cbea-4eae-a623-9307d6e591a4} -parentPid 4224 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4224" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:5764
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\143faa53-2c86-41fd-8db1-0d48fb1296ae.dmp"
        5⤵
        
        PID:4168
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2916 -prefsLen 27133 -prefMapHandle 2924 -prefMapSize 270331 -ipcHandle 2624 -initialChannelId {1be30837-f5e3-42a0-b9d9-255dcc6e3058} -parentPid 4224 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4224" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:3108
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\80a1cd6b-addf-4526-bcfa-082a295ee9f5.dmp"
        5⤵
        
        PID:7156
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2624 -prefsLen 27133 -prefMapHandle 3252 -prefMapSize 270331 -ipcHandle 3080 -initialChannelId {9271c3d1-12a9-48aa-b2d2-7954b41df164} -parentPid 4224 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4224" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:7020
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3356 -prefsLen 27323 -prefMapHandle 3360 -prefMapSize 270331 -jsInitHandle 3344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3332 -initialChannelId {81189d0c-d52f-4cc5-b0b1-b06d9e1047e0} -parentPid 4224 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4224" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:5112
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\156b45de-087a-43fe-b1ab-1fedcafc186c.dmp"
        5⤵
        
        PID:5664
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3376 -prefsLen 27323 -prefMapHandle 3620 -prefMapSize 270331 -ipcHandle 3804 -initialChannelId {17028778-25b0-4752-a0f2-aad6adc50fe9} -parentPid 4224 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4224" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:1720
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\5ec78a72-df36-495a-aab6-6805ea8d8032.dmp"
        5⤵
        
        PID:7032
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4108 -prefsLen 27323 -prefMapHandle 4104 -prefMapSize 270331 -ipcHandle 4020 -initialChannelId {ff302363-79a4-4d7e-9d8c-4a1e23cb2225} -parentPid 4224 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4224" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 rdd
        5⤵
        
        PID:4996
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2972 -prefsLen 34876 -prefMapHandle 3108 -prefMapSize 270331 -jsInitHandle 2716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3232 -initialChannelId {0db6366b-dbd1-4dc8-a24d-3c7ca45614cb} -parentPid 4224 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4224" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:1300
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4952 -prefsLen 34876 -prefMapHandle 4956 -prefMapSize 270331 -ipcHandle 4964 -initialChannelId {469fb08c-5b49-4c4a-8081-592feaa721c6} -parentPid 4224 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4224" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        5⤵
        Checks processor information in registry
        
        PID:4944
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4972 -prefsLen 32766 -prefMapHandle 4928 -prefMapSize 270331 -jsInitHandle 5060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5072 -initialChannelId {590a6091-1995-4a36-ba65-4c223ebaa47c} -parentPid 4224 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4224" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:3488
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5092 -prefsLen 32766 -prefMapHandle 5096 -prefMapSize 270331 -jsInitHandle 5100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5108 -initialChannelId {197d51dc-5b2c-4d98-b77c-187360de82d3} -parentPid 4224 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4224" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:6580
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5572 -prefsLen 32766 -prefMapHandle 5568 -prefMapSize 270331 -jsInitHandle 5564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5552 -initialChannelId {a450f354-4720-4da1-afdf-b79ea7644dd3} -parentPid 4224 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4224" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:3604
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqs2f54v.yef"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2556
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\mqs2f54v.yef /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\mqs2f54v.yef\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\mqs2f54v.yef --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe0,0x114,0x7ffce6f0c728,0x7ffce6f0c734,0x7ffce6f0c740
      4⤵
      PID:1060
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqs2f54v.yef" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1680,i,15803648571228843481,7522403658484052389,262144 --field-trial-handle=2324,i,4002455446566963228,12792159065825428332,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
      4⤵
      PID:4260
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqs2f54v.yef" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2124,i,11928081767777744163,6701043588519049823,524288 --field-trial-handle=2324,i,4002455446566963228,12792159065825428332,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:11
      4⤵
      System Time Discovery
      PID:3768
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqs2f54v.yef" --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,6679841598001822962,3924039401666005576,524288 --field-trial-handle=2324,i,4002455446566963228,12792159065825428332,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:13
      4⤵
      PID:1076
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqs2f54v.yef" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3164,i,9641388431117386461,16418309430832820003,2097152 --field-trial-handle=2324,i,4002455446566963228,12792159065825428332,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:1
      4⤵
      PID:4940
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqs2f54v.yef" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3180,i,6871301693279763315,7943132757104400538,2097152 --field-trial-handle=2324,i,4002455446566963228,12792159065825428332,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
      4⤵
      PID:6608
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqs2f54v.yef" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3556,i,15192087041101265561,925540048934763235,2097152 --field-trial-handle=2324,i,4002455446566963228,12792159065825428332,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
      4⤵
      PID:6616
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqs2f54v.yef" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3568,i,3089656063246161693,9618676046978258145,2097152 --field-trial-handle=2324,i,4002455446566963228,12792159065825428332,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:9
      4⤵
      PID:5576
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqs2f54v.yef" --force-high-res-timeticks=disabled --metrics-shmem-handle=4292,i,10299061776536382130,15263060498809994049,524288 --field-trial-handle=2324,i,4002455446566963228,12792159065825428332,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:14
      4⤵
      PID:6528
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqs2f54v.yef" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4332,i,17026538624780721369,16041606392943362157,2097152 --field-trial-handle=2324,i,4002455446566963228,12792159065825428332,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
      4⤵
      PID:5212
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqs2f54v.yef" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4464,i,2367986210287046288,7707619789260710581,2097152 --field-trial-handle=2324,i,4002455446566963228,12792159065825428332,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:9
      4⤵
      PID:3356
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqs2f54v.yef" --force-high-res-timeticks=disabled --metrics-shmem-handle=5032,i,1465874738362345970,282660568555946814,524288 --field-trial-handle=2324,i,4002455446566963228,12792159065825428332,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
      4⤵
      PID:6108
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqs2f54v.yef" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5128,i,3987167510628651460,4908736302762247204,2097152 --field-trial-handle=2324,i,4002455446566963228,12792159065825428332,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
      4⤵
      PID:240
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqs2f54v.yef" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5148,i,762203234732372603,1284241403102878091,2097152 --field-trial-handle=2324,i,4002455446566963228,12792159065825428332,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
      4⤵
      PID:2812
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      PID:2468

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pu854q2a.default-release\activity-stream.contile.json
Size 4KB
SHA256 a5189614d009720f514e4a5e4527361d2bdb9203604aaf5647f5ec18844c60c1
MD5 94bf43e5bb3c4977612ae290a7169ee9
SHA1 d6ec39063154978a329ca6e021acb25b3e1b1508
SHA512 c0dcc6b22cc29c22b9b12a317d686d66a35b92b85c658505a603ef3f5c2f651c9e5b68869de81dabcfdc3a8fd480de33334a4a0fbc4d1a9b21df8fbc7ac26712
SSDEEP 96:Kzzfq4tbgMB7k9VwoVdGjK48DlzBvddJ03VvPgktlYI8T+mROal:KzzTtvBqJd1blzhddJCVftlL9mROal
TLSH
T1E1A109FA6864C9535723A7F23C5F27DDF0477187DAF65584DB898C01AAE430EC0A99C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pu854q2a.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 e09eb581bc0c397dfaf7edd084ae71029ad6e99ac74d06ed7a2fa491cdc460f6
MD5 377039f099344af897fa52af808eee23
SHA1 fd808636e5df1e354f8e1daefdf1cc6108e4de6a
SHA512 3613742644f2d23e2e7dee012804b48ad8e484f0864ebd2ff3d2f86792d7fbef4d94d2c973e4541ca13e8a2d375fd1277ec696472b6596ed7c52f530c7b4e60b
SSDEEP 768:MyytER2wmwvf/SA8mqndpe2R1CnYYHuReuZgiGlO3rtJhZ/8OpiuueJSS9o:XyigA8LdqujgiGWJh19iuueJSS9o
TLSH
T194730AA397A871BB1F9027C72C4FBA5B66D24146E78A01CDFCEDC61C81CC658113A5BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pu854q2a.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 23a0d97e75895bc25aa7684a1416b2b36d47896f6b6d57971567e3bcc574d1ff
MD5 91acc40cd83bde364d23dc0342d09674
SHA1 3ed40522a4ae3c25e648d07e75739fde6c2837b1
SHA512 c32476635ee608d4343c5900745860cb2794b0494454a90889a69d674a1172be7130ab3fca3ce77d75d308e31a1661936a8836daff7bd5a4fefc2c00d7e55a8a
SSDEEP 384:HHMO0iO024YKFuhw+5EL1pPsac4j0lpDII+IXbXk:nrZYKFuK+5EB9sac4ID8Ld
TLSH
T1F6527D7DAF1138A90A27D1D4DCEA5218CE08E6BBEFD2D16606143C45C680778B8F64EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pu854q2a.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 cb4f9f3f5cd1748d2bc40baea7029e6a9bf7d8dd31df9e3f01de42fffc20db02
MD5 b8d4c63e7d21a90d841983bb5dae0f9c
SHA1 460d82569e2daff53dd424935e9803932e18dd20
SHA512 717c4ba3a9b7b3e283eba30c929d1d6f30d5b7719bf15b83ab6cf32dae96ef9827a5e21fee16be196866e8ec7863917fd5b6f1a140b23dd18691b3fe3a8ec30b
SSDEEP 1536:jTrliNd/DDBG35iTua0PoaZKEfklZxQD7OloK0g2kysZw3OFhZ9UyXEjQv7subZs:j3lt35iTUoxE81QDcyNOx9U70sqdJBg
TLSH
T1A3A3AEF6DF93CD3D65FFD02D5A82893EFD262400B3A72019C963671461CABB867B4648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

43571ebe-b1bc-4692-a046-df56f9f4917a.tmp

Path C:\Users\Admin\AppData\Local\Temp\43571ebe-b1bc-4692-a046-df56f9f4917a.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e9c5b48-56cf-40b1-8db0-bf3efa0a4256.tmp

Path C:\Users\Admin\AppData\Local\Temp\5e9c5b48-56cf-40b1-8db0-bf3efa0a4256.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

920da681-bebd-45f8-8f7f-b61f9b95ae55.tmp

Path C:\Users\Admin\AppData\Local\Temp\920da681-bebd-45f8-8f7f-b61f9b95ae55.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_lmdi5wzm.emq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lmdi5wzm.emq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

4ae42012-cada-4235-b45a-e223af006e04.tmp

Path C:\Users\Admin\AppData\Local\Temp\mqs2f54v.yef\Default\4ae42012-cada-4235-b45a-e223af006e04.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\mqs2f54v.yef\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png
Size 5KB
SHA256 63be4dfbc222f0c026579113af9aa7dea61e78a166ab9af053b46c1e172240ff
MD5 9cafc16ce8040254ec411cc5a8f954f2
SHA1 0d9841be48e134edf43c7ef970d24ddf852d155e
SHA512 aa1e0ac8d0647ee6c0b481e671b20fc68ff253dc72748b2aaf22f15bd8decd2b9723b16f8cd4c19d9a250abaa8d517101bad6ebfed7fd3a90ceefce02c1b3b75
SSDEEP 96:ALdfTPsPOWpgaNHQxO20qtLppvSFLtGaoFuPhQd1YDzpsE60tkuuAaw:m16NHQgoLjvSVtY2h6CDzpsErVu0
TLSH
T119C17E55555D711FD09D157110AF4A0F31A7E2AAC3785720C97E1BD0F88DE4603A3EB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\mqs2f54v.yef\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 ccefdc2d816137b5954b591e8954c392e0cf27388fef2e437991e3999d9ad3d8
MD5 efa437b6fe5031994d5917a91c19990f
SHA1 d46a1115227ead4e92346b600c28e9ac72cce96f
SHA512 ab52261f15a3f21728b41b4765da5ec6c9e71051b720204ee2decf6f09ac8a0c9a5c12313d921f232f1e698a7425d34415eca8db21a37f423535806bcdf238bb
TLSH
T1F3310AC7644047BA52EDDAF37F6B0C57DC12210107D4A440599F56E17FEEEC86015478
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\mqs2f54v.yef\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 bff87e21fa845d8ce3c266db6d904e9c7a3bf9fc2b95a1f1a5ca375f3fdb045a
MD5 097f67b0d583db3f8487ac27379c7eae
SHA1 18acf62fb9bc4e95899c4597cd72de66b6bef763
SHA512 0b6b323fa14e5b0dd6bb87fce791bbd0b7a867988d8332385ba76a35d93d4dd5b67f6be9be5a69fbdcd5da68c30bc840712daa83b9a0187b727d963dc9a9a045
TLSH
T15E514C54BEF34CB2EBC67C7254E65BF5A564C1E62D407A0C86B9CA1245BDD410CCD003
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\mqs2f54v.yef\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 3KB
SHA256 abe4eaa1a6fa423bcef61b423dc72386a9cf1968b1041de5270c56a7780254ad
MD5 8e589c60e0ba95ca1b178bad0a8298db
SHA1 d981cd3f9eb63636471e3bd4c0fd7585460ad6fd
SHA512 e8c7b5d340e698f3b1b42d6c3b7653b666e0add095611c00f502782928eb788070ca977b54b42f9515127861e55138a3cc0f02540f0bc2e44694fb0ea595ee34
TLSH
T196517D1B4B8AC56A0E53770E02E57ED454996C569EF383CC2106E7C0081A99F43EBBE7
MD5 SHA1 SHA512 TLSH

Submit Download

192.png

Path C:\Users\Admin\AppData\Local\Temp\mqs2f54v.yef\Default\Web Applications\Temp\scoped_dir2556_941389891\Icons\192.png
Size 2KB
SHA256 e401220b69a76a298b2e081a5424af69791a4caa3936af85d8862c05f4ced4a8
MD5 e063d7ac57fed2391e778c3a5817bfed
SHA1 3fddfdcf2917af9ce0e86eddb03725d4a3cdd7cc
SHA512 0de76ca2917cb2162d73a3d61d83dab2795ef1e9ca0f057091cef9eb79c0064dcd13c4749521163e6f77dfe43e0afa68326a32b7c19d8524da509dfbf4f1cb7b
TLSH
T11651060A0759BDB22A31C07991B8D9E7DE0C1003A5BBDD7E19954FF0A913CE43B23681
MD5 SHA1 SHA512 TLSH

Submit Download

256.png

Path C:\Users\Admin\AppData\Local\Temp\mqs2f54v.yef\Default\Web Applications\Temp\scoped_dir2556_941389891\Icons\256.png
Size 12KB
SHA256 6e8f581f4cee7f8f8af4a9e1059f0d3088b792de7045067d74254e2a6f1f9a6b
MD5 493ff5acf7b11c3f1147a8d9e25e7751
SHA1 6009b5d4c6cf66b4dea48b5c558fb9dfee261c4b
SHA512 684256b0a9d8169eb1c177068c0c04518dc1c1a6c2554c32beedcaf0bb4429902319ecb32d8c97671ba361de6e10e9275e8ef778f61934f38538f35b60a963bb
SSDEEP 192:Hlx0S8vKsNbVmc/vC0+e9JaSyw2X4RTv+ovsCF3vKY8XejYHvhX2kol0f993M:T0vdNbQ72iNXX6rsCFyYAZkh8LM
TLSH
T19A42BFA1B310ED73E30AEF2045FE64B0516C82217FE4A507D331D85ABF0FC9998A95A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96.png

Path C:\Users\Admin\AppData\Local\Temp\mqs2f54v.yef\Default\Web Applications\Temp\scoped_dir2556_941389891\Icons\96.png
Size 3KB
SHA256 00f563fcf365eb53a4037624ab3783dd6e19d2c6689c9892aa30ad2b16577848
MD5 43400a5061af952e87a0e06e1062b272
SHA1 5b937e80e93bb5f526a964e2a28aa9579e8dccb6
SHA512 8f3f25039af799f055ea81a2008530562b4b24e8afd65b65566b6dd0cdcc66f3735bf0428bb3c4eaf7079ce15499de3846bcdfc1db0707db50e9f3bc2c5e7d6d
TLSH
T14F819F6325E9E9CAAA5ED62071224074845F04EF59313775F07C18BB13CA56DFD70E26
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\nc5beo1m.qvv\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\nc5beo1m.qvv\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\nc5beo1m.qvv\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\nc5beo1m.qvv\ShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\nc5beo1m.qvv\ShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\nc5beo1m.qvv\ShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\nc5beo1m.qvv\ShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay\Crashpad\settings.dat
Size 280B
SHA256 baeadc39dc4b2a9bc9f74f7eeb3166d5650e8709f68640fc0fea284b62467649
MD5 964b4e9519087cda81c780fd4e744d4a
SHA1 074fe849deb02629dfbbd7cfd9b740f2c7ed7658
SHA512 ff8c575b730db3abd065d3610b16e075f23d5313b5e97bf807c5eb2d9fcbedfa8e6caa606a72bdfdcfa2e3d2f6a16c11b57f8f4667d43d4a00493a0adb76432e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay\Crashpad\settings.dat
Size 280B
SHA256 9ad62f64a240f53788c0a405a04391512270d7377fdc146cde0355da4aee58b1
MD5 70276ba847c06215d3e4cd5c0a54ee3f
SHA1 538aca7acf88f2f18d788d5ba81ae6f3bb939417
SHA512 8b5ec0de32cb772571b2b64147436da47672b16728a70e457aa135a324c50e2ce11f88c0762dd9c3e0498a15e37eb03694c973c9ab88b60e3275537e16bdbeb8
TLSH
T1ECD02220F3028C32F2B02C3223208380C88EF200880A30F000C0002808F23C280CF0C0
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 0f40237d9429f7547242a7246f5243d5c4f8e6823e1fefa96c3c7bbe71b4cc6b
MD5 828684c4293e503c21bae7e9eaf3e6ba
SHA1 bb07eab59c0e02eccc8a3e99efab7ba66ba36e6b
SHA512 5744a818d72477a5307e522b8bf4e56258673fae4682a213ebb0fe2191f1463a65bcdd6b4da82327de84d24ccc38fb46044b64a5e6bf4e89145d27ee69bf3d3a
TLSH
T151D02BA739FA94509DBF87D144B105984151BC94CD41ADCD112EB18BA4B1312341ACA1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 373B
SHA256 1dba50d8010ede2eca43cad2876a9d83d9de06c19729b667a932eb37ac02586c
MD5 246ff2b49df4438c4b4ed91b2d3ddb70
SHA1 3352cb34ef1c0e9f03eacfbfed4975a6ad791ff1
SHA512 6989d6438790dc486de482bbf6a38a7c9ee3ceb85293d1ec8cb2bc7f970a0b6490234e6308bd3e536e457994db30b2a5909cf98ef081f511fd5684c8aa33dcbd
TLSH
T11EE068773DF76410FD2F83D560B105980504BC48CC41AC8E601EB1DBA0B2700381AC62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe593f61.TMP

Path C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe593f61.TMP
Size 153B
SHA256 d001bb610ce36d6e3e01303cfad2747ccf462862ca1d7c093369d9bd9482a47d
MD5 89c6c1175d77645ad6e206e9e8e997cb
SHA1 00c0ca9d10806c8b8f0582da0c3838522ce8c344
SHA512 d6d5ef7ebc2966f1f44266196e1b35b9c4df6b9f64e382f6517096e8dcaa05aa5c3a8ee6fefb1cff4a763a86f69e8db5cc34df57ccfaacd35b2cb1d818604ede
TLSH
T144C08CBB1AAA0840EE5752D1003104E942222C888981AC89902EB1CBB030222362AC62
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay\Default\Sync Data\Logs\sync_diagnostic.log
Size 729B
SHA256 dfad318a5103f88c77b76823e42dea84289089ac046cf7127b3c7ef23fea2c4a
MD5 0238df4ce465f6ed128318ba5c80d7ea
SHA1 a762c34b31b014829a00ff3d6b69c90a858dbf40
SHA512 0ec1c9d45a673c9fe2090c1025013c9bf7d7336bf7f732330ba70ed3b84f7e9c5dbd55909ae851e0bde15a5037fc92cbdcc0ca6f4e9f025daba141c49c4598f9
TLSH
T1AA01ADE2F03911C12E7F25849254A716BA4B71B33116661E3EB58AD15D36E300EFA48D
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay\Local State
Size 4KB
SHA256 b3ec437706d13d07740d628d4e0f583529ff08371f2efb38b370b5ad99a38c90
MD5 f9d7e82549a990b572694c77737f5f80
SHA1 d32f93fb8130b994bb4eecc30198bb3e6ae79dc0
SHA512 2573224b7fb9e899593612b08a5932ebe1445bffd50bae82e8994fcae46c62f7d9e01b9e1abd8b30f1a7bf1a43259c57a548bdc636e6cc4a1378b5e7643eba46
SSDEEP 96:VqGNkzsFfgK4jc51UvDx3BkPvvnk+Bs0eUnOcShvq4a:sGNsZJjaYTuU+BsqOcd
TLSH
T1918183727864EC339AE56558B58A37939E3870B3DD51AFA8F1D8531C04EB74C3B09826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay\Local State
Size 5KB
SHA256 aa175fe7f6189f56fa678180dca7b3a6be90e6879c9e374d7dc5464db30d7c54
MD5 35d2f320cc5a212453ce2cf07e153f12
SHA1 7644d8e391afbd723f70a3be0cc40ed9cc753904
SHA512 df8197e9db2d77277daabb9568f21ac40cf05961bdfc17094cae00ae5766f1281b8d69dd7cf5c5ff8bf51e41d898306601cea5b2f95ab0fe272ccd33e3b9fb40
SSDEEP 96:VqGNkEQsFfgK4jc558Frh/cInURoDotovzojDxQBkPvvnk+Bs0eUnOcShvq4a:sGN4ZJjXooDUwOuuU+BsqOcd
TLSH
T1F4B1B6727464EC275EE5A914B48A3793AE646033E885BFACF2D85B0C04E738C3749C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe593714.TMP

Path C:\Users\Admin\AppData\Local\Temp\nqvicqyk.lay\Local State~RFe593714.TMP
Size 1KB
SHA256 ae98d38bcf937ca3d6a1f3a2e18468e6760dc327d2cf113a1399e61cf4088eb7
MD5 fb0f89e04c13dba337b2de02087753fc
SHA1 8887645b7fbfdded3e7243221c0c03a988d3a505
SHA512 8ceb9cd90710e8735d3d96e3bdc91394493efc66930edc20fb4ea32d1979a0df36543cfd88bb00a82a588034ed6d791c8cf9c81494ce65a6a5d36c6ba5b891df
TLSH
T16A315071B8A82C73FCA15659B24EBBA31E34643281515EA8B1EC5B1C01F77CD721AC3A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn\Crashpad\settings.dat
Size 280B
SHA256 ce40f05feebced37cb81fafb05b4115abb55cc18ad7ebb99a4b9b198b6cd0054
MD5 1e7e852722e5b0fe6c5e70c2d2fb2788
SHA1 dd8f571ad19cd94d20dc26970ce57425f332588d
SHA512 18859f8cd07b9906c62079833f0beba272ace8d4b358930aba01f620e87a5cc08306b65a953339057d1cf408344e38146751218434732d8f37863859a3a8ab44
TLSH
T11BD024345700F4CDC53434313030CF71C7105500540315004130043444411C1DD3D04F
MD5 SHA1 SHA512 TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn\Default\Cache\Cache_Data\f_000001
Size 34KB
SHA256 afd4782e0b7442187ef3334e0dd04804eec2f7e78b66f2486e9aad0e2c0f415d
MD5 86838477fc764344efbfb59db3377e02
SHA1 975ba960ae9f272dcbbffa0bb4846ae66a217bca
SHA512 c070be0783368b0cfc2c82c404a77b3d3a54d4fa7276947675c29af0c0f1596c0820ab6b7f55ffef78204b6270599e52685c465a5e5a14719affedfcc6e5171c
SSDEEP 768:UyU08MPVeXS+IFU8EHGmvKhcxSDctxyvsi0PD:IsdeCV5mG3hcwwLyX0b
TLSH
T1AFF2E1309D56284B8376EC684F46B9E2D4953252873AB157063E974835F13ECB3899CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn\Default\Cache\Cache_Data\f_000003
Size 97KB
SHA256 08c1ade001a530f1e243f27f19e1b070ac4b43ed38dd3bb1d7c40715dc4c87f2
MD5 171a26291b479857a5abeaece2104b09
SHA1 82a1796ad885412da94a5f0f15e91f3e07ca888d
SHA512 9ca77cc7db39ee4dffae42300e1494f9f8fbd6233d7740e9e9d5679b7d8979a58bc8ea510262719af0b4941a62584cafc404f0e8a875fa90baa0a9c1a5af93ac
SSDEEP 1536:wq/tCttbQz328dc9mqGiTLFu5ptbSOcOL1Rnz/Cl0jMHweWcPJsD/gPG2wMpatK:wq/tCjbrYUmqGiTLc3BBHMHweEkw4atK
TLSH
T10CA31289F732DB1F9313943896AC73046FC80367244986FE104FB9D32EDA55B2276D6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn\Default\Cache\Cache_Data\f_000004
Size 68KB
SHA256 10b42aed09380e9e8dbbff509acea3e1a3d5dec55ad67a7762d0ad134aa73e6c
MD5 4a93e1e7966665fe1c220053539f24ad
SHA1 f9068912a5c403d85a47a070c8245d9d85b055de
SHA512 238c07f8a77eb2403d9ccbf66435f3d2732430fff02ac4569a5c580d7575d22be0f3bf356f46ea70f8ee88fd3ee09d8f2b86af195c333ae868ddcf1517bbdd10
SSDEEP 1536:kv7iX/3S9HHJYdpdKl0wgwHMVFn85E7B3k+g2qiyyyg:kmv3fdG0wqVFn6g0sUE
TLSH
T179630207769844C18ACFE9DF121EE523A52073A09242A7DE331DEBF4D7B369358A51B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn\Default\Cache\Cache_Data\f_000005
Size 401KB
SHA256 569664398afd2d61516d4e79e6e62738f2f03a3d8821bcdde9b6268c8dbe9f75
MD5 4ff5bd70179ef5269c1728dbdbf74a07
SHA1 4de4e59a7b27a5d9905cabdbc4d0a7981241739b
SHA512 b3a2bb243f6c5ef34e2b2eae052b0d4c2fa9037b55e9038f5b76bc376b746f746f1cac71ab74b9f2d6353e24f808b549b658ad9954f1ed6d63e03db651c5cfa8
SSDEEP 12288:P6JUnWUGAop/SfI4Gl97/aGPVM0LB2mMSj:PZW3AtQ597/9tP4ij
TLSH
T1D7942370883BAE4C1D5F3738986FD93005A4ED37606B02C9D25DE969E8043977FA9E0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn\Default\Cache\Cache_Data\f_00000a
Size 77KB
SHA256 cb717ed58ef63cb1a17e6baf2f0b65323ee6ef4eab45f4bc6418a49ab041f616
MD5 91d8b2b71cc4844e7b112d70950130ba
SHA1 4ff393a5143703e1efbca1c88dabe70c09ab8641
SHA512 6487ab19079d37682a53b8771ce62dcb0a8d0c04833ef41fbb9fa6479131aef8dd799b04f3912324ad877ce11a95aee9a547f12fe252fd0f1305d23094129538
SSDEEP 1536:3RJ61f+DTQZNEeSIawDgnyIew4EmN9dKj6iRWTKKnDUOusR6CZ:BJOEQZqeKmhIeXpfdKJRW7nA+oM
TLSH
T13E73025ED0C1E372192B5B63C59E7BEE97D910CB426A6FAA3D1F091236090302E55F1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn\Default\Cache\Cache_Data\f_00000b
Size 27KB
SHA256 d2fc1c6ebd88fb175be2c5dc3c27741e32df41e8c05e92184b3cb9ace6753782
MD5 ea242e020e5e5815ec0941667295bd2a
SHA1 78ec8f478a64a4c373db8295d378efa0d6a79684
SHA512 df022556ed72994d5d6ebd480c826ef722812e0b4e00764f74833a24aa6fa8ff1ca4c776fed06ec6823942082926e1a2afd9016589c82298c811031f345989ac
SSDEEP 768:XWm0HR/ESa4tuUsaCGIbZhLLsaETud7yj:GlH04Ypd9xLsLTfj
TLSH
T1F4D2F28F866AC96775CF29143B5D8BD71859F35094483A832F0369D86F9CB3B173B884
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn\Default\Cache\Cache_Data\f_00000e
Size 19KB
SHA256 273db3d2dc34bc331aff134de65ef398456d47c846d8b48e53ce635ec85e1710
MD5 a004ec3830a6fa499ffab8684d528624
SHA1 0cf23548fe52319b3f101339eeb61d0de51ceb68
SHA512 96796228d76de17ee74720d53b8b2c6406a854b1b4475dfb2a08a36e2dfdf5ae28d88fcfe0e4e15e9e89c06236c0fb40577fe08528dcfefb8961c7ee7803e7a0
SSDEEP 384:1wWSHCxqRXm5+W3sARIm9VmhlxAJyicv+ElHUcZXvNx/NQUJzAr1DUkT3lg:bSH1RWlImOxviq+El9ZXFx/PJzi1DUwg
TLSH
T1A692E0FE95EDD2940CCA5CC64AD82A09681DFBD24D6A34C95A6E2D9DC0272C18C4FCE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn\Default\Cache\Cache_Data\f_000010
Size 59KB
SHA256 221be090e69a654c8fb404247bb6a9c791b91fdb2d844866699d88e3776de089
MD5 7fc3f92cc0b3de86dd761b413ac7208f
SHA1 43c65aff43313e43d3eb2dd3318371e8908cbd1b
SHA512 5cbd3bfa6abbcef92b261082358ce7dcc4de8775de3e3ec18cd018acbadd700358ea051706cc290e0ac378fb7d845889ccd9427161c63fca06969a56262831b1
SSDEEP 1536:iNsJI2JNsN9rHAA5rwSyVRGo0APMS9VIu1KY0qel/6ga:7I2Jm98A5kSiRGPA5VIu1H0F6v
TLSH
T14553013146EBCB352B6C97B50FB0AFB466A349449F039A25A4ED1B1FF35347F85090A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn\Default\Cache\Cache_Data\f_000012
Size 72KB
SHA256 d7d0ee585178d3c2c548e6c645a9af427c25d020ae71f3269a6c9736117d5b08
MD5 f4205b30278168c499efdfa4c2fd039b
SHA1 efabb5375bb73dc2ca6de38b6171612c439b8ff3
SHA512 ca5144c8b7afb2aba659da7e98fa0663c6ca5159e9cfdfa915c15d17facac890fc74150d8b99cbe27ea9d0539bc51c5dae954a69471284f3056d10e9e8f1f39e
SSDEEP 1536:RxOmCwT27LfWP5fP6dq0FD9LM6DCf8AXTvtauLIaX0gaooP/u3VTnFZ:amCs+WBfpOS6wRa0IalK2
TLSH
T1F77302DD912B3A0BE5FECA1DDD996B3D3C17AC89B71948A54F88C183C6B4F019299C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn\Default\Cache\Cache_Data\f_000019
Size 18KB
SHA256 d645c80c34c1a6404a01cf74be50231a154b4dc4c17712db70df4eca4adbb1ff
MD5 ac669633b65fef2019145f850da9440e
SHA1 1eac2a10d5792035f8562931fd6a9f3310b968c3
SHA512 b8a7b85b098620d4fe1f01032e00d3cb536739bf6b559e217f60a033865573a81161ea5ea29507cb418724a43f3c24d2fd6f567cd9a00147eff6d1cde6818844
SSDEEP 384:0emvopU1i2sJHUmpaPOXBjd0VU6HSpeUF2NEGr3inG:0CCBiUmYOL0q6y4UFGV
TLSH
T16182D025B888B5E1ABBC9E4B1D66A507746B09C560F1F8F181081BFB7ACB293F478419
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001e

Path C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn\Default\Cache\Cache_Data\f_00001e
Size 16KB
SHA256 843b3f1b0a72146f062df1e089b868bb7c96c0713c022eb1dc44270dc81a833b
MD5 b8968455b2d831a310ad58ec94c33891
SHA1 c6bdfbd402f5f4657c31fdbd0546cd5c7bdd2fa1
SHA512 ae96aa8f29fd26687cea3fcc5702e6a1262fcb82edc1bb562bfb724be34fda8c50ba786e7955757253e2745a86324258a0a078d04893d6a195b5bd2724073893
SSDEEP 384:2aZnY9eHIJJnk6uYMUsbUVnCbmwQNQf2BkV+yozA8XtdGiqbQE:2aR/IHKtYVnCCrM2BI9GA8Xiiq0E
TLSH
T11172D04BD93F447A04D47423ACB2C725FFAE6E4A2D49ADD0BEC1AA18C1FB1E02144591
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001f

Path C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn\Default\Cache\Cache_Data\f_00001f
Size 36KB
SHA256 e1d3f50d63dd8ded01a9955ccad5a4ba07b0a2ca974f51783200a324bd0b2c0e
MD5 34dc0e84591f4337a78cc9a157736dc3
SHA1 11ab3af6ac0fca4fe1f32f604c7e4d6fda05732d
SHA512 fd5f816913561c65834315fa768b7aeaaa265df1ac0126649f79cd083c432828301e6f65bd795943ccb0a27ff8fecd1446deb7d01c86e13bff678fb525d30701
SSDEEP 768:a7JJnE1ukVvee1vVo+SeVgkXGGG+IPfDsijr2MsCBqiO8PgiWDa5mJ:mXnE9VBo+YDB5fDJ4CBqiO8Pgb2YJ
TLSH
T14AF2F1468867325905DB8BA2F6413EA4322F6D5BD71B39BD3F04DC2C2F0987FA93154A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002d

Path C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn\Default\Cache\Cache_Data\f_00002d
Size 16KB
SHA256 e58af8601c2a4845672dd0023e4e1c437a3aff7aa9c9b1b2a905313c63e184ef
MD5 a7ae8d2f1ee86238a47e549eded08cce
SHA1 b6ad443b7ff156161fbca64a455ad61854bdbfef
SHA512 1ce92da506fe30bb1577a06bb86675e5a5c5fdd733b35b13f6289586390d9f7dd01eb78390b266a1357b3e96d4867ab627f3c7430e926c314211d991b6bd286a
SSDEEP 384:hQ5lJeu2wteTABEtp+SE09e/JuScVrgvT9PQUNc/s:hkj2V3ef/JuXM9RNKs
TLSH
T13972D183C80C1ED1D04EA01E4773D63ABC296C446A541F1D7E8AB9DE56E8BDE8C68D92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000030

Path C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn\Default\Cache\Cache_Data\f_000030
Size 41KB
SHA256 1f4f6417ea6875928e3d1d2ab783b114ac11772f4678945fa8dd941245f37771
MD5 aa07df331edfcfe171b296dfb5597f94
SHA1 8990111b7936dd792f604853d9a1f66730caf37d
SHA512 9088aa7a8025f7baf147a8066dd2c3aa070e2d8db207cfb9ca56c413bae1fd93bc5eb526174b4b0111d89809e4ac917ca3ac35fee65486f429a3cf39ca5a97a9
SSDEEP 768:VQlgNZwHo32U/lXGGP1J+ytJVdK3seQCLeUabBe7cWTCDD6oM4nSJ0iZ:VQlKZwI32Uu+05av07ZVoM4na
TLSH
T12D1302AE29C9B9824759A42C7F6D926DC778142ED58DDB13F60327EED1B43C20C7848B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 384e9f85a86bb33094f978f1c014cdf6c7d0ca817f6a3d49279973ffdf439797
MD5 313b9834a68f2e24879519316b9541dc
SHA1 b695f01349632c9fdb44ce290e3f50e7de144ed0
SHA512 8b36895388d90567c85d8fef5feeb57ae37c25cced63dcdd0ff781c20ce275247844870926d190c836f7e9aa13a52beda85c8206b181d936993d5dac562f70b7
TLSH
T141D02BFB18A60450DDEF97E241B254A101117D545E06BC4A40BAB28358B221BF413CB1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 82b40574e9545fa7ed8b2a14a2ba1324461e41542b1aa586d0fcef103bf3a71a
MD5 50c3d88c50ecdf31b85b291e01ce29c1
SHA1 0347ecffae191be232ca773c7227f4b3cb24ead1
SHA512 35a6196bcb030782176621e909e06d5d5ba3b3ea79b614679db9380427d70219e7ba00988230b79ba5bd5e6c3b4a666139b858806f73141eb1c7a1175f7478b2
TLSH
T157E0C0F73CE71810EF9F8BE254B248700010BD048901BD4F5077B2C350F220AA0A6CB2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe596845.TMP

Path C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe596845.TMP
Size 153B
SHA256 3076293da86f0928c6d10c983bdf72673719291a5af47d61aa357628b9971a83
MD5 2a3fe1f0e3f84f3dc6bf30e902651fa9
SHA1 75c1605b41d12179f8d7065738b473fdc2389f1c
SHA512 471db15ce65b4e965b8a5fbe9a3813c89b3b558b58e1f1fdfd595bdc11dcabd3498565d30570991a883f406cbfa927755fe34317813cbb85998194db5108ae09
TLSH
T1FAC08CF72CA90840DE8A92D2427218A14212BC846A45AC49806EB1C760B0122F013C30
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn\Local State
Size 4KB
SHA256 debe8c42c859515d3e2f57e8e569eb8fcc22babff5798208bdc5a2a73d8ebb41
MD5 3f713d44cd55e9e269aaa211f7432c94
SHA1 77301e13d48a0bdb87175f423942ac3251005fb6
SHA512 579e3a9c394885715d12bbe2e9c6d2337959429b7dd95b76934f375e66c8c6b24f0756176569c219f83dec023cf94acb9f690d9e5b2a74ab858f7c360fed3f8b
SSDEEP 96:cqGNkVsFfg9fs899Q1dBDBBcP1vsA+br0eUnOQz4k5q4a:HGNSZ9fn9wH3m5+brqOQVa
TLSH
T1DA8195712838EC2369E56654B4CA27939E3830B3D941EF58F1D8530C04E775C3B4AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn\Local State
Size 5KB
SHA256 9d7a69f0bd8bf9393ddbe9b5b966459bb490d85b3a331c5f9a4364ac7a0a17dd
MD5 4343799689038e472f2837a8e49b7d62
SHA1 7a0279e006b47bc57e62c83e5ebce2be6c91233d
SHA512 6d4ea7d358c765ce2f07bf823915b50c03fe3a313a2999ccb370bc409e8dfd826968ca8a94571c16780e227cb173ba107ee760a9917fce6e3f2e1e90f66ab13d
SSDEEP 96:cqGNkaQsFfg9fs899Q58Frh/cInURoDotovIODiBcP1vsA+br0eUnOQz4k5q4a:HGNyZ9fn9looDUwVim5+brqOQVa
TLSH
T170B1A6726478EC275DE6AA54B4CA2753AFA43073E885BF9CE1D81B0C04D774C274AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe595cad.TMP

Path C:\Users\Admin\AppData\Local\Temp\pn1z2t1g.2gn\Local State~RFe595cad.TMP
Size 1KB
SHA256 f52449ab5da838a1c29f97a622ec530e994b60075b8cf5fba043a6f00a163a84
MD5 23be9c2ce2885b41417a4088f79ad385
SHA1 f9d3769832385d18eaf269ddbb99d6d56394f261
SHA512 79ff5c13c80575a7f90adfa4ac5086de90b0fd6ed45bf2d03d670890f0631783f30e5c6ea3e90a9300a93a1c8e17540e9c61cf9d0406648e3318a00d8d565764
TLSH
T1523172B169B82C73BCE12665B1CAA7135F3461B2D196AE4C11EC071C05E375C661AC3A
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5652_116887344\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d31ebdb-785f-4da7-9e1b-3f988860ac1e.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6020_1325897327\4d31ebdb-785f-4da7-9e1b-3f988860ac1e.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Google Chrome (2).lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome (2).lnk
Size 2KB
SHA256 d43175c690b00ae2a1a44d01a5217a6b0b0a6f92c888442947a3530087b5f82c
MD5 28e375d6078c07fbba9c9b7e96943878
SHA1 d3d19f1f4f92fab9938e21737fced5ad6940776f
SHA512 70541e507a2801143130a03d2112fe0349d337323cf8b30fbe3f785fe95d3550241973dcb8841e36c5373314c1654f55c9314f2209242c61d0004ce3da4a4950
TLSH
T1E841AC1577F91759F3F38A7669B337300F7BF816D2A44B2D509852880CA1600459CF73
MD5 SHA1 SHA512 TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 7a35c5e90bc7a489d7602cb6cdd1b7473731ec4bc5411a68e5e018bccf575a50
MD5 72d8bd6970e7526063e8a60d6a28ace2
SHA1 1600593578cbab5505087309df03fa8bb20b0ffb
SHA512 3c72a869f7750f49598e37975e9813d5b6002bde369c54c92fe21fd19bd476b5b16211915da733c467423d37f4b72a2db01718b163a270c71d7b2065f8ae464d
SSDEEP 48:HvQ1dONc9KVRJ9zCNY5dLXuH0pxuQ1dONc9KVRJ9zvYigdLXuHP2F:H9Jo2uUjUJvtIug
TLSH
T13891E05157D61E86F3F3AA72597377205B3BF9084B188A0E0141450D1C76B19CA6DFF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OxGIsizVFz.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OxGIsizVFz.lnk
Size 1KB
SHA256 b8db911dce24a89057768e8912b6a967351e7abbf3b5a96297a7acb994bea733
MD5 43cc90971a06d7f246c8a407c052a13f
SHA1 f911c54b902a25dc0362f477a9c34a955ff6b5e5
SHA512 8ef1fb471f85acc4f7095657568bc9ef92720b1970a413f0aeee9fbe3737e362166da4294dbdf065523e1dd6d7727972d524e2eec4a0d727816dd0a05a76ee90
TLSH
T1C231D2140BF21B04D7F7873968F7A3249636BC44FA649B9E018056AD5C18610E978F3F
MD5 SHA1 SHA512 TLSH

Submit Download

06f3c452-5c49-4a93-b2b6-66389d63be6f.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\06f3c452-5c49-4a93-b2b6-66389d63be6f.dmp
Size 66KB
SHA256 598ab0d3664d0ce142c990394f69195a4e681aed95d55aeef31f0ce4e6cd2c77
MD5 0f130aa1bb309b1b7e49e6a1d10a02b0
SHA1 b31e6780b7920095fd8046c53f76bb45e964230c
SHA512 18a6ff63db9a064d48efb0ae024a83958a0f334c8f72253f033758dcacbc9f5bf5ca91d7d65dcaba49ca23fe8ac735975c760e65d0865af0b0e87cb2e2d66155
SSDEEP 768:ADhUzPberlNZP0di3tblUH/S4ZCVQutesua4QLxVhKnDw3LHCeCeCuiFEXGqBFhC:sibc3PQJoGPsIMY
TLSH
T17B63A81277D44A61F566DB3618E3A30237F7E89147A3C35F023855AE2CEA3E06D70E96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06f3c452-5c49-4a93-b2b6-66389d63be6f.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\06f3c452-5c49-4a93-b2b6-66389d63be6f.extra
Size 10KB
SHA256 5480c0a392561a47bac75a09a80db4e47f8d39e43bce13ca7f7991dfac7a35e1
MD5 72dcc6db721cf763f4412a171ada160b
SHA1 057ebd41fd79ccdff2cb211440bcafd2d6e5f96a
SHA512 10b9d7dd12e1d5f33c44358bc4a080bc16bfb70e7813b66cc22c9509ed92488cd214373c4aae2bed129d98768d65bd68c5b8ccd387e5cb8c0f2f27d21a0cf4eb
SSDEEP 96:STWCdllDTjPY6pw6lFFdtH0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7aAutILfcBCqz:S5dlVfFbG7uvZ8RLGxsP5wlKpfog
TLSH
T1E5227153874724B7AD4198C4BC30AE7C45EC6EAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06f3c452-5c49-4a93-b2b6-66389d63be6f.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\06f3c452-5c49-4a93-b2b6-66389d63be6f.extra
Size 10KB
SHA256 e5f4a00cf1107055e1a899c4be339d1e19c0ec36fbe23b1b6e38555e2b63d9b9
MD5 1fc86a652fe2e159850de4d2668ab636
SHA1 5800ccc237aed897c3d01400c74dc04a0101d7c5
SHA512 8c6212bef0c1e151a7f59fd44b58c552e22249e8c59fc19fc83ea3fa4c82dceed59b7ff6c62af141fce9a30d743ecb6db0c7a9e54c1c796100334ba242950153
SSDEEP 192:S5dlbcFQiR4p4DnTYapdVxzPjWBHa4T/fKNtalypfoAbLA9H:idNcFQi5Dz1LWBHa4Tma4AAa
TLSH
T15F32E721091CD837E7D6AC8DFB393E3AD26D7B1B10E678AC41CDCA49C1A5878A779413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c5a3333-5a84-48e0-884a-a3b8232c4a73.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2c5a3333-5a84-48e0-884a-a3b8232c4a73.dmp
Size 64KB
SHA256 5401807d88e449ffd7b1f52cea1fb8ccdb4662eee77d5e1f215339027312045b
MD5 0e270582932317e4268fcc0e6ebb647b
SHA1 47d985754bf61a82377fadc7e00d4875e39858f9
SHA512 d11e939590955e3be81057cb86f5dbfa126a0f875eeee400f3cf283b845992e17c6f62635601156f47c6b21d166828dc6581aceef179d35eed31439956184a8b
SSDEEP 768:HpejPi75JDeTT4jUf0LTpvoUH/S4Iji75JLi+Y4osua4QLxVhKnDw3LHCeCeCuiT:B75JA5y75JnYvJoGPsIMY
TLSH
T18653D512B7C84A25F5658B3618E7A3113BF7F99147F3436F02326EAA1CAB7806D70E15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c5a3333-5a84-48e0-884a-a3b8232c4a73.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2c5a3333-5a84-48e0-884a-a3b8232c4a73.extra
Size 1KB
SHA256 6353b13cda7a6db094b49beb783f6cda0089fc7f8c6fc5bbd4ffc79eb641d761
MD5 53dc16a984c34296f2f8e36b375ca010
SHA1 cb2807f2565257b7e884c377ada8ea524baf32aa
SHA512 a186c6effd19cdb7559ee334a47f9f12203d50ca78bf00c45edf37f25e7d0d083e8bcdc87f41273734dd7590c6ce920dcefd741dad700a9552949824da5a6aa0
TLSH
T11C3172B3C2AC2E2299578A98B33E13038999B32345D32D0C38CD4A08858E4DDD7669C3
MD5 SHA1 SHA512 TLSH

Submit Download

2c5a3333-5a84-48e0-884a-a3b8232c4a73.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2c5a3333-5a84-48e0-884a-a3b8232c4a73.extra
Size 3KB
SHA256 f2728218d821adcbcb8ea3602917263a4ec18d45c06e69b2efc0a8109a3853eb
MD5 bf10d2d4bd81d96f39e03989aff85516
SHA1 faa50b8559b5f58f52a06c22f7fad32a91b867a3
SHA512 0f062a46dfb43df8e8eda452e1c397946ee578d9bbc18b3884bb5b6500af7f0c6dd9e3e049d2cf517c3a3229005b0b25a768d07559bafc7247c3391e036d5a6f
TLSH
T1AC813335015CDD375AEA5D89B337AD1D89DEB31A98623A8C91DBC75C01A8CF4B386183
MD5 SHA1 SHA512 TLSH

Submit Download

50db9854-a850-4f0c-98c8-b408291e0d4d.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\50db9854-a850-4f0c-98c8-b408291e0d4d.dmp
Size 66KB
SHA256 91490da6a0978ba50677725e95aceeb044e81e40e43b9a12bd3c63bb33319e07
MD5 1d429f12f9cae5598d50f925ace3eae6
SHA1 e1fb3d0e63ba3abf7ab5b0a91465a6fec63d6ce1
SHA512 a34d5cfbda8392dee9621d693ccfa9a25f14a8022ddb60d5221e097cd18ac55b160660d39cff1ed3c4d74f5d719d63ca14d8fca858042280bf89df32f82092b7
SSDEEP 768:e87Yp80lsTb93UH/S4HdRH84/hbkNViIVPUQHTbpsua4QLxVhKnDw3LHCeCeCuiT:kD/CNUUDJoGPsIMY
TLSH
T15E63B715FBC44A35F6A58B3558E7A71937F7E89C5392436F0210A7AB1CA33806D70E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50db9854-a850-4f0c-98c8-b408291e0d4d.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\50db9854-a850-4f0c-98c8-b408291e0d4d.extra
Size 10KB
SHA256 5b230fab13a3ffec5a296078097fbf9b9dc50999c42dc87145ab14f7a4738322
MD5 63fd403a2e95dc9037b6c0537af4452e
SHA1 e86a9f2f11891330696b42b4693c34a2146b401f
SHA512 fa5261047df884e99d5951b6d93a5a59c1011555b653c750f7a7960d6c5d7575159800ca5029fabd5589125411a146096b0a14d768118539582591e1fd5eba41
SSDEEP 96:STWCdJDTjPY6pw6lFFdtH0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7aYutILfcBCqwA:S5dBfFbG7uvZ8RLOxsP5wl7n8foW
TLSH
T1B6228353879724B79D4198C4BC30AE7C45EC6FAA61F958A802CD4D47FA468F81FB84F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50db9854-a850-4f0c-98c8-b408291e0d4d.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\50db9854-a850-4f0c-98c8-b408291e0d4d.extra
Size 10KB
SHA256 3606639ad987a8d386306724857e9eb44e1388a7ffe10b99e59eecc94f36cf48
MD5 3b075feec3871de11c1e842542eab1eb
SHA1 0bce73babd277a441f47dbb8ae6ef6cdca953c88
SHA512 642b13cd89173467f2db69dd3785ea1a8292a22744892eba7ad03c9c4cdb3324e01fb91924c410913afae3173adb6ae0ec6f20b5ddb37111e9d2e946b1bcc0f3
SSDEEP 192:S5dncFQiR4p4DnTYapdVxzPjWBH64T/fKNtaljn8foObLA9H:idncFQi5Dz1LWBH64TmaqAOa
TLSH
T17422F721081CD837E7D6AC8DFB393E3AD66D7B1B10E638AC41CDCA49C1A5878A779413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d143665-03ee-41f7-a3b5-bc73517b84bf.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\5d143665-03ee-41f7-a3b5-bc73517b84bf.dmp
Size 59KB
SHA256 6ccbe9684919c4342de3f97ed9d55e97d9dddaa021d7b547399e5844d2ce14bf
MD5 48f7acf03716d73ee540f0263a45ccbf
SHA1 365d10bc0b24459ce35f35460bbbd420fc4dd4a4
SHA512 9914d80c9543f53e8c738751ebdeffcac4f62ab39f479064d2ffeb73007952ee76f767c2ec5262a750609de7a9175c7c622cf908fdc46dec07f4811f40e55100
SSDEEP 768:6dfxORdF0N54t7UH/S4bXVoYJrsua4QLxVhKnDw3LHCeCeCuiFEXGqBFhFo2KX9n:ZRO/JRJoGPsIMY
TLSH
T14043C81167D88975F5758B3629E7AB013BF7E8B80B93875F021099BB1CAF3846C70E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d143665-03ee-41f7-a3b5-bc73517b84bf.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\5d143665-03ee-41f7-a3b5-bc73517b84bf.extra
Size 10KB
SHA256 c8c183e5b801d34d0bedaef69b1157b7ed7f5c66473ac65fbd2c6298ac493368
MD5 95067a6c4a37f15a6ca53e1617f7bd65
SHA1 5e8a12d6003b6870841aae63a47568e51dbbcf48
SHA512 876b53968a0e685c03ba201046f148b93016f1b7a6376ba68dd180ad1d746e4acd47d64afbec340aa63a066179b79c01550fbf18966e41b57387e0851e3a94d7
SSDEEP 96:STWCiDTjPY6pw6lFFdtH0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7aiutILfcBCqwvB:S5GfFbG7uvZ8RLgxsP5wlqqfoY
TLSH
T1F5228353875724B7AD4198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d143665-03ee-41f7-a3b5-bc73517b84bf.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\5d143665-03ee-41f7-a3b5-bc73517b84bf.extra
Size 10KB
SHA256 9d639d3dbc0af2d1ea2a95b0003025bef999afdbef19c55a69a3bf49e8834b93
MD5 8ff17b877e4ee958193818be418ab088
SHA1 0c786c051a09ccac8f7796a1dbbd6cb1515d818d
SHA512 6b22d5164331d12d644d322b4852a75cb10f7e82aa8d97143738f893fc2c0b2e93a6ef0c56e738177138c85002120ba72fa17464d0a23eab446bab7504eaece1
SSDEEP 192:S5icFQiR4p4DnTYapdVxzPjWBHm4T/fKNtalCqfoobLA9H:iicFQi5Dz1LWBHm4TmabAoa
TLSH
T18222E731081CD837E7D6AC8DBB392E3AD66D7B1B10E678AC41CDCA49C1A5878A779413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86f4b790-09d6-4ec5-9cdd-b773700475b5.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\86f4b790-09d6-4ec5-9cdd-b773700475b5.dmp
Size 64KB
SHA256 38510d20493d7561449627d0bb065d30fc1fa50a4574498bd09dd5d72bfdeab7
MD5 fa7dbd72f5c4ffc6e1663c04a2422779
SHA1 767b1eda0b33408abc24ae49b7cf63753f20eca0
SHA512 3a0c6d64c58f506d31507d36e925c80c18b9dfc889a2583470e8dbab06aaed1f8b5c17cbcd25114c1df5f0582776d557aa34d6f3064bf25ad928af4327a24866
SSDEEP 768:r8NbH+S50ilnvI5iUH/S4f3lWSH+JJv59izsua4QLxVhKnDw3LHCeCeCuiFEXGq8:DMPg5JoGPsIMY
TLSH
T1C053A41667D40B22FC65CE3618E7A3113BF7E8918BA3431F761069AB1CA77846D70E36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86f4b790-09d6-4ec5-9cdd-b773700475b5.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\86f4b790-09d6-4ec5-9cdd-b773700475b5.extra
Size 10KB
SHA256 b16be33a0a5e33c3c612a348b1775fef3866372a9ec647808c161da4d93fc9c2
MD5 3b193d5da7c750c0857ead637a038180
SHA1 aab9c8c8dda12244d110907be99114348dc7c577
SHA512 ea07189b85000759b53802abaeaeccaec7eee2cd39e28ce2b85ae5aedbc30781c19f2adde753487bad790ca2ef7620a00a78087e876d2e9ecebe7103d521beb5
SSDEEP 96:STWC/DTjPY6pw6lFFdtH0Rh7CTvBb1d0FjMLlIrLlhTLlaXv7aZutILfcBCqwvEv:S5/fFbG7WvZ8RLJxsP5wlcqfoV
TLSH
T149227253878724B7AD4198C4BC30AE7C45EC6FAA61F958A802CD4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86f4b790-09d6-4ec5-9cdd-b773700475b5.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\86f4b790-09d6-4ec5-9cdd-b773700475b5.extra
Size 10KB
SHA256 c1b6f0a1495e50e2ff337f0621e8407e50f1364c4df22a9cca83a75a11627808
MD5 86f5f82394af39a6b3ceb162737b8225
SHA1 8d2aabe95e885cd60a75f3e8b47dceb110d79921
SHA512 80de6dccb83bbb5f800d333d62a357694061b0c3dbba21503b38c69442034cc4eedfc7519231d245380e1f022d553945738de57f134cc73c395c63fabc5fa9bb
SSDEEP 192:S5tcFQiR4p4DnTYaVdVxzPjWBH54T/fKNtal0qfo5bLA9H:itcFQi5D/1LWBH54TmatA5a
TLSH
T13622F831081CD837E7D6AC8DBB393D3AD26D7B1B10E638AC41CDCA49C1A58B8A779413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 f83037084c47054337f055eb8143fc13be040f4aa5bafdfb3d4bfe02748b53ee
MD5 899397897895666aba17fa8175df7a5b
SHA1 df9c2a6d6b12fd54dee355736eb8bd46564de8bb
SHA512 6510a4f7ff66b6661ea414e5caf3806f8a9155c6076acf6dcd4a3312a0c08cc3b4a513a856300d4c022ae7642f6f2145c66f4e56c296e6cf60e0e7bf3f49249a
SSDEEP 192:aOv5zboob4myjH8YN1d66Joz0dzgCl6mc0dz:Zboob4myjfrd66JozQzgC1jd
TLSH
T1D1E11E64F628863FC408427BCDA61B400F36399AA84E3F1935ED650C2D5B2DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 d952d568319dd57decbec6cf294fc34723ea18a7cfd2711925204bed56512a18
MD5 4c836e1ac295e853a0a6213a49097114
SHA1 7bc26ac2e4359df12e3d5a567faefd107617b899
SHA512 d97d7303fad1d146b2054b3465dffc2b7640ec492120b47dbdd1034a293bd75d1e045d977e3ec1df373f185a909817f1873546d681e7d7089a2491807eb20d52
SSDEEP 384:GFXd66JozQzgC1j9boJZ4myjcnCZrx33OmTGcmhuAwM7KDN70Ybab0379bjP3:GFgmnKtnkTGcmhuAbKDN70YbabcZbT3
TLSH
T16BD2FE94F72A913FD41552BADCA507002F79B889981E2F673A4C646C6C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 04ba6e681a147868891452756a3ae609f786dbc192a6b67722a9cc4bc44e00d5
MD5 9cfbd4924e96b264ae4da739603832e8
SHA1 228c021cd9064802df0a4073d414d2c3246ba384
SHA512 237b6b881353a0ec572b7b624706cc8e243cd89b4d3035c0e539f7598e57f536d7f371bf467b747170e757ec1752965e4973817bc0da7eadf6d2988df7caa676
SSDEEP 192:xf1d66Joz0dzgCl6mc0dNOv5zboHJb4myjH8:xtd66JozQzgC1jMbopb4myj
TLSH
T114E11064F628863FD408427BCDA61B400F3A389AD84E3F1935DD650C2D562EE7A9D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 1d0e261846ce6962a44bb835a77170bcf4b480f70284cb6449e1c549f742164f
MD5 ac54732815acab631c420f439d5d9253
SHA1 1ecf8e75b703f67c2f3c6b20a531d28bbff8d97c
SHA512 138864ac9d88bf7a013e62b9138ab05bd9779e5f24d738e3c1d34f099fed5169e1490e2c831ff12fe3232ca657ddfd413e378424d3bdff97e938e3e46bfa4a2c
SSDEEP 384:4boUb4myjcnCZrx33OmTGcmhuAwM7KDN70Ybab0379bjPF0d66JozQzgC1jd:QPtnkTGcmhuAbKDN70YbabcZbTFhm/
TLSH
T1B8D2FE94F72A913FD41552BADCA507002F79B889981E2F673A4C646C6C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 9087cb59e2e5d4caa826f520fc3a4c753c3e8d75922d9003af1fe2de15142a45
MD5 f5ecd6953ac3091e0cd6631022c30310
SHA1 4580ad75bfcbce7403366182c58e8d8c11ddda2e
SHA512 9da4897e81df3633bcf5902fa166d8d9083f216a73802a3c479668d69f494a1221e017fbf5d16b32751eee6aaf7ef6e111912e6d58c55213f9ce681afd32ffc4
SSDEEP 384:TboJb4myjTmd66JozQzgC1j0nCZrx33OmTGcmhuAwM7KDN70Ybab0379bjP3:nMqnmqnkTGcmhuAbKDN70YbabcZbT3
TLSH
T1C8D2EE94F72A913FD41552BADCA507002F79B889981E2F673A4C646C6C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 8a9eb4d0646b8c3b0870ba279f259b90d31c127fe4fd0cf1e611fb54f11df48c
MD5 576d2cd247de189d1013442f06243e5f
SHA1 ce4c90c5e2f37c25518905793f8c076bc9fa819f
SHA512 fef5a704cfa39ff2b96405be66f49692b5295ec25b827b518892e05aea0c515fc932a5c17a527a8dcc08c067452b9325e11bc4fe045c6be6ae5e7488ae1ce9c3
SSDEEP 192:xF1d66Joz0dzgCl6mc0dtOv5zbo8b4myjH82:xDd66JozQzgC1jgbo8b4myjl
TLSH
T138E10E64F638863FC408427BCDA61B404F36399AE84E3F1935ED650C2D562DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 28b7a0a1c104cab3a8e39694efa986fa5d9a7ead636124539b44d7ab4992f6d4
MD5 0fca4e86c2df8fd30ffd6d6d152b0ae3
SHA1 83bab4c9ee852ca13a606d0e55d0bb6f1171a64a
SHA512 1a415f6f669bd337b41eca57e9e64d2395a2f721a9631e60545a038981eb32022cd2faf7d878b139d149ea2e6b374559173c8d06ac935be3834439c4f1be5ee2
SSDEEP 192:Kf1d66Joz0dzgCl6mc0d0Ov5zboHJZ4myjH82:Ktd66JozQzgC1j9bopZ4myjl
TLSH
T1F0E12FA4F628867FC408427BCDA61B400F3A389AD84E3F1835DD650C2D572DE7A9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\events\events
Size 1KB
SHA256 467f51edd4ba4bf9fe3858f5a9fded7765fb5571a03ec438c9664973c95e8100
MD5 f54d03fbf3ff0e2d7c4a3253ab15cb26
SHA1 e8c639baf517fd0076301072e369cea275fb68fe
SHA512 990dfd746c5d1b1c0542a6c9b4d006323ad566af0045cd12332f5874002989f2fc0b2022ce030c5fd79e2c6dd67e02abdd91b600a09774c65dd4616f6d9e7c32
TLSH
T104216A4C3AB94D7A69C6E6DCB45A028E53A18E0708C71C534D52DE8CCDC5ADE326B83D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\events\events
Size 1KB
SHA256 1eed0732d56110fe3c42f59d77b3a683f0407369057d3798917db871f4804970
MD5 a2bea4ee2ed955550046eb008233b552
SHA1 9ed4021b3ccf34efe0e52f459e7246fe8f629e29
SHA512 f7ad6f2e82fe36bf27e25c969b6b091cb54c0ee9e4e1309215bbde722ced8356942b99b0c2d0cf31b59176741dc32d99ce72f2a1614c9d37501a7ed0a266d640
TLSH
T1DE21379C3DB84D7A9D9BE29CF885028E57518E0348C72C535D52DF8CCCD5ADE326A839
MD5 SHA1 SHA512 TLSH

Submit Download

0da76aee-a22d-4535-8434-a9b1c68bfe2a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\0da76aee-a22d-4535-8434-a9b1c68bfe2a
Size 16KB
SHA256 ef1516c4ee276c4c92d06564c3f65c2b3a1825c0b8b44d22f4057545fddee3cf
MD5 09715344702d0dceb73cfb7422eea964
SHA1 71c782dd8c91e33d6702c35bd22308e1c18cf9b1
SHA512 adaae597e2c2ab4d2132606a84c6b4c630c68de1b12a605c5548e3d3c906ea0090d2dee0679fe3c1c03d42acdc6733ca823d27613a2fa837ad194406dca87b4a
SSDEEP 384:SroRHKqlybdhUhNtyec+Dz5VcwalP8lrYyUs:ouNtN75VElElnL
TLSH
T10072D956282049BBC251E3A894F9BFC3E5F528CF4C025FCA9BE47D085DDE0AE512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14629d91-c7f9-469f-81f4-24dd5f786e87

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\14629d91-c7f9-469f-81f4-24dd5f786e87
Size 2KB
SHA256 38b30c2e446bd20405ca5516ffcd05a4d97367a12bb63fdabc491a71e2b6a15b
MD5 b051b71d9310a1dd8d20b3b0decc0c3c
SHA1 057af377a8c470ea13f95534dda5f17f1a798181
SHA512 63687bf13f00bf4d1654fb1fc36eb89bec071dc1b9dda8589199729db18ff89f35c8a5430d3e14d9710127c8179285ed83361bd94f6fd725ffae652921bc5c6d
TLSH
T1E14123AC35749CBA8CDEE15CD482338E53644B0340C61D432E91DF0CCC9E6D9636E51A
MD5 SHA1 SHA512 TLSH

Submit Download

15e67879-1c17-4085-a5ff-e7e49c39b827

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\15e67879-1c17-4085-a5ff-e7e49c39b827
Size 3KB
SHA256 725f64bf2039de485f628937945b717e6d667abf34abb32c726427e1ebbf8498
MD5 2c18b4ce15d748d987b418c6f51c3ff0
SHA1 a07864ee410352a0025e2a98f6f883e4e5d8dc3d
SHA512 6b35e5d283aef9b218945699b3e5bae61e8627ba81954dda3b521e11de56a42a112d75ee6c009c4bb0b6dc3d160954dc6dabc79549ba2fdd7a96da7af29f6450
TLSH
T10F616621056879739FECB140E33779549EDE339B58530BCE257ACD2842F88B4978B25B
MD5 SHA1 SHA512 TLSH

Submit Download

19bc64a0-217f-4447-9a55-208edf9f4ca6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\19bc64a0-217f-4447-9a55-208edf9f4ca6
Size 235B
SHA256 09a62f3f2feb6bdb04f84d06fc95ac214c2621d587204debd794dd39927197c5
MD5 ba884b0580f8249dc8e32462332e58bc
SHA1 e88ea9f3b88029531aa66b5a5ec6ee71517b2034
SHA512 155cc52688cc4129c6898acf80957090eed0340ab26d92df10c24a1c6c00d5a0fe4dc7a4df2187be0f3b013fc534209ceb17b782b33ad352680253c7c49dc9fa
TLSH
T17AD097C014C8A37E0C100F46B1A06EC230884C372874E81085501078CAF9EC682A2826
MD5 SHA1 SHA512 TLSH

Submit Download

1adeddf4-c65f-4308-85ff-bc102a1241e0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\1adeddf4-c65f-4308-85ff-bc102a1241e0
Size 235B
SHA256 3bd0b8d9c1d630a6d9814d8a031b9681795e77fd65a4cbf2bd99c21c17bc8455
MD5 f5dd4405bf943cd03b4f0607e88e32b8
SHA1 47ad6651280df502a831e76f66040c8f3a9c2b2c
SHA512 54bf4a67813bba317ad0dc9cf585e5fc801b0a6193c75198d2d92ce5d55422bfd9ce7d0126c05de8b140ad6c2939ff9a4707eb2baab0b0be7a676bd838596fe1
TLSH
T1D5D0978014A8336D08180F0BF0A069CB70458C3350F85860C6D142B48AFC9CA515190B
MD5 SHA1 SHA512 TLSH

Submit Download

1b7f7e99-82d1-4497-9e23-2c04009b2006

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\1b7f7e99-82d1-4497-9e23-2c04009b2006
Size 914B
SHA256 15eae9b00e92456e8be3b7469cd5db98077a03b4c523bdfe567f6e7962fe4da1
MD5 0e984c6a275663af13630baf641dabfe
SHA1 105fd98a00caa8100e2ca08bc5834200c18ceab9
SHA512 6863312d16796800f10920666fb920949d7679f0b2de5ca3a2162ede69b632fa633346109110b4543a6adf146c8487d320fb403b6259665613e654d6dcf9ff1b
TLSH
T10C11D4D09634B9F28D28D35BD795770247B47513C0C64A087DF54B140EDE02ED76A30B
MD5 SHA1 SHA512 TLSH

Submit Download

2e343b07-97da-4e36-ad40-e9be3af8fb99

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\2e343b07-97da-4e36-ad40-e9be3af8fb99
Size 3KB
SHA256 7c6af75a5cefde2b748fcd494a1396f45074d4bdc91e4f4c2cf3b080217cb4d7
MD5 2b9267c3060cb184af563bbeeba6677c
SHA1 f157a84b23998b02bc23d27d1a9c5040fe6ef7b4
SHA512 1ebfaa1a6d3780630f531e68813426574cf3c0bdce28d814a0b9302d6a73530f92b83c4c900ca2c58da11bd6f2e93b9738e87f06a866770f2ed04cb842e79858
TLSH
T1CC616731056C69739FE8A504A367B9548EDE339B5C430B8D25BACD2442E88B4578F35F
MD5 SHA1 SHA512 TLSH

Submit Download

315dd99b-cfb6-40f6-9514-c9d0cad17535

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\315dd99b-cfb6-40f6-9514-c9d0cad17535
Size 235B
SHA256 ecb516b7b8dbc0ebf2c7549540033b7236a1983cb8a1a7dbed1f5e23e20ee725
MD5 fa9e78557e2461d0d5df77fc811f3818
SHA1 ad39c1232a3d9db7c27aa56cb89d2bdd4c147862
SHA512 546788969b2a86a1e488bcf50443eedbe5ed4dc2af7de76daad2c7da03ae0c6a252b619ef394b5a46395738f6435382ed31d220ad79ecd4a20f84e24baf4bcae
TLSH
T135D097C029C8376E88301F07B0A07DCA3084CC3328A49820C9A00578AEB9BCC03A280A
MD5 SHA1 SHA512 TLSH

Submit Download

42cfda36-239f-4cfe-bb9d-bdcb1864705a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\42cfda36-239f-4cfe-bb9d-bdcb1864705a
Size 235B
SHA256 2a11ab91c1b05c92c1e889759ff8f8c594afa91fbbbad5006bb98ff6483900c3
MD5 d2312bdbfbb4145e5955eede7d97295b
SHA1 b59e03a4f417da26a5e6f345536a25baac1516b1
SHA512 7163e38b7dd7f095cc0dd37d5d4850edbb05483326c4bb935c6b9123c1bc9ce7bfe8c7661d2028af1f64cd2f1987286ae32e0885fc238fc94bbb2b2d9b5c45d3
TLSH
T12AD097C12498A71C48100F07F0A069D630888C3310B498208AA20638AABE9C902A1807
MD5 SHA1 SHA512 TLSH

Submit Download

4672d6cd-c983-4f43-9205-8654f5b68cea

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\4672d6cd-c983-4f43-9205-8654f5b68cea
Size 3KB
SHA256 4be55d9515494f2aa85516047a6009102dc1e6044e8b4e76ce176b09eba8d22f
MD5 003caa754079f56494cb834eeaac7dfc
SHA1 07f166604802af329ee24bc0200e1a9c7dac3a46
SHA512 7e78eee237c9c714b66ff6e710469d4032e2e9c0ccec360c5b6ebff18d476c13d63999d214698f466f9491835e8ad42a3721a666eeca2f3bc7f2bf45b6840122
TLSH
T1C6615531466879738FE8B140A36769558EDE338B5C430BCE12BACD2842E88B4578F25F
MD5 SHA1 SHA512 TLSH

Submit Download

4b6e85d6-ddfa-44bd-a116-ed0c28cd9474

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\4b6e85d6-ddfa-44bd-a116-ed0c28cd9474
Size 896B
SHA256 5db2ce9a3e24dce8f0a6ea8012d1f128c30a2b48525e328212828caf5e125009
MD5 63aee465fcdeab368eb7c27628f43f14
SHA1 b0f60fc86c89d1b886307aede09c7d4857dc8694
SHA512 d0262ddd483a8a6e0bd41890140ddbb4cc6b90926ea8477bbad210a81952a917074e30063de84e1c8c7778676eaba9ad11204b7889da35b211a5ea5284e0ab2d
TLSH
T19911D490973479F2DD28D15BD5D1B74246A43523C0C60A183EE587084EAA16F976A70B
MD5 SHA1 SHA512 TLSH

Submit Download

52c70dc5-99ba-49de-a188-ae4913d241a2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\52c70dc5-99ba-49de-a188-ae4913d241a2
Size 883B
SHA256 8cd423a71ce8968751482deabb4233dbaf1c3c336a783edb7e10697062ab278b
MD5 115012f55e3da092a9afe1524ec45f1c
SHA1 b0850f0b1f1e9e837f0bac2916fc85c5d181b9dd
SHA512 7a40c9510d42de1bd2d07b6f9cccc4ae2d78bea7c6c6a6fbd0ae68653a2094bbb78999b4e9e4ea162e1e31668d1f5656adf9d448a22c3db5d94256d301d5e379
TLSH
T18711DC90E734B9F2CD28D28BC9817B0287E8752380CA45183EF54A080E6E52AD77970B
MD5 SHA1 SHA512 TLSH

Submit Download

80a01782-2ddb-41ff-8ccb-137fd3262a63

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\80a01782-2ddb-41ff-8ccb-137fd3262a63
Size 3KB
SHA256 81f6bcc59e585d0aabfc26bc6dccb4d9662c390b83260bf4bc2568a464bab61a
MD5 38c71ecfaefdd800479c89650ab2ca79
SHA1 47fe4784dc987637766ffc69eb9048e34a8b0c32
SHA512 bafeb1e0915e5fe978eac8ad829776375d8f95ae80c43a338cf62281e5fb707f7fce33e7ebe4e0b04c40d9424a8298849da7bc40ab44f773a6dc293900d3b113
TLSH
T156614531066869739FE8A504A3277E558ADA339B18470BCD25BACD2442E88B4978B25F
MD5 SHA1 SHA512 TLSH

Submit Download

9170205d-f1bd-4f9f-b38a-0afe9f1d27bf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\9170205d-f1bd-4f9f-b38a-0afe9f1d27bf
Size 2KB
SHA256 8b6890e0efb13ec6b38adb79857daa804fec37ed19bd501d2153e1a3ab7b48b8
MD5 af27b674255e4e727294818aca8433ec
SHA1 74022652b6cc469c9e2903baed5bacc8fc189b4e
SHA512 14052ac3269d35d8508a6a3142aa5c6b51e57a4357730e41ce36366ac4298031155b6d7e0c7de23d225aecd929291a70d137762c3742f4e9d8d33756c01ba034
TLSH
T1C341415839789C768C9BE19CD486338D57258A4384C228572D52DE0CCCDA6AE633E93B
MD5 SHA1 SHA512 TLSH

Submit Download

9abd67ec-6eee-42ad-9790-203d24a4ca1e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\9abd67ec-6eee-42ad-9790-203d24a4ca1e
Size 3KB
SHA256 2c286ad8067d32be23ce389dc9b8f14d74405d0313643f361c519d0f9146727e
MD5 e240cc43cbb871d352448d0de7a85913
SHA1 f58eb14fd70d78fd4e61255e79c6c4884d614ec0
SHA512 69e10959de1c8895183ee994a425e2fe6b84ca7363cedb27eec274a416c37a20ec522ea928166e8bed996e1e8e5064bbb82784d45399feb294c0ac019c902216
TLSH
T198617620466879738FE8B100E327B9548EDE338B58431BCD227ACD2842E88B4578B25B
MD5 SHA1 SHA512 TLSH

Submit Download

aefe7a7d-ada1-4402-926b-c784667ee07e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\aefe7a7d-ada1-4402-926b-c784667ee07e
Size 3KB
SHA256 eb17d48b16bfc4334f7267a8b982ac5ea1868d505623684118d93bebc194465d
MD5 5437df60a24df44acc26e5e7636fa15c
SHA1 c1f3c10d2efa58d2d4874acc17128bb89a9f07d6
SHA512 fac1597795d8983172f35abe8ea9d62379b118d3567d603c3d1a8c41caa2878f3282a4458b213eb2fa75193835ce76a239bf5525141504468c551d00788c0595
TLSH
T107614521056879739FE8A044A3777A458FDE338B58530BCE227ACD1842E48B4578B25B
MD5 SHA1 SHA512 TLSH

Submit Download

b956033d-6b97-4ecf-a106-fa85954e9595

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\b956033d-6b97-4ecf-a106-fa85954e9595
Size 3KB
SHA256 7275bad9e0e87603aad768eb7bca5007f19df9a1c7e8e78d0ef2326f1c2a5bea
MD5 a898d322dbd528cb1b7913fe4edc7383
SHA1 bcecfdb70b40662d15664f37c0a9911f1992efbf
SHA512 ec5b65c0dfc5a426a908b0d0967599b0eec7a6cc25b940516197359a6e34eb5ea413cbfda4fcb691e4effbc4161acf398047712c081885eed21f4b9da2c257c2
TLSH
T10C6165314568A5739EE8B104A337B9558EDE338B58430B8E12BACD1442E88B4978F35B
MD5 SHA1 SHA512 TLSH

Submit Download

bfb96e3a-ea1c-4072-a2bb-ce8e1342e159

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\bfb96e3a-ea1c-4072-a2bb-ce8e1342e159
Size 3KB
SHA256 dbe70c7094158a657c09dbc48939ae1822e40d17bb26aec99852c17411ea84b5
MD5 91675ea08c1d8d49a774b99f84dde4da
SHA1 ec03117dfceb6b59718cdd0883ea4f228fb8e764
SHA512 11d4a2168f5f5ec307fac2a047f648a291f9ba97008759e1cfaa4880618e515266ac592ee0ceeaad90ab7f0056f11443db4bff4270365b371c94f2966bcfd159
TLSH
T13F6155210668A973DFE8A540A377B9548EDE338B58431BCD227ACD1442F88B4978F25B
MD5 SHA1 SHA512 TLSH

Submit Download

e2ecee27-17c9-4edb-88b1-8b830c968932

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\e2ecee27-17c9-4edb-88b1-8b830c968932
Size 896B
SHA256 8d9548b8d2758bf4e34696da7f45a17ed6057a55dcaafaa29763951e1209d5ae
MD5 858357371db09859416b186902e39479
SHA1 1278132241b3ee29f2bfe08c10d53e65b3c227f0
SHA512 6542a9a1e6fe781f24ca624780d10d0d4fa6daaa32287b62bbcc339e7f3e52e54ccdb80bbc9d93535484c221f5d8d992d508f5ac7bc94c5179a4a710882ff014
TLSH
T10011D0909734B5F2CD28D1CBCA91774247E87123C0D60A087EB547080EAA56A976A70B
MD5 SHA1 SHA512 TLSH

Submit Download

ff9ff1fa-d030-4b48-9e3c-50a570ec5289

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\ff9ff1fa-d030-4b48-9e3c-50a570ec5289
Size 3KB
SHA256 4444122182631f5b23f35cbc1cb659bec6fdeb5ada3f374bd782c3b43e064510
MD5 1676e54c4eb3162d003bb23b854a978f
SHA1 4a9a634c3ddcdc8cb38ed6d7d1605119d9852285
SHA512 7f8fc750a63afef7188821eeaaded76bd296d2e5f6d0b9c6125752ab70e6911b6760fbba02a7d1ae5bd0a52ebca582a7f111e3df1b8e6a0405353eece83479a0
TLSH
T115618731066879739FE8A500A367B9548EDE338B58430BCD12BACD2442E88B4978F25F
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\prefs-1.js
Size 6KB
SHA256 6a0ac2564d3cd0e01bf511ede55beaec3d997022ec4ebbd8896deab654b74793
MD5 b109383f8da619dc6f71608285780351
SHA1 ee539784747f336119af301c37efb9c58627b3b2
SHA512 f1c2db177607c4995b43fa7373f5b8236b7582649c6db171d6d3da9c2c8899486f15c527d8f083a645d58c809fbe26065a7e0843f1739e00e8ad8babc740ddf3
SSDEEP 96:xHtjUTUubqGqV9fdkM1zSfSSlldv9jrncHJRL9I17Bw88H8L4cnfVSuO:Pj+2RV9fdkMeSS+n5uBw88qS
TLSH
T154E130789548CB7F74B677ACAC6889315AB2013B77BF68C710B94484054CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\prefs.js
Size 6KB
SHA256 8976f353df04c48c6d68045c65397412bfc74fb2006877fda708a7a7a9959065
MD5 161de2cca5370532297abea5dae8dac4
SHA1 8f57c5febb570d66581ae68bfcd6cd5fb00b4f76
SHA512 31b56fd7a1416c72005a2a26ba5a9a8477926d77852da03a6a6eab280ac92f48d904580ab6e2fcbcb3d4eff5811f910965ef0ff15f98f9c883186fb8b0e6e46f
SSDEEP 96:xHtjUTUubqGqV9fdkM1zSaSSlldv9jrncHJRL9I17Bw88H8L4cnfVSuO:Pj+2RV9fdkMzSS+n5uBw88qS
TLSH
T132E120789548CB7F74B677ACAC6889315AB2013B77BF68D710B94484054CF3482FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\prefs.js
Size 6KB
SHA256 f25fdff1140f00b3990f9fc82a9e105e3870d356048a5a2bd3963d0358332029
MD5 e20d070c09cbbf0b28b9143b8c38925b
SHA1 8ed3d1d98edd6744338f95ef8e9961ec6d1db232
SHA512 383e7b9ff5ce43cb832f106880c9a7ec04484c771df550b813417d6c36f52e99ee82186e62cec5043ee614b32741497991e83464f00714a1012805805ee4aefd
SSDEEP 96:xHtjUTUubqGqV9fdKjYnj+1zSuSSlldv9jLncHJRL9I17Bw88H8L4cnfV+O:Pj+2RV9fd7ybSS+n5uBw88qT
TLSH
T1B4E110789548CB7F74B677ACAC6888315AB2013BB7BF68C750B95484050CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 b3b542e2a5d91ca5d99345ddf15e81f1e2d215f05e522e19e93da32837060597
MD5 ee6478cf14032beadbbd90e2567db4f5
SHA1 a9455f147caf6084ef0902aca83af40a99375cf2
SHA512 e77dbe3ba47ff9d7f0b73a341edf0e59b23397ccf324d0f81898a60724508566e31a3bf67209cb323960fc08404390adf48e49d1139f51ec45a0b2cd4d06e077
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 9KB
SHA256 d900171f82ecf7e33b561a975e9c5e2e72d6b7f6a7ab1b38751a054997a25425
MD5 8f54a73474791bdce5fbc915f47889d9
SHA1 229c219df47207a1c8a1c0f4b78a5b278aca431c
SHA512 2178fcc24b6a5f376551a5bb67a16f306fe7bea1f015deef84f31abb3fb432d0a5ac9219955371d27cea0e9932040a380a74f7ca71a96e63be2575f5ff087e88
SSDEEP 192:PZ5fAgUwD9KJ1AeuPOrrqlbm/ZAk3GCo5qfVA+kTyXXm5EaeFAuk62O3fk/Hrws:PZ5fAgUwD9KJ1AeuPOrrqlbm/ZAk3GC0
TLSH
T1CC12B0DA5F02486F3B82DF6B335365905E9B540BC7F890B23BDB5202B0CA965112F5B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_installer.log

Path C:\Windows\SystemTemp\msedge_installer.log
Size 132KB
SHA256 0f98c44a08d867dacbd3aa0183932006153f57e5a00e9dbaa23deb2934405192
MD5 93e3e571c2de68d567227ba81f4a07e4
SHA1 a12c53453b194ee5933f0fd5b9b18307b5787ee4
SHA512 7b555f94ccee61e2719cf74c2c3eb358774edaedc3eaa1ffe6086351fb01159c884d46830880aecba4891832c0b8d424ad75d4107cf71cd0562f3f5e90e6a253
SSDEEP 3072:Yyds1f0Vjc8mSh1v3aK1qyZ0ELXOLuuuuuuuXXXXXXXXXXXXXXXXXX7uuPyOBogm:Yyds5Sh1v3aGZ0EzyOBog6IOrj
TLSH
T102D351D12B0341B3AF4B7EDE361375252DAE1287D5C08EF97B683081B0C6DA6519F1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1364-1784-0x0000000000530000-0x0000000000531000-memory.dmp

Download

memory/1740-489-0x0000022ECE7F0000-0x0000022ECEF9E000-memory.dmp

Download

memory/1812-504-0x0000021504F80000-0x000002150572E000-memory.dmp

Download

memory/2100-490-0x000001AE212F0000-0x000001AE21A9E000-memory.dmp

Download

memory/2524-3030-0x000001C3FFB60000-0x000001C3FFB69000-memory.dmp

Download

memory/2992-838-0x000002688C880000-0x000002688D02E000-memory.dmp

Download

memory/3504-45-0x00000176C4AB0000-0x00000176C4AF6000-memory.dmp

Download

memory/3504-446-0x00000176C3F00000-0x00000176C46AE000-memory.dmp

Download

memory/3504-444-0x00000176A9F90000-0x00000176A9F9C000-memory.dmp

Download

memory/3504-445-0x00000176AB810000-0x00000176AB822000-memory.dmp

Download

memory/3504-38-0x00000176C3ED0000-0x00000176C3EF2000-memory.dmp

Download

memory/3776-2168-0x0000000000F40000-0x0000000000F41000-memory.dmp

Download

memory/3924-6-0x0000000005320000-0x000000000533C000-memory.dmp

Download

memory/3924-5-0x00000000050B0000-0x000000000514C000-memory.dmp

Download

memory/3924-4-0x0000000004DF0000-0x0000000004DFA000-memory.dmp

Download

memory/3924-3-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

Download

memory/3924-2-0x0000000004E40000-0x0000000004ED2000-memory.dmp

Download

memory/3924-1-0x0000000005350000-0x00000000058F6000-memory.dmp

Download

memory/3924-9-0x0000000006F70000-0x00000000070D2000-memory.dmp

Download

memory/3924-7-0x0000000000950000-0x000000000096A000-memory.dmp

Download

memory/3924-8-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

Download

memory/3924-0-0x00000000002B0000-0x000000000044A000-memory.dmp

Download

memory/4016-3928-0x00000000077B0000-0x00000000077C2000-memory.dmp

Download

memory/4016-3925-0x0000000006280000-0x00000000062A5000-memory.dmp

Download

memory/4016-53-0x0000000006500000-0x00000000065B2000-memory.dmp

Download

memory/4016-54-0x0000000006780000-0x0000000006942000-memory.dmp

Download

memory/4016-55-0x0000000006630000-0x00000000066A6000-memory.dmp

Download

memory/4016-56-0x00000000066B0000-0x0000000006700000-memory.dmp

Download

memory/4016-57-0x0000000006E80000-0x00000000073AC000-memory.dmp

Download

memory/4016-58-0x00000000069D0000-0x00000000069EE000-memory.dmp

Download

memory/4016-3927-0x00000000077A0000-0x00000000077A8000-memory.dmp

Download

memory/4016-3929-0x0000000007CF0000-0x0000000007D05000-memory.dmp

Download

memory/4016-3920-0x00000000073B0000-0x0000000007707000-memory.dmp

Download

memory/4016-22-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/4016-406-0x00000000065F0000-0x000000000660F000-memory.dmp

Download

memory/4016-25-0x0000000003040000-0x0000000003050000-memory.dmp

Download

memory/4016-407-0x0000000003040000-0x0000000003050000-memory.dmp

Download

memory/4016-405-0x0000000006280000-0x00000000062A5000-memory.dmp

Download

memory/4168-3221-0x0000021415810000-0x0000021415FBE000-memory.dmp

Download

memory/4328-19-0x0000000005570000-0x0000000005580000-memory.dmp

Download

memory/4328-37-0x0000000006A20000-0x0000000006A6C000-memory.dmp

Download

memory/4328-51-0x00000000063A0000-0x00000000063B1000-memory.dmp

Download

memory/4328-17-0x0000000003070000-0x00000000030A6000-memory.dmp

Download

memory/4328-52-0x0000000006F00000-0x0000000006F25000-memory.dmp

Download

memory/4328-21-0x0000000005BB0000-0x00000000061DA000-memory.dmp

Download

memory/4328-26-0x0000000005B30000-0x0000000005B52000-memory.dmp

Download

memory/4328-18-0x0000000005570000-0x0000000005580000-memory.dmp

Download

memory/4328-27-0x0000000006410000-0x0000000006476000-memory.dmp

Download

memory/4328-50-0x0000000005AA0000-0x0000000005AF1000-memory.dmp

Download

memory/4328-28-0x0000000006480000-0x00000000064E6000-memory.dmp

Download

memory/4328-35-0x00000000064F0000-0x0000000006847000-memory.dmp

Download

memory/4328-36-0x00000000069E0000-0x00000000069FE000-memory.dmp

Download

memory/4328-49-0x0000000005870000-0x000000000595A000-memory.dmp

Download

memory/4328-48-0x0000000003000000-0x0000000003019000-memory.dmp

Download

memory/4480-2420-0x0000021B86720000-0x0000021B86ECE000-memory.dmp

Download

memory/4480-2412-0x00000000002C0000-0x00000000002C1000-memory.dmp

Download

memory/4480-1975-0x00000000002B0000-0x00000000002B1000-memory.dmp

Download

memory/4740-2407-0x0000000000F40000-0x0000000000F41000-memory.dmp

Download

memory/4740-1966-0x0000000000F30000-0x0000000000F31000-memory.dmp

Download

memory/5260-511-0x000001BE88B60000-0x000001BE8930E000-memory.dmp

Download

memory/5504-3098-0x00000132FEDE0000-0x00000132FEDE9000-memory.dmp

Download

memory/5664-3499-0x0000029EB36B0000-0x0000029EB3E5E000-memory.dmp

Download

memory/5752-1522-0x0000020A3E2D0000-0x0000020A3E2D9000-memory.dmp

Download

memory/6020-69-0x000001CF732C0000-0x000001CF7345A000-memory.dmp

Download

memory/6496-2423-0x0000022A4C800000-0x0000022A4C99A000-memory.dmp

Download

memory/7032-3501-0x000001FD596B0000-0x000001FD59E5E000-memory.dmp

Download

memory/7156-3226-0x000002EE36950000-0x000002EE370FE000-memory.dmp

Download