phantom_stealer | 59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4

Analysis

max time kernel
149s
max time network
107s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
08/05/2026, 12:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4.exe
Size 1.5MB
Sample260508-pzenmacx7j
SHA256 59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4
MD5 c5d19dd5fb7f162c206ca78481bd1182
SHA1 5455a36ad582b33e855e5aa7dedca07eca278302
SHA512 53683916e64947ef86b440ea80e2920d393cc042131b3c76dfdb40eee9a524999207642aabfb0e5239a740bc13cc23b55dbeabc748eec1d31576b638f7889dfc
SSDEEP 24576:y8+v9jEXQ5oM+TDhi2s9MrXQVGLO941y2LxLA5UqGJN2J+gvcfkOUVAM:IvuXx51agQb4Y2LZA5U12Jv2P
TLSH
T1A8652214369CDA12E9A517F04AA5E77013B49C89A512C317CEFEBCFB7832B5A290C747
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery phantom_stealer persistence stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.flexi-synergy.com
Port
587
Username
[email protected]
Password
FlexiSynergy@1225

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
mail.flexi-synergy.com
Port
587
Username
[email protected]
Password
FlexiSynergy@1225
Email to
[email protected]

Mutex

06TY9GZ4U8MOV0QJQHR3

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 1 IoCs

resource	yara_rule
behavioral2/memory/3828-16-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\puJtjXYubBZy.lnk	59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	icanhazip.com

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/848-6-0x0000000007FE0000-0x0000000007FF6000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 848 set thread context of 3828	848	59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4.exe	78

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\c36db4bb-ab12-43c8-87b3-4077e0b6d4ce.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\4852_13422718622015535_4852.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\be946d69-70bb-4995-a956-38c82c73a0a2.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3064_13422718622068011_3064.pma	setup.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Checks processor information in registry 2 TTPs 30 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227186217311535"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-330179853-1108322181-418488014-1000\{BB0B964B-2434-405C-A3E2-B5FD8EAF04EB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
848	59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4.exe
848	59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4.exe
5188	powershell.exe
5188	powershell.exe
3828	RegSvcs.exe
3828	RegSvcs.exe
2084	chrome.exe
2084	chrome.exe
3828	RegSvcs.exe
3828	RegSvcs.exe
3828	RegSvcs.exe
3828	RegSvcs.exe
3828	RegSvcs.exe
3828	RegSvcs.exe
3828	RegSvcs.exe
3828	RegSvcs.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
3828	RegSvcs.exe
3828	RegSvcs.exe
3828	RegSvcs.exe
3828	RegSvcs.exe
3828	RegSvcs.exe
3828	RegSvcs.exe
3828	RegSvcs.exe
3828	RegSvcs.exe
3828	RegSvcs.exe
3828	RegSvcs.exe
3828	RegSvcs.exe
3828	RegSvcs.exe
3828	RegSvcs.exe
3828	RegSvcs.exe
3828	RegSvcs.exe
3828	RegSvcs.exe
3828	RegSvcs.exe
3828	RegSvcs.exe
3828	RegSvcs.exe
3828	RegSvcs.exe
3828	RegSvcs.exe
6592	firefox.exe
6592	firefox.exe
6592	firefox.exe
6592	firefox.exe
6592	firefox.exe
6592	firefox.exe
6592	firefox.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	848	59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4.exe
Token: SeDebugPrivilege	3828	RegSvcs.exe
Token: SeDebugPrivilege	5188	powershell.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	6240	chrome.exe
Token: SeCreatePagefilePrivilege	6240	chrome.exe
Token: SeShutdownPrivilege	6240	chrome.exe
Token: SeCreatePagefilePrivilege	6240	chrome.exe
Token: SeShutdownPrivilege	6240	chrome.exe
Token: SeCreatePagefilePrivilege	6240	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
2084	chrome.exe
2084	chrome.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
2816	firefox.exe
5088	msedge.exe
3568	msedge.exe
6592	firefox.exe
6592	firefox.exe
6592	firefox.exe
6592	firefox.exe
6592	firefox.exe
6592	firefox.exe
6592	firefox.exe
6592	firefox.exe
6592	firefox.exe
6592	firefox.exe
6592	firefox.exe
6592	firefox.exe
6592	firefox.exe
6592	firefox.exe
6592	firefox.exe
6592	firefox.exe
6592	firefox.exe
6592	firefox.exe
6592	firefox.exe
6592	firefox.exe
6240	chrome.exe
6240	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2816	firefox.exe
6592	firefox.exe
3828	RegSvcs.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 3828	848	59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4.exe	78
PID 848 wrote to memory of 3828	848	59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4.exe	78
PID 848 wrote to memory of 3828	848	59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4.exe	78
PID 848 wrote to memory of 3828	848	59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4.exe	78
PID 848 wrote to memory of 3828	848	59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4.exe	78
PID 3828 wrote to memory of 2084	3828	RegSvcs.exe	82
PID 2084 wrote to memory of 2396	2084	chrome.exe	83
PID 2084 wrote to memory of 3084	2084	chrome.exe	84
PID 2084 wrote to memory of 3092	2084	chrome.exe	85
PID 2084 wrote to memory of 5144	2084	chrome.exe	86
PID 3828 wrote to memory of 5144	3828	RegSvcs.exe	86
PID 3828 wrote to memory of 2396	3828	RegSvcs.exe	83
PID 3828 wrote to memory of 2396	3828	RegSvcs.exe	83
PID 2084 wrote to memory of 5080	2084	chrome.exe	87
PID 2084 wrote to memory of 5916	2084	chrome.exe	88
PID 2084 wrote to memory of 2648	2084	chrome.exe	89
PID 2084 wrote to memory of 2408	2084	chrome.exe	90
PID 2084 wrote to memory of 5032	2084	chrome.exe	91
PID 2084 wrote to memory of 2744	2084	chrome.exe	92
PID 3828 wrote to memory of 3084	3828	RegSvcs.exe	84
PID 3828 wrote to memory of 3084	3828	RegSvcs.exe	84
PID 3828 wrote to memory of 2084	3828	RegSvcs.exe	82
PID 3828 wrote to memory of 2084	3828	RegSvcs.exe	82
PID 3828 wrote to memory of 3092	3828	RegSvcs.exe	85
PID 3828 wrote to memory of 3092	3828	RegSvcs.exe	85
PID 2084 wrote to memory of 2356	2084	chrome.exe	93
PID 3828 wrote to memory of 2356	3828	RegSvcs.exe	93
PID 3828 wrote to memory of 2356	3828	RegSvcs.exe	93
PID 3828 wrote to memory of 2408	3828	RegSvcs.exe	90
PID 3828 wrote to memory of 2408	3828	RegSvcs.exe	90
PID 3828 wrote to memory of 2744	3828	RegSvcs.exe	92
PID 3828 wrote to memory of 2744	3828	RegSvcs.exe	92
PID 3828 wrote to memory of 5144	3828	RegSvcs.exe	86
PID 3828 wrote to memory of 5144	3828	RegSvcs.exe	86
PID 3828 wrote to memory of 2396	3828	RegSvcs.exe	83
PID 3828 wrote to memory of 2396	3828	RegSvcs.exe	83
PID 3828 wrote to memory of 3084	3828	RegSvcs.exe	84
PID 3828 wrote to memory of 3084	3828	RegSvcs.exe	84
PID 3828 wrote to memory of 2084	3828	RegSvcs.exe	82
PID 3828 wrote to memory of 2084	3828	RegSvcs.exe	82
PID 3828 wrote to memory of 5032	3828	RegSvcs.exe	91
PID 3828 wrote to memory of 5032	3828	RegSvcs.exe	91
PID 3828 wrote to memory of 5916	3828	RegSvcs.exe	88
PID 3828 wrote to memory of 5916	3828	RegSvcs.exe	88
PID 3828 wrote to memory of 3092	3828	RegSvcs.exe	85
PID 3828 wrote to memory of 3092	3828	RegSvcs.exe	85
PID 2084 wrote to memory of 3584	2084	chrome.exe	94
PID 3828 wrote to memory of 2356	3828	RegSvcs.exe	93
PID 3828 wrote to memory of 2356	3828	RegSvcs.exe	93
PID 3828 wrote to memory of 2408	3828	RegSvcs.exe	90
PID 3828 wrote to memory of 2408	3828	RegSvcs.exe	90
PID 3828 wrote to memory of 2744	3828	RegSvcs.exe	92
PID 3828 wrote to memory of 2744	3828	RegSvcs.exe	92
PID 3828 wrote to memory of 5144	3828	RegSvcs.exe	86
PID 3828 wrote to memory of 5144	3828	RegSvcs.exe	86
PID 3828 wrote to memory of 2396	3828	RegSvcs.exe	83
PID 3828 wrote to memory of 2396	3828	RegSvcs.exe	83
PID 3828 wrote to memory of 3084	3828	RegSvcs.exe	84
PID 3828 wrote to memory of 3084	3828	RegSvcs.exe	84
PID 3828 wrote to memory of 2084	3828	RegSvcs.exe	82
PID 3828 wrote to memory of 2084	3828	RegSvcs.exe	82
PID 3828 wrote to memory of 5032	3828	RegSvcs.exe	91
PID 3828 wrote to memory of 5032	3828	RegSvcs.exe	91
PID 3828 wrote to memory of 5916	3828	RegSvcs.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4.exe
"C:\Users\Admin\AppData\Local\Temp\59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:3828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3gsc0e2k.4ns"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\3gsc0e2k.4ns /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\3gsc0e2k.4ns\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\3gsc0e2k.4ns --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffdc52fdcf8,0x7ffdc52fdd04,0x7ffdc52fdd10
      4⤵
      PID:2396
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3gsc0e2k.4ns" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1880,i,12254990024711111470,10378464455701257314,262144 --variations-seed-version --mojo-platform-channel-handle=1876 /prefetch:2
      4⤵
      PID:3084
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3gsc0e2k.4ns" --field-trial-handle=1984,i,12254990024711111470,10378464455701257314,262144 --variations-seed-version --mojo-platform-channel-handle=1992 /prefetch:11
      4⤵
      PID:3092
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3gsc0e2k.4ns" --field-trial-handle=2016,i,12254990024711111470,10378464455701257314,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:13
      4⤵
      PID:5144
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3gsc0e2k.4ns" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2704,i,12254990024711111470,10378464455701257314,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:1
      4⤵
      PID:5080
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3gsc0e2k.4ns" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2712,i,12254990024711111470,10378464455701257314,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:1
      4⤵
      PID:5916
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3gsc0e2k.4ns" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3296,i,12254990024711111470,10378464455701257314,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:1
      4⤵
      PID:2648
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3gsc0e2k.4ns" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3312,i,12254990024711111470,10378464455701257314,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:9
      4⤵
      PID:2408
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3gsc0e2k.4ns" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3352,i,12254990024711111470,10378464455701257314,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:1
      4⤵
      PID:5032
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3gsc0e2k.4ns" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3384,i,12254990024711111470,10378464455701257314,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:9
      4⤵
      PID:2744
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3gsc0e2k.4ns" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4288,i,12254990024711111470,10378464455701257314,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
      4⤵
      PID:2356
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3gsc0e2k.4ns" --field-trial-handle=2164,i,12254990024711111470,10378464455701257314,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:14
      4⤵
      PID:3584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ggwwi5mo.xv2"
    3⤵
    PID:5376
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ggwwi5mo.xv2
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2816
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27097 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 1512 -initialChannelId {1a0b40e4-8bd0-4635-b7bb-aae746222ecd} -parentPid 2816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2816" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:1956
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2120 -prefsLen 27133 -prefMapHandle 2208 -prefMapSize 270279 -ipcHandle 2488 -initialChannelId {5703b24f-50ca-4ea5-9f11-2781ac537d5f} -parentPid 2816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:804
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2e4f6e7f-5f51-41ac-a1c0-8fb1beaa5156.dmp"
        5⤵
        
        PID:5584
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2112 -prefsLen 27133 -prefMapHandle 2840 -prefMapSize 270279 -ipcHandle 2324 -initialChannelId {5844ecc9-46b0-4857-8818-5bcd6c7b9ec1} -parentPid 2816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2816" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:3148
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f561a08c-ee98-4b51-b055-ce7ef88df0dd.dmp"
        5⤵
        
        PID:2208
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27133 -prefMapHandle 3144 -prefMapSize 270279 -ipcHandle 3148 -initialChannelId {15c03d13-44ce-4ff4-8a9a-ecdaf29c2c90} -parentPid 2816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2816" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:5124
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f0dcc2f6-0f7c-45d3-ae9f-150b7663b5d9.dmp"
        5⤵
        
        PID:4948
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3148 -prefsLen 27198 -prefMapHandle 3440 -prefMapSize 270279 -ipcHandle 3400 -initialChannelId {9f04f024-a935-4f44-aa68-0418d7de7ae7} -parentPid 2816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2816" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:3088
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3744 -prefsLen 27274 -prefMapHandle 3748 -prefMapSize 270279 -jsInitHandle 3752 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3760 -initialChannelId {085e2c79-49a7-4fab-9110-49a131088ff1} -parentPid 2816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:5996
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9bed5fa6-3cd3-43db-8d69-c7217367f71a.dmp"
        5⤵
        
        PID:3140
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3388 -prefsLen 27274 -prefMapHandle 3456 -prefMapSize 270279 -ipcHandle 3708 -initialChannelId {b3ad77e2-2224-4ab5-bebf-98989c5366f3} -parentPid 2816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2816" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:5844
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c044f434-bc5b-4d5a-9bef-38b5a769a3f1.dmp"
        5⤵
        
        PID:4584
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4128 -prefsLen 27274 -prefMapHandle 4132 -prefMapSize 270279 -ipcHandle 4164 -initialChannelId {96ec3dd4-6904-4648-bf5a-ddb58733db25} -parentPid 2816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2816" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:6064
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4552 -prefsLen 34773 -prefMapHandle 4556 -prefMapSize 270279 -jsInitHandle 4560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4568 -initialChannelId {8911fc57-fd3c-422a-af19-c88cd766107d} -parentPid 2816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:2568
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4972 -prefsLen 35010 -prefMapHandle 4976 -prefMapSize 270279 -ipcHandle 4732 -initialChannelId {5e62cd6d-9b96-40c6-af78-6a9930adc238} -parentPid 2816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:4400
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4964 -prefsLen 32900 -prefMapHandle 4956 -prefMapSize 270279 -jsInitHandle 4944 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2828 -initialChannelId {0664d5f8-1a70-4576-8913-5bcdb9486ced} -parentPid 2816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:2584
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5216 -prefsLen 32900 -prefMapHandle 5212 -prefMapSize 270279 -jsInitHandle 5148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5364 -initialChannelId {bc762928-db61-4a94-ab13-7fac84b9990f} -parentPid 2816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:2108
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5148 -prefsLen 32900 -prefMapHandle 5212 -prefMapSize 270279 -jsInitHandle 5216 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2816 -initialChannelId {7da2a1a7-5f0f-46d7-9dde-bdea3a1d4e0a} -parentPid 2816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:1104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:5088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffdc347f208,0x7ffdc347f214,0x7ffdc347f220
      4⤵
      PID:2104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2132,i,15386656005463936073,12486206955102578818,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
      4⤵
      PID:5968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e" --always-read-main-dll --field-trial-handle=1712,i,15386656005463936073,12486206955102578818,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:11
      4⤵
      PID:4520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e" --always-read-main-dll --field-trial-handle=2344,i,15386656005463936073,12486206955102578818,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:13
      4⤵
      PID:5272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3064,i,15386656005463936073,12486206955102578818,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:1
      4⤵
      PID:3784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3076,i,15386656005463936073,12486206955102578818,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:1
      4⤵
      PID:3472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e" --always-read-main-dll --field-trial-handle=3440,i,15386656005463936073,12486206955102578818,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:14
      4⤵
      PID:6128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e" --always-read-main-dll --field-trial-handle=3444,i,15386656005463936073,12486206955102578818,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:14
      4⤵
      PID:5436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e" --always-read-main-dll --field-trial-handle=3452,i,15386656005463936073,12486206955102578818,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:14
      4⤵
      PID:1604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3556,i,15386656005463936073,12486206955102578818,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3580,i,15386656005463936073,12486206955102578818,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:9
      4⤵
      PID:3380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3628,i,15386656005463936073,12486206955102578818,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
      4⤵
      PID:1856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3712,i,15386656005463936073,12486206955102578818,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:9
      4⤵
      PID:2832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3732,i,15386656005463936073,12486206955102578818,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
      4⤵
      PID:5656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3760,i,15386656005463936073,12486206955102578818,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:9
      4⤵
      PID:3272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3840,i,15386656005463936073,12486206955102578818,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:1
      4⤵
      PID:3140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3884,i,15386656005463936073,12486206955102578818,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:9
      4⤵
      PID:5124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3928,i,15386656005463936073,12486206955102578818,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:1
      4⤵
      PID:3152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3940,i,15386656005463936073,12486206955102578818,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:9
      4⤵
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e" --always-read-main-dll --field-trial-handle=4468,i,15386656005463936073,12486206955102578818,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:14
      4⤵
      PID:2112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1108
        5⤵
        
        PID:1740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e" --always-read-main-dll --field-trial-handle=4856,i,15386656005463936073,12486206955102578818,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14
      4⤵
      PID:2688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e" --always-read-main-dll --field-trial-handle=5104,i,15386656005463936073,12486206955102578818,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
      4⤵
      PID:5408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=592
        5⤵
        
        PID:6100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e" --always-read-main-dll --field-trial-handle=5188,i,15386656005463936073,12486206955102578818,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
      4⤵
      PID:1824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e" --always-read-main-dll --field-trial-handle=3448,i,15386656005463936073,12486206955102578818,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
      4⤵
      PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e" --always-read-main-dll --field-trial-handle=5184,i,15386656005463936073,12486206955102578818,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
      4⤵
      PID:2992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:3568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffdc347f208,0x7ffdc347f214,0x7ffdc347f220
      4⤵
      PID:2488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2172,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
      4⤵
      PID:1904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --always-read-main-dll --field-trial-handle=1672,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:11
      4⤵
      PID:3808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --always-read-main-dll --field-trial-handle=2272,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:13
      4⤵
      PID:3712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3036,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:1
      4⤵
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2928,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:1
      4⤵
      PID:1560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --always-read-main-dll --field-trial-handle=3444,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14
      4⤵
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --always-read-main-dll --field-trial-handle=3448,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:14
      4⤵
      PID:3760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --always-read-main-dll --field-trial-handle=3456,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
      4⤵
      PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4860,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
      4⤵
      PID:4596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3500,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:9
      4⤵
      PID:4124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3528,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
      4⤵
      PID:4924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3572,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:9
      4⤵
      PID:800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3592,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
      4⤵
      PID:3056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3628,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:9
      4⤵
      PID:880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3644,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
      4⤵
      PID:5812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3672,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:9
      4⤵
      PID:6112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3712,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3736,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:9
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --always-read-main-dll --field-trial-handle=3032,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
      4⤵
      PID:1548
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1140
        5⤵
        
        PID:5404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --always-read-main-dll --field-trial-handle=5256,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
      4⤵
      PID:5240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=596
        5⤵
        
        PID:4232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --always-read-main-dll --field-trial-handle=5288,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
      4⤵
      PID:4428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --always-read-main-dll --field-trial-handle=5356,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
      4⤵
      PID:2404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --always-read-main-dll --field-trial-handle=5524,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
      4⤵
      PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --always-read-main-dll --field-trial-handle=5488,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
      4⤵
      PID:1476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --always-read-main-dll --field-trial-handle=6300,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
      4⤵
      PID:2340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --always-read-main-dll --field-trial-handle=6300,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
      4⤵
      PID:2420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --always-read-main-dll --field-trial-handle=6264,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
      4⤵
      PID:1112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --always-read-main-dll --field-trial-handle=6456,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
      4⤵
      PID:4432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      Drops file in Windows directory
      PID:3064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff7d8406a68,0x7ff7d8406a74,0x7ff7d8406a80
        5⤵
        Drops file in Windows directory
        
        PID:884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        Drops file in Windows directory
        
        PID:4852
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff7d8406a68,0x7ff7d8406a74,0x7ff7d8406a80
        6⤵
        Drops file in Windows directory
        
        PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --always-read-main-dll --field-trial-handle=6428,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
      4⤵
      PID:5040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --always-read-main-dll --field-trial-handle=6540,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
      4⤵
      PID:1112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --always-read-main-dll --field-trial-handle=5040,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
      4⤵
      PID:4232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --always-read-main-dll --field-trial-handle=6632,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
      4⤵
      PID:6068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --always-read-main-dll --field-trial-handle=6680,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
      4⤵
      PID:3716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl" --always-read-main-dll --field-trial-handle=6628,i,16805690250661654296,17598328204457551439,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
      4⤵
      PID:6228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2y5sidh1.gjb"
    3⤵
    PID:6580
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\2y5sidh1.gjb
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:6592
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1932 -prefsLen 27097 -prefMapHandle 1936 -prefMapSize 270331 -ipcHandle 2020 -initialChannelId {734a3947-a697-4abd-9eff-fa79b1669607} -parentPid 6592 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6592" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:6808
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2476 -prefsLen 27133 -prefMapHandle 2480 -prefMapSize 270331 -ipcHandle 2160 -initialChannelId {9afc0a02-3eae-4a4c-9a34-0643179a0d14} -parentPid 6592 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6592" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:6868
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c89852de-28a1-4649-b45f-b6ffc5c59067.dmp"
        5⤵
        
        PID:6900
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2232 -prefsLen 27133 -prefMapHandle 2668 -prefMapSize 270331 -ipcHandle 1308 -initialChannelId {845fd2fb-81ea-415c-bc53-c037993ad890} -parentPid 6592 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6592" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:6960
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a60140fb-8168-48ab-9223-4b03afd53f3e.dmp"
        5⤵
        
        PID:7072
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1308 -prefsLen 27133 -prefMapHandle 3176 -prefMapSize 270331 -ipcHandle 3280 -initialChannelId {249248ae-5946-4fd1-8a95-badff3cf680c} -parentPid 6592 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6592" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:7092
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b1cfff97-3e54-4b92-bc28-41da0c115659.dmp"
        5⤵
        
        PID:5944
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3180 -prefsLen 27247 -prefMapHandle 3444 -prefMapSize 270331 -ipcHandle 3436 -initialChannelId {c6de6cb7-b3c4-43db-bcab-67640564295e} -parentPid 6592 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6592" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:3348
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3364 -prefsLen 27323 -prefMapHandle 3372 -prefMapSize 270331 -jsInitHandle 2760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2848 -initialChannelId {b3cfa6d7-26d3-4ee9-8a21-71c661bf5657} -parentPid 6592 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6592" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:2876
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\7edb782b-b123-4655-899f-b5b74451b8d2.dmp"
        5⤵
        
        PID:2148
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3600 -prefsLen 27323 -prefMapHandle 3960 -prefMapSize 270331 -ipcHandle 3876 -initialChannelId {6e44e47d-8cb6-4e0c-b918-07c741188e3c} -parentPid 6592 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6592" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:6152
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\71eff371-8ebb-410c-93da-ea713556e643.dmp"
        5⤵
        
        PID:6336
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4204 -prefsLen 27323 -prefMapHandle 4208 -prefMapSize 270331 -ipcHandle 3356 -initialChannelId {2564b1c6-182a-4baf-a013-9e0a717438fa} -parentPid 6592 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6592" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:6356
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4516 -prefsLen 34876 -prefMapHandle 4520 -prefMapSize 270331 -jsInitHandle 4524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4532 -initialChannelId {a8fdee22-c833-4f78-b93e-4a4ff0c2a778} -parentPid 6592 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6592" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:5812
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3376 -prefsLen 34876 -prefMapHandle 3304 -prefMapSize 270331 -ipcHandle 4684 -initialChannelId {cb7b4c2a-a3c4-45e0-aa19-b01c30766dd2} -parentPid 6592 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6592" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        
        PID:568
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3044 -prefsLen 32766 -prefMapHandle 5084 -prefMapSize 270331 -jsInitHandle 5088 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5096 -initialChannelId {1352d4f0-a907-4e56-b679-0cf1cab88a96} -parentPid 6592 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6592" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        
        PID:2060
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5324 -prefsLen 32766 -prefMapHandle 5328 -prefMapSize 270331 -jsInitHandle 5332 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5344 -initialChannelId {54bc5b7a-4c85-414c-9907-bbd9d4e1eeec} -parentPid 6592 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6592" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        
        PID:3680
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5352 -prefsLen 32766 -prefMapHandle 5356 -prefMapSize 270331 -jsInitHandle 5360 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5368 -initialChannelId {7935593a-6275-49c0-8ec8-93ae566f27fa} -parentPid 6592 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6592" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        
        PID:412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hwmd4sgr.nmn"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:6240
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\hwmd4sgr.nmn /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\hwmd4sgr.nmn\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\hwmd4sgr.nmn --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffdc34ddcf8,0x7ffdc34ddd04,0x7ffdc34ddd10
      4⤵
      PID:6924
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hwmd4sgr.nmn" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2396,i,18271057925485404463,10003179943874193546,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:2
      4⤵
      PID:7160
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hwmd4sgr.nmn" --field-trial-handle=1744,i,18271057925485404463,10003179943874193546,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:11
      4⤵
      PID:7076
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hwmd4sgr.nmn" --field-trial-handle=2040,i,18271057925485404463,10003179943874193546,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:13
      4⤵
      PID:2588
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hwmd4sgr.nmn" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2876,i,18271057925485404463,10003179943874193546,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:1
      4⤵
      PID:224
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hwmd4sgr.nmn" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2928,i,18271057925485404463,10003179943874193546,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:1
      4⤵
      PID:2960
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hwmd4sgr.nmn" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3476,i,18271057925485404463,10003179943874193546,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
      4⤵
      PID:1588
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hwmd4sgr.nmn" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3512,i,18271057925485404463,10003179943874193546,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:9
      4⤵
      PID:5972
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hwmd4sgr.nmn" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3524,i,18271057925485404463,10003179943874193546,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:2036
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hwmd4sgr.nmn" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3540,i,18271057925485404463,10003179943874193546,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:9
      4⤵
      PID:4192
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hwmd4sgr.nmn" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4332,i,18271057925485404463,10003179943874193546,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
      4⤵
      PID:4576
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hwmd4sgr.nmn" --field-trial-handle=4388,i,18271057925485404463,10003179943874193546,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14
      4⤵
      PID:2056
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hwmd4sgr.nmn" --field-trial-handle=4848,i,18271057925485404463,10003179943874193546,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
      4⤵
      PID:2812
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hwmd4sgr.nmn" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5016,i,18271057925485404463,10003179943874193546,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
      4⤵
      PID:6604
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hwmd4sgr.nmn" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5048,i,18271057925485404463,10003179943874193546,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
      4⤵
      PID:6836
  - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      PID:6528

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1tjvljcf.default-release\activity-stream.contile.json
Size 4KB
SHA256 27b4c67d7db1ac106f9caa7b0331834ed21a48c8219eb989dd80e1dc16ca3462
MD5 f1b9700176ce690f7e955f5e47a49ffd
SHA1 021b945510cb8c1d9f73e3fe2b0296dda16d259c
SHA512 953f013997167d4b82f87d65ec32d0b70c1625aedf13976e5b8c58f9eb845a2f5df0cf43792013c8212ac34555bac05fb60b394259bfa7451d5311a1acf69c0e
SSDEEP 96:KhkoUPtvLNydEdD9/79e8DlTL40jHKY75c5InQKO6D5Al:KhKtvxyGdxflTLHj9cw5Al
TLSH
T128A1D99F8C78E487077223E17C4B279DF20BB10B9AD5C98DAA958C02D5D425F54AE688
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1tjvljcf.default-release\activity-stream.discovery_stream.json
Size 74KB
SHA256 daa8bb13927633d4214b014bf2489c296cc25059746acd2cc61da8beaee5c7d5
MD5 9020c25bdb5db0a6e1f7f99d71042af0
SHA1 b43d11311be38243383814e0ae79eeb21e910517
SHA512 672ce0476ae5c8ab0726707239309e66699117af3fb01c978fcdb9ae925cb40e4c399270cdc574ac83b98af7059f2eb177520d41d5b7b6e056a075bd72021d35
SSDEEP 768:1yRZqqSu5j3OkiO4Ug7Wv/IizCreSBTqV6GtvlqxHBgT/CJSiuuhNRa:0Cxu5j+kB+reYQ2g7CJSiuuhNw
TLSH
T1987309A357E8B1FB1FA077C73C0B795766E24189E38906C9FCECC90C819D694423A5AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1tjvljcf.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 dc72d070221805cba964e89f6250b80c67413db707814110e6f23936c0417fd6
MD5 ad9fe49e9d07ecc04430dd81262823c2
SHA1 29bc79a55e195a8b705e5f78932b5d0acfcd6067
SHA512 1c95070e72cd9d0c810baf814d76242e2a792b61e6a15794da1519697c5b9f262312f1718a2d7cc71fd5c0629f6233b04cf014ffca85cc04be805c4b6edab155
SSDEEP 384:HHMO0iO024YtFuhw+5EL1pPsac4j0lpDII+C9w19wm:nrZYtFuK+5EB9sac4ID8Lv
TLSH
T174528D7EAF0138BA1A27D1C4D8EA5218CF08E6BBEFD2D06605443C44C684778B8F64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl\Crashpad\settings.dat
Size 280B
SHA256 da570323480401539358afa79b37009fa6089a6bd28f28396d54d0cadedc89c2
MD5 7db2d8317d7b004ce0dc5f62dbaff460
SHA1 c4761993b27de056694cbcdf30df6c5d8fd59851
SHA512 794a72190d56b697562a6513de3e40d6e32374d31312281af945447399a8fd25f6eb9edf54024ed2c815fb592490065183f200f6cc1b44ee3a74ab4b3ccbaa30
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl\Crashpad\settings.dat
Size 280B
SHA256 dd0573e1c5948045ebfecdb6cbc47cb934505ccbceedc6dfa2518c8e5880297b
MD5 5b910d09a853ac76ca25d4deb1f5db1b
SHA1 e7778f74da40c76d0d84d8889634b211b8749372
SHA512 81336e25ba85db2892ee8b15fb68f01e5816bc8e81bc2880c13ff8df787e33bc860103065e14c53c6b3c1de3968baa970765ebc36d3784763ad7dfed55eb2019
TLSH
T1EAD02222B38B0CB8EC0328320C3B0F880002CA20C20B20C0EC3F03A80C0BA2A08E38C8
MD5 SHA1 SHA512 TLSH

Submit Download

1a18dff9-81cd-4e32-8884-eb5a41411949.tmp

Path C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl\Default\1a18dff9-81cd-4e32-8884-eb5a41411949.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl\Default\Cache\Cache_Data\f_000001
Size 34KB
SHA256 afd4782e0b7442187ef3334e0dd04804eec2f7e78b66f2486e9aad0e2c0f415d
MD5 86838477fc764344efbfb59db3377e02
SHA1 975ba960ae9f272dcbbffa0bb4846ae66a217bca
SHA512 c070be0783368b0cfc2c82c404a77b3d3a54d4fa7276947675c29af0c0f1596c0820ab6b7f55ffef78204b6270599e52685c465a5e5a14719affedfcc6e5171c
SSDEEP 768:UyU08MPVeXS+IFU8EHGmvKhcxSDctxyvsi0PD:IsdeCV5mG3hcwwLyX0b
TLSH
T1AFF2E1309D56284B8376EC684F46B9E2D4953252873AB157063E974835F13ECB3899CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl\Default\Cache\Cache_Data\f_000002
Size 97KB
SHA256 08c1ade001a530f1e243f27f19e1b070ac4b43ed38dd3bb1d7c40715dc4c87f2
MD5 171a26291b479857a5abeaece2104b09
SHA1 82a1796ad885412da94a5f0f15e91f3e07ca888d
SHA512 9ca77cc7db39ee4dffae42300e1494f9f8fbd6233d7740e9e9d5679b7d8979a58bc8ea510262719af0b4941a62584cafc404f0e8a875fa90baa0a9c1a5af93ac
SSDEEP 1536:wq/tCttbQz328dc9mqGiTLFu5ptbSOcOL1Rnz/Cl0jMHweWcPJsD/gPG2wMpatK:wq/tCjbrYUmqGiTLc3BBHMHweEkw4atK
TLSH
T10CA31289F732DB1F9313943896AC73046FC80367244986FE104FB9D32EDA55B2276D6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl\Default\Cache\Cache_Data\f_000003
Size 66KB
SHA256 3f5d46711fc4ea973b0341fa657e87f1a3893d892977119284ab1450961de8d3
MD5 9d52c3b03e224bb14709737e1cd5061e
SHA1 90e946e11dad09ea0f1936dc158e7dd91d111f53
SHA512 7aef7bdb1cf366fa357920b406fcae175bff2f8b023bf547bc48143f825376b19930515e7c7567c85b7e68fcd29e0cd120fa3c6110d5252699b0e954539e0965
SSDEEP 1536:VhVSVO6QhTyX2jEFts1fxkC+sNi4TkMU6gm9ymK5Mz4fK:VnSVuC2St68J4amcmKiF
TLSH
T10263123E9B2A87C12CBF1DD4851F17090E75486B062FC8DD4745143CAAEAAD44B2FD6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl\Default\Cache\Cache_Data\f_000005
Size 401KB
SHA256 be3d8d00bb4a70c233c41d77ef19ec94388010ed01b3c05cff8427b501759c9d
MD5 1eb01c3c50d6d0d1508b5d4bbf2f89e1
SHA1 8587d9fa42eecf82477f67a5cab473e190a8e76a
SHA512 3f27d01e3a4897343ae63b499821376bf48795ed4ea5d3487a618845e218c483d9c201d60b7fe2485e7ac3246361752e0e795efee663417c20963adc2ef322ee
SSDEEP 12288:BvV0o7xTYGHvlvtDb0jSbuqd9B76Z0xoJ+F:Bt06xEGHvRtDbVfdDF
TLSH
T1229423F0D7BF1804DE0C21136E0A18E6507934E26B7F72C67A75CA7925A6E7103EFA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl\Default\Cache\Cache_Data\f_00000a
Size 78KB
SHA256 9b8c9105b814adfbdede8637069b1ba79a00ddc11d1e675fbf0b472fb6b20490
MD5 28039095487c6b897b6b9d1376f501cc
SHA1 77b640b656b6acfb7ddaa08eee7710e6a114f92c
SHA512 90e9d260b9a535d539a82771867dc19c37bd204aaeb1d96cfeae428816c5dccc8537101e4a54eb3b6566cb713ac7e2fb190f84d6531f0efb3b2e4a120e35cb7d
SSDEEP 1536:NF89d5MMhmPl/IglPCCcvNpQ1OIHqlpRWXx6bF8yrumPlMEj9Mr:ARtAPl/LPvcvNpgqy6yjmNMEj9W
TLSH
T1027302E425C9C72BAE4155162E7A9233E7B05FDFE5FAC082E61BC5808C98D335712C67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl\Default\Cache\Cache_Data\f_00000b
Size 27KB
SHA256 d2fc1c6ebd88fb175be2c5dc3c27741e32df41e8c05e92184b3cb9ace6753782
MD5 ea242e020e5e5815ec0941667295bd2a
SHA1 78ec8f478a64a4c373db8295d378efa0d6a79684
SHA512 df022556ed72994d5d6ebd480c826ef722812e0b4e00764f74833a24aa6fa8ff1ca4c776fed06ec6823942082926e1a2afd9016589c82298c811031f345989ac
SSDEEP 768:XWm0HR/ESa4tuUsaCGIbZhLLsaETud7yj:GlH04Ypd9xLsLTfj
TLSH
T1F4D2F28F866AC96775CF29143B5D8BD71859F35094483A832F0369D86F9CB3B173B884
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl\Default\Cache\Cache_Data\f_00000c
Size 19KB
SHA256 04de4b822cda39d55bd6ebde97c09a578a4f63242e7cf804977da383fab17618
MD5 646c73cd9bdc03d8c616bfbf868d9672
SHA1 4d93fdb8c3740ac0f32ad437fa68ae1464e7dfb2
SHA512 b7a4460dc6e75d30d559646cb85b56b210fa5326ee948057e4c819432d5bb35634a7ccd9ab334e180a4ed6b00be6b76ba4804e178053b763224a87b1b71108ba
SSDEEP 384:B3N5kjhDv5mbCOcR61oWpQt3QIIuhzTEEr6XDrPFeuCsOVeQF1sKkiXA:Bd5kBhO461oWpQtAGhzQv0u5ZQFGK2
TLSH
T14C92E0AE6C191707B47AFC8498B671E5C4C71DAEA0E22537179BCF774CE0079882293B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl\Default\Cache\Cache_Data\f_00000e
Size 55KB
SHA256 d8204a264efd7b1935aabbc7c85fc471bb88bbc9016808a165f8e063a2f5cdba
MD5 fe4db5c31e53c3e67838fd54a7b1dcd6
SHA1 390118a32d1739456db6f38fad9194ff8f808ff6
SHA512 f42bb0df63bf8438d121231ab46e5752de5c620d43689097edbb1ee6b212f290d5da34fed07d44b70cbbef7c206b58505355b8b200b6fa10a0a9d6797cdac448
SSDEEP 1536:chq9KMvJGt0Ze36MbYuE4xkG6OFQWQ+4Orj0xfEfdD:L9KkJ3nMo4t4WQ1Ff8dD
TLSH
T17B43F1C32F6D1474EF9BD17521A5CFA547AC247F843DD2B0121BED1F628658DCA8105A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl\Default\Cache\Cache_Data\f_00000f
Size 59KB
SHA256 c722c19fc53a8cf11507511be0a0f425d256d0edfaa0c43b9177dbd9d4a538fd
MD5 1fc9d12e079e8053730adb8c5d9769f5
SHA1 6db462ca8de6ccd660bf01e497b886ddbb0ce571
SHA512 96e68c0e4eff5f88287c32c4d29381145245b101af8eec994eebcec35bd39899705f6f74e40f424335160bd5f26e79bcc4772c3320d274ad0ce4c81487866c56
SSDEEP 1536:crMbi15cl7L9+vf6tE68YdwfitnJh/C9UuOqTRt+pyS/+st:crv124f6tEHwFrK+uOqP+p1/+Q
TLSH
T1CF53F12E9CFFA07F2AB0D9EEEB7910F5DE9601BA65009FCC797524431BD61718923908
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl\Default\Cache\Cache_Data\f_000011
Size 72KB
SHA256 193dc0e32aaeaed8373689a34903a7a869eeec406306b0e054513bbc229ae432
MD5 b3dbf823c6d17d8fe09de16dbe159b7f
SHA1 fe4a900e50856987bd05768499405cfb70e60575
SHA512 9b44b951d0b75af0d8d99b8c8071b805b881014baa7dfb5eb00240f933136ae68431ed67a2ea3556e027f947f82110d4a6b8289ae0b8d5b3829495d03b97cd09
SSDEEP 1536:EvoCSHkUIk+TW7n37v90+O2xgmRbfcX7gaXQ8zEl5f3CZ0L:IokRdC7nzfO2xXRIX7gag8zEl5fs0
TLSH
T105730241779E5F51BD730D41B3229C6B0EC012ECE7D2D6B8608641AF7C981BBBA8921C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl\Default\Cache\Cache_Data\f_000018
Size 20KB
SHA256 a42933786606cac26af6c791e32ca8c09296b4a6598c9d7d623c5c2ac4d245e0
MD5 4287d1eb50c912e6631e1c83de3dd1ea
SHA1 3f86dc700531c875fc4178501a28387dac472d22
SHA512 282358001312aad3284015b3aa723a7f46401e3a4f2de244ca7f25c034288f0104f7b0fe24b2beb12344b6c6abc5d68f96e4a5e7eccc7da6bc66f19871b6ede3
SSDEEP 384:pdl68ms5fgUdFwTwaL7rG1AFdOFXY/Pc/BqNyl6iOF:p36hs1gUdQbL7TdOFXgPcANPiOF
TLSH
T18D92E0081FCB005BA34F3EFDE91DE9288B1209A2193DAFD3935DA589B812476636355B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002f

Path C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl\Default\Cache\Cache_Data\f_00002f
Size 16KB
SHA256 843b3f1b0a72146f062df1e089b868bb7c96c0713c022eb1dc44270dc81a833b
MD5 b8968455b2d831a310ad58ec94c33891
SHA1 c6bdfbd402f5f4657c31fdbd0546cd5c7bdd2fa1
SHA512 ae96aa8f29fd26687cea3fcc5702e6a1262fcb82edc1bb562bfb724be34fda8c50ba786e7955757253e2745a86324258a0a078d04893d6a195b5bd2724073893
SSDEEP 384:2aZnY9eHIJJnk6uYMUsbUVnCbmwQNQf2BkV+yozA8XtdGiqbQE:2aR/IHKtYVnCCrM2BI9GA8Xiiq0E
TLSH
T11172D04BD93F447A04D47423ACB2C725FFAE6E4A2D49ADD0BEC1AA18C1FB1E02144591
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000032

Path C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl\Default\Cache\Cache_Data\f_000032
Size 36KB
SHA256 505fcfe97a69fe8c3e8fc858655160738a27738bdd0f551dd59959b119643bde
MD5 dca7b964f5badcd6f6fa7e90d5bc7597
SHA1 05374bf4bd43825203b17f40ed345a5faf99e32d
SHA512 303996534cd3ac11a35ea25e4306dab13fe17cf1c27f4daae90078b983e7c447524814eb56082fd55c123a65f49c9824f145d76fc0a7a67d2b74bd91be301d18
SSDEEP 768:PJOwLgWLIj5HiHzghjBtMwN3wc5U7BBORbAI70RKq1Q:PJdgxj57hAw6PORbAIg8q1Q
TLSH
T1CEF2F20440225A366B6ED1EE58E1E36A21624BE7F5EE0D3D28978F5B373BD4D21E8D01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003a

Path C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl\Default\Cache\Cache_Data\f_00003a
Size 16KB
SHA256 4dd852db06ff143f9d38126264c1ea54cd41d9cd9ed8181dff01d2d490c23848
MD5 21fc722a9fea6a4d3b414d22adc45a95
SHA1 4f332f3b14e5e256050a235e6be576ab7b5b37ce
SHA512 7b42d3557249c743ac97f477a2b4f17fd9c77dac7de3384c67c2a907d0b18f1c975aaab7f1d3ea6221ab6b7d8f8040a83eba041e6eae16114c817ed3b31412d5
SSDEEP 384:20hm3JWH+xKG7WptbJB8IIBlHsmTWqNfOeoC3SHRIPlUvG:2u9+oUWpfSnTs05fOISy
TLSH
T1BB72DFCF9D77947AAA2674FA43594302CC65293C49E944FFB9D0AC4E81B15E21F24C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003b

Path C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl\Default\Cache\Cache_Data\f_00003b
Size 41KB
SHA256 f619896bc4ee1f36eb151c99c1907272e9ca45de718fd2f385dfd4ea54d25f75
MD5 c0c227e5ed3d63bc2c6020e10650e3ab
SHA1 1300445e56ba5f6ffaf4b3a4492d7ce1b87982d5
SHA512 ce97fe1127ae08630bf728edc56d8a7de6da8c9df71eb0a03519414b226d6c8893b07305600df51f2d33210c3635e6dcea082867fbb2d5e02cccac3942c70b9d
SSDEEP 768:S29IndCGXtrNKt4CLTp5P+hImCgZ3e7AYSvP2+r07+7XWGtn4jE6E35MPfLgW1rt:0n9rmvp5P+EAeRSX3R7BozzPfUWv
TLSH
T1E61302589346423460241CFA5A4C635FBAC85C0DEBE8691D30516B7C5D7F5123D7B91D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003e

Path C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl\Default\Cache\Cache_Data\f_00003e
Size 18KB
SHA256 5bc38250bb1079027be3fa9bf358e86ffb5b936f92d0754ac58affe616be2c99
MD5 8a9abfe39eb77358098b76a549a2132f
SHA1 a9f87580bd2ec8e67ab52538183d925169cb1d45
SHA512 72a65d1d870fd7fb3625d6c9f2c1f03b295715703bb2431406dbcdf1e64dd46fbd4f21f44c7a58bc58a43b2f78f823865a869d34a066c1b5632967d96f7a3349
SSDEEP 384:RWpeGDY4jZFnrJBQEE5gmj8qP1uUIaeFF94ldzDN:IXDYuZlr/QN5wq9peFFO3vN
TLSH
T1E982E0722C3AB3DA07BC9FBC682C6803DF9084396F613E9031D6AD46051478266DDBF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExtensionActivityComp

Path C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl\Default\ExtensionActivityComp
Size 4KB
SHA256 8c471cab38a1696289186d01b06ff6af2a888852dc18d6fb8d2a0e54898104ed
MD5 d25d5e1dc1d93430e64ee17e48ce442e
SHA1 d5c7ca9a57e6cc68927a249fe8e601d52680ac7a
SHA512 f4cff7510b4ad81090e0b1842652f8eb7995f7aefd0ce651151bc24ca3a4305d34ecae41cf193d9b846e8f6359ccf545e5d05e63e6e766fa9761ccebce620f6c
TLSH
T154819284F7C02420DA306EF7A5024BB85E62CA82A5124F93487002D0FCA78ECDC75AAA
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 192B
SHA256 40c8592ea210d622d12661591df36702e682cac8908884168005f672644c8f22
MD5 42c8d78474cfd51c7e00ff2395c64922
SHA1 628b4f99d141eaccc85949f7e23aa04f09d55a8f
SHA512 39d7fd18cda999ad3c99566ce7cc1de1a33b57cab223016afa64f5c113f68b27566235755e1be078c47cf14da1f55e85fc7b541c549b1409bfb4f1ebc1759d71
TLSH
T1F1C022FB24080D30FF0083D21053496D92562D88C74DADC0521FF3C37034220B82B484
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 257B
SHA256 6255b2dc5e9bc8a47a9a40aece3230acfba4f2085adcde051d1ca3b622310f69
MD5 6d9951cd7b25d8886761e402a480176d
SHA1 9e305355af8731cea81e9dd14311aef1602b4091
SHA512 749cd9693119248ca3884f8fbd76ff3d0e6f35554b08443a832bb5ffa3adc7ab15bebd004fafa37efc7763565d45688556e3e022bcf9ca425f6c85bf113871d0
TLSH
T163D02BFB2A052D30EF0007E6502384195153294AC389ADC4901EF3C3E03C610BC1F9D8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe583989.TMP

Path C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe583989.TMP
Size 119B
SHA256 fc9b8dcc52249486eb79103fb907f28be9c35f84adcfa52ad4fc86602968424c
MD5 0271fa692052226487d7c72850482874
SHA1 627440c3fa7dd03128f308d6c5fff9d4c994885c
SHA512 564a29f2032409ba9b9fe725e8f259bc4c127ebde696acf3bc28c5b2adafce67301751308a711d731a10c6092ffe0fd1d66849938aff6829d046725cf2d7afd5
TLSH
T1DDB092BB64081D30EF8223D6A013999891262CC98A89EC80411FB6C37074626B62A854
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl\Local State
Size 3KB
SHA256 c92f442462d5795fd150cf562b04dfcf277420dd63980a4f32ab07bf1a6835b7
MD5 e6d78e718356bae58cb665205e9ea652
SHA1 be3844964f655a4a10e99db57eeda9e813c7e60f
SHA512 9340994015468e4a66ee7856ba8abd83c8b2e340a258679dcc12016453feeeff48aaff7f35c3c9a5c89024a2d4587b44f390da9fc02ed31aa89da8e5fae2ca49
TLSH
T1C371973398689EA355E15684B28637035D74E257EB997F84E1DC371C02EF66C831EC2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl\Local State
Size 4KB
SHA256 5d18513ed549acd9a16ea898a23420c1050ab2eda85fca297c33df14fd2ff048
MD5 b5cdd0f0f4d81ca3e929a03fa9019506
SHA1 03424d9c5214fc6f8e3b020dad4d10bc988feac9
SHA512 3742c58abcb36ecaf363e3503f21d52ba0e9bbec16822ecf9eed6521b8a353639c20397ccf9a9f41a1d8f0bbf89d77cace41fbffbbd5e0ee076b809b2c0f8291
SSDEEP 96:MqGNkCufV3L08Fh58Frh/cInURoDotovbADcBdxvQaGQZJ2P0gJSDS4SYSuSDSDR:XGNbGL8ooDUwSwhGQf2Md
TLSH
T1E8A198335878DD6759E15A44B5C627076EA4D127E7997F88D1DC2B0C02EF3A8434AC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe582c89.TMP

Path C:\Users\Admin\AppData\Local\Temp\3ewedxe5.4sl\Local State~RFe582c89.TMP
Size 1KB
SHA256 837a8ef742f097c864499be0eb9e6a6bba95fc1d17eb7c856cafa390644739b7
MD5 b0e4556ac98511b639decebbc6d7a4cc
SHA1 13d227bac9eb77935b0258f6f472dcfab13ee239
SHA512 21bea2d6018888913e1f6069dcf94ca0a3df41f46e19e5e63a621154b3124f7c46cfcbf0f6a205649f0fab92c31261a6fa681416f64ea342b882951bd22ea5b6
TLSH
T19231757284781EF7B9A24A09B29B66472D70507A92A2AE48A1DE070806D77CC161E83B
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\3gsc0e2k.4ns\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\3gsc0e2k.4ns\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\3gsc0e2k.4ns\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\3gsc0e2k.4ns\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\3gsc0e2k.4ns\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\3gsc0e2k.4ns\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\3gsc0e2k.4ns\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

53b30f25-3c51-453f-abc5-abe816468d7b.tmp

Path C:\Users\Admin\AppData\Local\Temp\53b30f25-3c51-453f-abc5-abe816468d7b.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_vq0fvw0u.vyf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vq0fvw0u.vyf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

a77259dc-8660-449a-8f67-abe0e3ea6192.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3568_2016293104\a77259dc-8660-449a-8f67-abe0e3ea6192.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e\Crashpad\settings.dat
Size 280B
SHA256 033027cf1504bbe4dda949fc2972f5dfc283ec92022c764c0493011f4cd79253
MD5 fd8e0f07290ea3412145a5ac63b43206
SHA1 11c25558eca3bfbd9bacd5aba215f70f162de109
SHA512 aedb89bd1e8ff42a7cbe1ed55387b90e0095e67d4ddce5dd2be5399a7bcd8ceeb504a6ac855367dd4a184e1a7b06cd6e80a1d72d18792a6b903c5a21dd044262
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e\Crashpad\settings.dat
Size 280B
SHA256 e4103bdbb2b6ee0147f45c10f7ac2406d52414e85f5351eb7c09437b22382b39
MD5 67200940a41605c763d248f2e23a73a8
SHA1 579e93e15f57f30f781dd8f8de8b64a6d2dcb4c8
SHA512 f5d1821a17cf78ed97b4c3e33c8dbcd2e403bce36f91228f039f01622fec23531a32174b227024d77c5610c71a7e1909bebd2463a5e0764efbc63179dedcf534
TLSH
T1A0D0025ABB3DA010CDDF21FA327C4AD8BB51CA371A3655B719E284641CB544840F2EB4
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 192B
SHA256 a09762469ffb72baccba229ebe4767d4800ecc4ffc47359fa9e21e05f582c4fb
MD5 61cb7f693f4d7f8b9cdba22aef56378c
SHA1 051c70d8870cb2d55af2fc2365e41f1dc962601d
SHA512 02bbfdd23fc831c3e5495c3dc981ff1e44edcba5efd4ce27d00727bfc64a01ebdd562f07f7b1a4fe3396b5f9e3de1c5094066ce239a78beaf544c87ba18af6da
TLSH
T12DC012FF15265D306D9507C251226E5892050CD1C7A9FD80516EF7D6B430262BD1BC04
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 257B
SHA256 880269414203d3a49c6008ab98a03ae292ae3202ffc5fe2ccb60591a7328ca25
MD5 940998f3aa06db9a5c9c573918265e80
SHA1 081fcfe9e39fd847b09b4bef949ee27e2fe0c622
SHA512 a5d1e25cb5bd483ee1647373d740835af2e6979c6e8eaaad64e50e92cafbbc0c413cfd2ce6b020e3ca20ccd8286f7a72bee6d5931da6c4d1061fa626aef3f42a
TLSH
T1A7D097FF0A371C30AC5003C622222F9892120CC4CAA8FE84409DF3C2E870296FC4BE1C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe582064.TMP

Path C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe582064.TMP
Size 119B
SHA256 8d66a6d69ca733743d50ceb55e9e03195f62fcf2c6b0bb1151f452ac6852c655
MD5 df45f6f5136a1e8269d1f05a84789eb9
SHA1 2180ac4d8b3256b259377b5ac66ee1261a651316
SHA512 aa40b2e2a481b2ab8f5f423c3a02e98164945f81cc5e8096246b6c4f909f88332e576989fbad23d760b634b2c06ef5223e3628c9fa17274de3f62a4c90edc562
TLSH
T12DB092FF04191D24AA8102C66122AEA8A1160CD48AA8FC80802EB6D37030222BA16C10
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e\Local State
Size 3KB
SHA256 a871f72133173d42a7063f0474d4681ca77b0dc798e500ba2f1e906b6d7418e9
MD5 0d4a7b3080d89a7186ec057770c7fc97
SHA1 167ce7c5f51c08a14be368f6312a1bf286f41c45
SHA512 e70d75132b9a23141d1b86704b81780ee6b7134d6af5d10d6fe8e02583563b4af1f057dffb545cc1ebbbe8b6136975d427741e563d47c12abcfbb7a1749c5d53
TLSH
T14871B6335868ACB35DE20AC4B58926135E75E22397696F94A1DD3B1C01FF63C8317C6E
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e\Local State
Size 4KB
SHA256 76f3ed9c897e3ccd1f38748624d414506b48ab2e21c2e99b0bbfecb266044612
MD5 7e85fa5c304a8adddc547edec727cea2
SHA1 e7319370bb2b9fa4af91eecbfc1f2b99164444bb
SHA512 89d31c9af50688f952450cd5e1ab3523f366dc88d84a06f0f966948fa1a3ab8ba7529783345b9462b9398ed51d182fe896cef6057f43d2d4db1ab8ef85f508f2
SSDEEP 96:IqGNkCufV3UQl58Frh/cInURoDotovBjrDDBOCevvISbJ2PuJSDS4SYSuSDSDSEo:TGNbGgooDUwdfdvS92w
TLSH
T12DA1A5335478AC675DF25A84B58526036EB4E223E7987FD8D1DC3F1C02EF2684356C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe581354.TMP

Path C:\Users\Admin\AppData\Local\Temp\w4eu3fbu.k3e\Local State~RFe581354.TMP
Size 1KB
SHA256 b73dd1e12c41fb6d2ebe734bdf69fd7061d5c19153a0f83dc472d76f0f8ff075
MD5 27f1b5dc19cbc2c7d6420f01f9924e76
SHA1 837bef5139e85d839c9e01def4ea32dabe693633
SHA512 a5c24632e12f99d03c422150ca5bf35d6f279821b04b57a112e3221e4127159a2b5b730fa621bf2f75fcca18655151a5d47d791e5ddbaafc225755d9c7a62862
TLSH
T1FD319772946C2DB77CB20A99F34E66436E70A27142655E8851CE2F1902F725C0627C3F
MD5 SHA1 SHA512 TLSH

Submit Download

V0VAYTP4JUJXRC784GZC.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\V0VAYTP4JUJXRC784GZC.temp
Size 4KB
SHA256 9b763d2919561b8276bd6d40b6f31d126d989e29a61f543840d42175f0fb2673
MD5 abaac96a6df135329acb3343d6a9ec3a
SHA1 1ab73c1247551445a0cca7c713cfd0f2b5c28278
SHA512 b60d51e30143fba6ac17c6324c69d6fb51c1aef8bc3dc768b23d49e3a86c9f071c2f3f1a5a7094266843f21136555648c56f49afb69fb29054252b360e1fcc21
SSDEEP 48:MdCjzdOhr7YFO7J9zUoYQdLXuHZprdjjzdOhr7YFO7J9zvYFgdLXuHw2g:M119JUoVu5ls19JvqIuY
TLSH
T1C881EE8157DA1697F3F7AAB26537F7009B76B9098A09860D008142490C72B15CB6EFE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 a49902a0c2131dd36659485285840d2ba5cf4a0a1216bda8a1b4d51d863020b3
MD5 63326300c77930e341963fa5424b13da
SHA1 db1702ba1318afc72761c0ff6479410a56f8ae7d
SHA512 4fd7addb2b009d41c601e8c8714449918b9e976d06f10c480549c2f3a7dc5408a1242437ec3f6c9f3728f155958b88b031d19bef58b42b09afbe80d4524bdd77
SSDEEP 48:4jzdOhr7YFO7J9zUoY6bwdLXuHZpojzdOhr7YFO7J9zvY6blgdLXuHw2g:t19JUoAu5f19JvdIuY
TLSH
T18681DF9157D91697F3F7A6B36577F7009B77B90A8B098A0D009042490C72B158B6DFF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

puJtjXYubBZy.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\puJtjXYubBZy.lnk
Size 1KB
SHA256 582eed27505c16f539872ac87dea4da8d3482e0d93c5e526938c95ca2762c664
MD5 14ad24fa0dc6b3fcb70caec0444efa2d
SHA1 e3bcb3d52769db46ba01d687edacf887fa56c62b
SHA512 e69c5f34bb8bc12ecd998e6a7ab02f4aeccb2468d4b79d8394b15879a2704f5c8fe664151f9b038575d266f29327374b11263361e5957fee463762cfd576adf9
TLSH
T10831FB0107F21708E3F38B39B8BA73204A76BC55EF564F8E014085A98C25226ED74F2F
MD5 SHA1 SHA512 TLSH

Submit Download

2e4f6e7f-5f51-41ac-a1c0-8fb1beaa5156.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2e4f6e7f-5f51-41ac-a1c0-8fb1beaa5156.dmp
Size 64KB
SHA256 c1cfbf6d16946657ccd5bb7d428485a122bed806d0e3a7376d90fa6a69e37ed8
MD5 324e135cbdf7841973758cea8b663a8b
SHA1 76aa51076f1269876f329c036b17e18b53e09505
SHA512 4fcd2fc22bcbf3289814e7e46bad1685649c372586c1b26abe8565b07591651c2566ee8128af58e6133c8b6b3404cbc87061f0518aa4c69723381954d3328666
SSDEEP 768:5SPWJgR0TrJgz6Ptp46/zBbOnr8Svdot:geJgR0TrJgzOtq6bBb6r8SvdM
TLSH
T15A53C9A2B7A29422F02547359DEBA71277FBFC100B57835F0308896E9CB7345ADB1E25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2e4f6e7f-5f51-41ac-a1c0-8fb1beaa5156.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2e4f6e7f-5f51-41ac-a1c0-8fb1beaa5156.extra
Size 1KB
SHA256 a1202998f24315fcce75eb8dc5805fe914b97dcf21f5ac7720d82d49c879d765
MD5 d9988057c0e4cf2fc0b062d238fcbaf4
SHA1 28ffff22c2f5262bcad0ca5d9e91617062c878be
SHA512 56e613e5437984b5baea40fa400661fde54b2aa46c4e26a42f53fdb66ffd0262df5e7129d7d616f042a81b4479139f686acbf9afaf14bf22957637bfde538caf
TLSH
T1333174B7C1EC2E6299574A58B73F13038999B32705D35D0D25CD4B0C858E4ECD3629D3
MD5 SHA1 SHA512 TLSH

Submit Download

2e4f6e7f-5f51-41ac-a1c0-8fb1beaa5156.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2e4f6e7f-5f51-41ac-a1c0-8fb1beaa5156.extra
Size 3KB
SHA256 807c8946e72c1661816d4ddfc5ca5527ce37c5e9f95c226aae370b36fcd2a092
MD5 49495b6594727cacbbf0d539d1b9c390
SHA1 76b5a938a109b170d3f9a79d04ea48660754effe
SHA512 3544f40617a8c147c550869551968aabeea0a8441502acc364a2d0f349a5194ec2dd9bf995ae303f91de243e64d4d6eff924ab31cbda4d80a2983711399cf047
TLSH
T111810231005CD9336AEE5D9EF3376D1D9D9EB32A98A22A8C85DAC75C4178CF4B386143
MD5 SHA1 SHA512 TLSH

Submit Download

9bed5fa6-3cd3-43db-8d69-c7217367f71a.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9bed5fa6-3cd3-43db-8d69-c7217367f71a.dmp
Size 65KB
SHA256 e48885b5ace656cad9d9e5288372e8ecdf9614ee1e2b32a6e1f038d12a7d8a28
MD5 6956e2e8c14a8cd84ac6977f63446ed6
SHA1 9f734852e0115ed0b42333c08cf5af32cd8c0a0c
SHA512 c99515e0bfbb5f6ae041869a4f45cd2970583d755fcbd0f74350df2452debe3041355cf2e95e0b2189a96d1bd42a5b30926b340d27d5b748847b76a3468b0215
SSDEEP 768:Oge7Nf5u+eOK2gkNBQXfNf5u+e2sAMTYQnr8Svdot:9xWK2gkNBQXOXAMTYYr8SvdM
TLSH
T11363A812B7E81861F925833458EBA71ABBF7F8108B97835F03009D7B2D673416DB1EA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9bed5fa6-3cd3-43db-8d69-c7217367f71a.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9bed5fa6-3cd3-43db-8d69-c7217367f71a.extra
Size 10KB
SHA256 a773fd7a6be7861def8cf4629781e29eaa00bd7a725564448c30a601b16d1fbd
MD5 c8e0a3a8c3c14a2f6033fc883e9989e3
SHA1 72152445353ac22534f3e89e2138d3a41e8b492a
SHA512 fe7d64491c44c6b8610e7076f8eaca77eaeff259425b64cab294ef8037f710eec15a4a7e4c91e704e7031b310dcd9e62c4905150faf8ec8acb3387455418d137
SSDEEP 96:STWCOTTfDIY6pw6lFFdt40Rh7CsevBb1d0JjMLlIrLlhTLlaXv7aputILfcBCqwt:S5OH78Fb/7uvZ8lL5xsP5wlO8foW
TLSH
T1CC228213878724B7AD5198C4BD30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9bed5fa6-3cd3-43db-8d69-c7217367f71a.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9bed5fa6-3cd3-43db-8d69-c7217367f71a.extra
Size 10KB
SHA256 933ee1527a0ec0e51e323def853e7301a61a25555d1ec9d210e03319aa921cca
MD5 6361d87f58fad4e2c2a06d7aa00f5fbe
SHA1 898b8408528deb7913a3524344f5312246ae5a55
SHA512 c2db44572b610988755548c4fe1f3e6a8b763ebc9c399564c62eb95ac8a85975b5ef23adfeb0569998a5ce8ec38d9b11470580be692501e6d08e1174b8f0ca11
SSDEEP 192:S5OjicFQiR4p4DnQYapdVxzPPWBHT4T/fKNtalm8foObLjetRW:iOjicFQi5DI13WBHT4TmaBAOv
TLSH
T1D222D831081CD837E7D6AC8DFB393E3A966D7B1A10E6789C41CCCA49C1A5878A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c044f434-bc5b-4d5a-9bef-38b5a769a3f1.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c044f434-bc5b-4d5a-9bef-38b5a769a3f1.dmp
Size 65KB
SHA256 38d7168a3ea929c33e0587ddf03e1c4933c21a9252a658b542f4fdeabf255096
MD5 a62b07c8442871b9072459dba7af27f3
SHA1 2ab3dc8b040d454afac47f6b53533d6e37b5a0ab
SHA512 c9b197e04a7011d1b228fde01b5a4930692e2f01c96c31a159574c07dfff1195aafd84146421b7ca3922985f75a7e08d01456a28a849015f8428b63e7bbb2966
SSDEEP 384:P22/8N0iGZk1arRpx0mjwywQOn5kKqv//XPDobnr8Svdot:P2+8N0fGgrRT0mjUGK2Lsnr8Svdot
TLSH
T14E63BA12BBA01463F6398230D8EBA71537F7E4210FA7535F07605A7E2E777816CB2A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c044f434-bc5b-4d5a-9bef-38b5a769a3f1.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c044f434-bc5b-4d5a-9bef-38b5a769a3f1.extra
Size 10KB
SHA256 e228f10b62f0945a1b69491efa892dee0d2274dbca80d8388124d3c56ff20a29
MD5 5ddf7a842d6bd3a10bc5f01564cdf354
SHA1 94e0bf25125ab8cb946331dbb9643a2a98cf0fb0
SHA512 834abfb15a4c5d364c14155a2bbf25df4f9d89e2640c362cdc10f77490908c3823e3d7894db08a0b390b309cd0c2b78277f77c2a8554cde72dae5393347c6ec0
SSDEEP 96:STWCxlRTfDIY6pw6lFFdt40Rh7CsevBb1d0JjMLlIrLlhTLlaXv7a3utILfcBCqh:S5xlh78Fb/7uvZ8lLXxsP5wlcCfoZ
TLSH
T154228253874724B7AD4194C4BC30AE7C45EC6FAA61F958A802CC4D47FA4A8F41FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c044f434-bc5b-4d5a-9bef-38b5a769a3f1.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c044f434-bc5b-4d5a-9bef-38b5a769a3f1.extra
Size 10KB
SHA256 dff06652361184a76297a6f81ae8659098f0ef16c0c0824c3105fd2fccf1bd59
MD5 4c615ee3006754c7d643169e286726f7
SHA1 dfd76ba425a67ef7d5d862e648311cd1aea12368
SHA512 eb39dc62b16060bf467e4b258c262f34b68622556ddabbab3c020a36b236cc4a7e7e9cdacd1da932e538d24ad1682cb755941d9f748acb626f55f2abf4362468
SSDEEP 192:S5xl9icFQiR4p4DnQYapdVxzPPWBH14T/fKNtalUCfo1bLjetRW:ixzicFQi5DI13WBH14TmahA1v
TLSH
T1D332E721081CD837F7D6AC8DFB393D3A966D7B2A10E2789C41CCCA49C1A9878A779517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f0dcc2f6-0f7c-45d3-ae9f-150b7663b5d9.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f0dcc2f6-0f7c-45d3-ae9f-150b7663b5d9.dmp
Size 67KB
SHA256 d67eafc41089617f16760666415c9d407545869f0757f230f3e7fc8b8287903b
MD5 0d519d67bacd961d29a144fc7b04fa79
SHA1 0c722cc99a3b2505031376232158b6951ea1996a
SHA512 0d9b1ee5060b65bdbe464c27fcf2bcc111eb0ec345c4316fa0522040a91798226d5e177bb6b97fb4077d2e8ca42962fdb90b518657059fdf5cb239251eb876c4
SSDEEP 768:OjDxB5gmy7Unry77crf8Bq4L2Q5/mnr8Svdot:aNB5ggry7Gf8BqDK/ir8SvdM
TLSH
T1B263B866B7A81871F226433098EBB74537F7F81107678B5F1300897A3C67389EDB2A65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f0dcc2f6-0f7c-45d3-ae9f-150b7663b5d9.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f0dcc2f6-0f7c-45d3-ae9f-150b7663b5d9.extra
Size 10KB
SHA256 c224c3e1d759fa8a320fbcf45f9c8808e29835e65d5923bb67934a26d86cf46c
MD5 c6dac5f70db48d06bde568745cd53ff8
SHA1 20098a7270e5179abf7d1dc27441db256011fc51
SHA512 f4978115922c52fac9ca7c7084f7f27acaf90528a214ae2da32de57df2910b20fcd55ae56d9037e16d7f161f5efc2480ca2809ccd8b3fe73c03dbbd72940f9e4
SSDEEP 96:STWCuTfDIY6pw6lFFdt40Rh7CsevBb1d0JjMLlIrLlhTLlaXv7a4utILfcBCqwvn:S5W78Fb/7uvZ8lLuxsP5wluUfoI
TLSH
T1EA227113879724B7AD4198C4BD30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f0dcc2f6-0f7c-45d3-ae9f-150b7663b5d9.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f0dcc2f6-0f7c-45d3-ae9f-150b7663b5d9.extra
Size 10KB
SHA256 d6a066b376115c39165022d435e1a9e61e4537698a0afe74558375a93d49fd1c
MD5 5bcd4dad0f3d22edc4de35715e86546e
SHA1 0e5842efa6e772871954c5ed87a9344dca60a81b
SHA512 500b23cb0773886b0ab4e7c179bf041d51ba32c3663bde423e7abf0e1cc82685717dbc3413614f73a25fbc4ab1b2ee39ed3b1c39f5c48ab0d668d74a147fce97
SSDEEP 192:S56icFQiR4p4DnQYapdVxzPPWBHc4T/fKNtalGUfo4bLjetRW:i6icFQi5DI13WBHc4Tma5A4v
TLSH
T19522E831081CD837E7D6AC8DFB393E3AD66D7B1A10E6789C41CCCA49C1A58B8A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f561a08c-ee98-4b51-b055-ce7ef88df0dd.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f561a08c-ee98-4b51-b055-ce7ef88df0dd.dmp
Size 62KB
SHA256 2325d7a864f0ca402ade4e30668dc95534fe1cd11d28c523c6becf6c6fe2f9b4
MD5 25d9c0c3510f6af365713853789e7ea5
SHA1 5d0f8d5dadb6f7de84a285ddc8041515e5d160fa
SHA512 408d2126df16917d115e22078c86337007dcfa61ff2bbe17832df675d46900ba28e5cbb6043a81f8825fcf4b7404f975cd9d48182ce86c2ea40c8082c6936609
SSDEEP 384:NLwoj6blKAJa0iH040pblafnRxD5OY35fonr8Svdot:NLL65KAJs65afnRx5L5gnr8Svdot
TLSH
T18853C812B3E11466F131033658EBA3163BF7EA120B67839F13108D7A2C677A5BDB1E61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f561a08c-ee98-4b51-b055-ce7ef88df0dd.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f561a08c-ee98-4b51-b055-ce7ef88df0dd.extra
Size 10KB
SHA256 2cb9ed646e62c76e276f8c6cc833a3acc53ee64c72e759942ed246783386eab0
MD5 3a83d585ae08c053778c8dbdf19afd3d
SHA1 d8bf1533d989364693a1dc658dcbdbb4a080459a
SHA512 6ca94e16cafeac3fdc27ca8138803100ce8d853f41eeb656e3f55a709603d8dc4019fd0fdfa1a41ba25051d38e34fc4789df4733080ca45bbce6c5587744680c
SSDEEP 96:STWCTTfDIY6pw6lFFdt40Rh7CTvBb1d0JjMLlIrLlhTLlaXv7aQutILfcBCqwvEP:S5H78Fb/7WvZ8lL2xsP5wlWTfoA
TLSH
T1C9227213878724B7AD4194C4BD30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f561a08c-ee98-4b51-b055-ce7ef88df0dd.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f561a08c-ee98-4b51-b055-ce7ef88df0dd.extra
Size 10KB
SHA256 ea545a61dbccf8f277ae94d6b087659cdf142384c4127c599d19c34de9dfa48d
MD5 cd2af483d2494eabe3ba2114fbcbc3f7
SHA1 37edb298f248a92cfa4b3c502c2780aae20bd62c
SHA512 80e95f7f53a2912f791030e52f888edf483ef0de89cf4076c3c82c81dd208815a86885180b0e42e709dd56e668558fc00ca657c466575f1ade61b0c6b46417c7
SSDEEP 192:S5jicFQiR4p4DnQYaVdVxzPPWBHo4T/fKNtal+TfogbLjetRW:ijicFQi5DW13WBHo4TmaWAgv
TLSH
T1B422D731081CD827E7D6AC8DFB393E3A966D7B1A10E6785C41CCCB49C1A58B8A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 d718b3fd391b6212cf1e659898b237df412d729dbcde43303167c6a1e236d561
MD5 a1f092ac727236c65bd9854c0a52cf4c
SHA1 5f21bf1a4ffb6df9abe422767d6558e5b5e8bbaf
SHA512 b5de5a711f9e7e9238f3830773441344c18b7547a8c064b1b033dfcb5a69fb14bff6288a0314d5600f674e3b543f84be19d32f5ee3966e7dcb4233f4b8354ca2
SSDEEP 96:QSdF95/7bkW6QXjrcPyUR6WxLW1Em+QFl3JFPFsd/dd66Joz0dzgClKtmSSd/UK:QOv5zbooCyjAixW1d66Joz0dzgCl6mSO
TLSH
T144C12F68F528863FD408423ACCA21B454F36385AAC4E7F1935DC640C2D572EE3A8D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 157b28ef93b5297e9acf85d905f0b58bbea87f23b8c315dc5cb52cef082c0b64
MD5 0de0d65931871f2d49ccc06fb8930eb8
SHA1 42ce45389e02cfd44e396d88879c4dde9f7240b2
SHA512 62f1a927a170c4e4a9c89d2588153c8189fb1cdb1917ee83d65a66af6d78727521052d25c4fb7b73076dd3580d20e0b181ba746b5b50aeeee310cce36bba10ed
SSDEEP 192:8Ov5zbotbDAyjwixu1d66Joz0dzgCl6mSSdz:/botbDAyjZId66JozQzgC1bd
TLSH
T1C4E12064EA28463FD404023BDCA21F440F35399B984E3F1935AD644D2D5B2DE3B8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 f7dfb1a218c9044f835f929dc5ddd533416c14ac39505e7eaea330157558c74d
MD5 a8689ebafa794f2507f987a1e511966f
SHA1 6832eac3e2c3b2d27b0b1ad222e81bc5b4719e71
SHA512 0cb62c8a025a4a07092bbbdabda6d1c59908d97571cceb914148f826841959e79a615a9d6c6291a590a4e2d96a4acdaf665968db846070cc89549806ed036d7e
SSDEEP 192:DOv5zboH6ZDAyjwiDQ1d66Joz0dzgCl6mSSd:MboaZDAyjrKd66JozQzgC1b
TLSH
T191E11164EA28863FD408027BDCA61F440F35398A984F3F1935AD604D2D572DE3B8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 94f1a7775553a825f0ee6dfb692dbd47c2ec4a2b8b282ac6ea7b9aef9223e25c
MD5 cd42d482ca3cb3e5814faf3b73ca8b05
SHA1 3b4ba1f1182fc1ae39627e6685ba5b59440852bb
SHA512 2571ad897dfe9caa225f6387adc9335637937c83105751fba754eb091e42855d0c46d22ea820cc4e94918f46f13d3a11050d870be7658b6b29d5a098e7ec4a74
SSDEEP 192:DOv5zboHoZDAyjwi6b1d66Joz0dzgCl6mSSdz:MboIZDAyjSZd66JozQzgC1bd
TLSH
T1DFE10F64EA28863FD408027BDCA21F450F39398A984F3F1935AD644D2D572DE3B8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 f2a8378383ff2149ac4d484ef5313f9f200d8aca68a99ff0b2e2f1e15f831974
MD5 2089b5a8ec4f52d6bccd083c8e8ca772
SHA1 0efa29daeb6b3ea15b3ce9ad606ced0a984f2fe3
SHA512 6fde1cf563e0da51aed1ee3aa9671584e9ad32cf4e1e76e566dab2d5beaf767e6595933222e4a602ad475750bdf60bf8c28328bc71d8aa2ed53984fb613ad432
SSDEEP 192:JOv5zboLbDAyjwiC81d66Joz0dzgCl6mSSdz:GboLbDAyjamd66JozQzgC1bd
TLSH
T16AE12164EA28463FD404027BCCA21F440F35399B984E3F1936AD654D2D5B2DE3B8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 7b605c69006b410d8e17ddb35207368b613f33ab14e7f5d70dbc44aaf4dedd59
MD5 bfe526a84b793c7f4f86cc4ff15e3d0e
SHA1 d0889c143194251166399283dc0632593343bb23
SHA512 03ba90f6dd6a2fb2659b4fa5cc9ed8ae7965ab14bba47f71041900563457087eca75426f93e47b37d9808908cac52b23e55c48668811764393b0f3f331db9c46
SSDEEP 192:Xj1d66Joz0dzgCl6mSSdoOv5zboLbDAyjwiD:XBd66JozQzgC1b1boLbDAyjr
TLSH
T126E12164EA28463FC404027BCCA51F440F35398B984E3F1936AD614D2D5B2DE3B8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\events\events
Size 1KB
SHA256 353b002109923493d53f30186b10667c7d50c4547a5b852487db43e905a1ce54
MD5 89c28f3b25fb6ec6a319bd1d1a619d28
SHA1 5a4142cb006e3271aa8e5daface305bf8897b904
SHA512 69f0a7e59d6790944a8810fe17e1a112a98a0ff656ff43a547e6edaa04a5e80bc5d9399dcc7793b7ff55577bc766918f78f6cdaa218a89e72a8ab52c104d6dac
TLSH
T11821784C39F94DEA9EC7E298B541028E57048E8B05C75D430D62DF8CCE89AD9316A83D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\events\events
Size 1KB
SHA256 6075c01f47e95b27a1c4cfc150e6b5a4275ec7593474589233428c6a7ea01a84
MD5 0e7f0f348cd23b184bb32e458382d78a
SHA1 f4856e826e7e6a0632c80ca3800649ab701225ec
SHA512 04a9c26e5635d9c47dccc736fbcc6d8b8f26a4b06468d07409ced8b76854c196c991d9b63e8ec5ad2700d9386843efcefa2108a895aeb18229d1f53862226bfd
TLSH
T10721AF5C39F84DAA5E97E29CB541028E57418E4305C75D430F92CFCCCE89AD9B22E438
MD5 SHA1 SHA512 TLSH

Submit Download

16786c3b-1dbd-46e0-81ce-511eb13c0376

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\16786c3b-1dbd-46e0-81ce-511eb13c0376
Size 235B
SHA256 5c0d86ef6d8666264e21c69b98345e19dc4d72f1c8fbde0d00f4f7755dcf01e1
MD5 9d24dcca8870452515dfc182afa4bec8
SHA1 879dbae617b0649a976b5c29d41da3cbab280c59
SHA512 e267a728cf18f4b0aa43c46bd0d1ffa4fdc4c235fe9dd68dbc11f2f61bf66836a10808deb136a9be6ae8f210cfd30a60441707af03a2ecaf975cee11d9016f23
TLSH
T118D0978424886B2D08040F27B0B068C730848C3310B89CA0C5904AB4C9F8EC882B3C17
MD5 SHA1 SHA512 TLSH

Submit Download

1ab237e0-cf9f-43eb-962a-77b8e9561b49

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\1ab237e0-cf9f-43eb-962a-77b8e9561b49
Size 235B
SHA256 84b92aa88745fa3a34fbf1c01cd8fff14ede6e8ced6bc7e323ad1f61a3e9f961
MD5 f9a22962de3c518a5f10bcd59178a30f
SHA1 3e93a56d273f0c0ae57f6602a04ee997b480f9b6
SHA512 482542f38d778c05d8c815783eacb19ee57b7ac807dd11cb55467b93a8d3c574820998ce944ba75e92721b862bb730b1e7943f9897da091725d575ec3aa6199b
TLSH
T121D097C528A8636C0C140F12B0A12ACA30948C3311705820C7B0A1B4C9F9AC44366806
MD5 SHA1 SHA512 TLSH

Submit Download

1c033895-f644-4cc4-87f9-3fbd2ecc89c6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\1c033895-f644-4cc4-87f9-3fbd2ecc89c6
Size 3KB
SHA256 d9616a3eca89c982b30e4222560e84c8dc21185aba4936df97332f1900933fb7
MD5 0b9b97e2bdd1d6e74b4f015454f3bae9
SHA1 44cc239a349656f98da224cea225e2130e58645b
SHA512 bc819dc6e39ae28ac174d41e3bb8ec6513235f136952e2b61645f5fdfe69e52a0da5457e9a090311e0172ea67b42250c44d21177615821cee73e58664188aa2e
TLSH
T191615121455C75738EE8A000E37B7A959EDF339F98470B8D15B9CD2882E84B8578B25B
MD5 SHA1 SHA512 TLSH

Submit Download

2202edd8-b4dc-498c-8c2f-73840073bafe

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\2202edd8-b4dc-498c-8c2f-73840073bafe
Size 235B
SHA256 7f735d23efcb04d14501588792eb3d66e352f5c819e5a34c241cd60d34e0c23d
MD5 59d812a4f94456af8e18f6b55681a805
SHA1 9627bea0abfc1c323da0f689880bab958603c703
SHA512 b39de329b6d6b1e7a01c79100f141e404451fbc82e203adbdba33e520220d916b617f2d74797279d4586ef322697aab9aea18b6ccc1deb0c8930faff1bc63243
TLSH
T100D097C0188863BE0C000F0EF0E029C630948D3328B07860EBB202B8AAF9AD842A2807
MD5 SHA1 SHA512 TLSH

Submit Download

412b39b6-1231-4c5d-a154-423fcd202886

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\412b39b6-1231-4c5d-a154-423fcd202886
Size 896B
SHA256 e71f919645986cfc29a5838c1da722f5d5c727341ab5de38fb6a265b1e15e866
MD5 21489590a392836a1b58b1be5b38beb6
SHA1 2efc771d1d4489f719b608b354e62f4eca45c872
SHA512 91f77b4e854ff75e96ab891fa163632889291a73849d02fc07091180de9eca2996927d693a18f1e1ff26a5f3ae4a3d4e2d4a59807600dc6983bdcbd96b22d203
TLSH
T1981104519A74B5739C28929BC5D17B0247D4712380C61B143DA24A084CAF53F676771B
MD5 SHA1 SHA512 TLSH

Submit Download

4480b1c1-b979-4ed5-bcbd-819a91bd5417

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\4480b1c1-b979-4ed5-bcbd-819a91bd5417
Size 2KB
SHA256 e84e96bb7e8752f1d9de534340092d000d1f5437124880b8d1956b78e45f5490
MD5 3c16a607cfb72f8d4c8e808c477aefa7
SHA1 6795c3b7954d94d3a917fee3ee46eaf7b4fa94bb
SHA512 4cb1e3298b907654ae6f0a0ad8e3f67fe67c2528ed718e9710a7b5985aff75828bc35bb4c0eabfa38f14a2f7b44bbe09cfb29b869e12a364190d418f2f8a44e4
TLSH
T19E41116C35B85CBB9C9BF65D9451334D97648A1710C21C832F61DF0CCC966BA336B42B
MD5 SHA1 SHA512 TLSH

Submit Download

45ee253a-bc6f-473d-98c5-79eb4540c054

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\45ee253a-bc6f-473d-98c5-79eb4540c054
Size 3KB
SHA256 1575672543118a5af1e714e3b39e9fbf4150fc1872f0ce362609f910690169e5
MD5 93a65a8c6b7c302aea5f0cae92db95ce
SHA1 85d9e339537cda762e30615bec1f2f4e607b79b0
SHA512 a795a05d389dfc02e948ce0180b503fd3072a0e5c837b537d9d376cb9c66d81bb38cbfac576086af3172f0eda09e44407cc7bfd7b51669f67b91d82aa0db66bb
TLSH
T1C4613431551CB5738EE8B101E37B7A998EDE339F58430BCD157ACD2482E84B8678B25B
MD5 SHA1 SHA512 TLSH

Submit Download

4a2efd2d-0028-496f-8f2c-3cdc8162a797

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\4a2efd2d-0028-496f-8f2c-3cdc8162a797
Size 3KB
SHA256 744d07c9b30b27c34b67abbf3af8e55f08782f4167b525d1043060af6379ecca
MD5 c205cdb8a8a6fb3099557f501713f16d
SHA1 7af8e334fc8dec5fb6a2724a86b3583c81ea1d01
SHA512 8562db8e01446e01e092b778c5b1e7aa845f851e4a11a80b06cc60b30418247e4ed0ac6bb73f25c569ffe3f25c34f0819a0dc9d8cad029856d7e6e4d11af4c49
TLSH
T147613531451C79338EE8A101E3367A549EDE339B68570BCD1569CD2482F84B99B8B25B
MD5 SHA1 SHA512 TLSH

Submit Download

4b85dc4b-71af-4ebe-bfe8-799de964e35c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\4b85dc4b-71af-4ebe-bfe8-799de964e35c
Size 235B
SHA256 8a627ed35ebe9baf8116e8c0c681d1abc25611006c9b8374b1685d0211dd1014
MD5 290cf5064570f3ade34a9019ab8a2f31
SHA1 ffb1f25444a15692767759b7d7b2d268b4fbe558
SHA512 94286ad09e91c3c076fa843ec95a5188ba0629abc680d675a025bc19ed9d2bade0a1cf2db5006459054d6674aba4ffcd1c528a486abdb0778595634a55ac6140
TLSH
T144D097901888A36C0C081F02F0A128CA3044CC336074A8209E6004B9BFF89C401A1E4B
MD5 SHA1 SHA512 TLSH

Submit Download

4f64c9d6-6cfe-4bf1-bc0e-ff61262988e3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\4f64c9d6-6cfe-4bf1-bc0e-ff61262988e3
Size 3KB
SHA256 b59d13585a84fa9bb2391a6a01d23a223640ac716b6f2cc7b1039c9e2491fe71
MD5 ddebd024d2f0efe24f4683695e2b827c
SHA1 2f7a7951401a48483c953d59720220f3537305fa
SHA512 ca7dc4e897894c785b76efe3a6898ad57dd479466f02d25db12819570c17dc05bd4bd59867094a35524b32499d6fe807754bd7fffe1812a542364c1df7e0e73d
TLSH
T1B1613331055C79739EE8A101E3377E559EDA339F58430BCD15B9CA2482F88B85B8B35B
MD5 SHA1 SHA512 TLSH

Submit Download

646f6c38-78f8-492b-94c1-6e45e07da983

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\646f6c38-78f8-492b-94c1-6e45e07da983
Size 3KB
SHA256 4d40cc5440dbd10df8b6ce4b358586db5849720a9560c56e6c32ae4e64e261f9
MD5 2c53ed422619e5d7fb05d2a5183f9088
SHA1 09e2c809661ef5862666cd7950f9face1ca9c416
SHA512 968632f66e64bac7efbf60f84479fd4dc11b9ee2e36c7f7702323dac3dcac0814bc20a88cebe0872da86c1889ba48fd38fd5875c969c0fbfd1eb3cb111c8654a
TLSH
T139614531155C69739EECA100E37779549EEE339B58430BC91579CD2482E88F8578B25B
MD5 SHA1 SHA512 TLSH

Submit Download

7d13adea-0486-4efa-b93a-acf99f38f7be

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\7d13adea-0486-4efa-b93a-acf99f38f7be
Size 17KB
SHA256 28d3520dd9450e129d56320f1ac6027216a16c08e241488b7383cc24795c265a
MD5 69c0131386ee3cc1429bdf17c0d17a0c
SHA1 7e723c548545d9cbd7a9b3d1533288c2fb96a295
SHA512 bd73dc542d1ce9011dc82a152eb20420154ea15ac3bafe68df3f74d206c1b2000d91ef274cef6d3e00a24096c8b6baa7e1207314e49a48b9a7b3a775f94b303d
SSDEEP 384:ioSvnOgVB8wKrFTd9U2XKrp3eYvlMK8QfdJ:iobk2akYvlMLQfdJ
TLSH
T12682C856246045BA8351E37994EEBFC3E5F528CF4C418FC9DBF0BD0869DA06E522788B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f7a077b-88d0-4c6c-be44-e11108751be0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\7f7a077b-88d0-4c6c-be44-e11108751be0
Size 883B
SHA256 f28547d3f12bf8cddf54a879671155d4e42dca4d3d3e7851c671134695a5c312
MD5 13a0bc1421437234b1b04bd7e098a2c5
SHA1 a93a70e7999223c0566c020ce50952d86319efdb
SHA512 dfed657cd085edba9a95cb1f7e80c86012db866df0bbd885490658f0b1e0d4308c8845eba630f7eb4043b6aed010d50bdf70c884a6eb8803fd13df5ad84d84a5
TLSH
T1D4116392E634B8B2CC28820B85853B078BE4713381C607143EB259048C7FA2EB37B20B
MD5 SHA1 SHA512 TLSH

Submit Download

9237b917-06ed-4dae-a859-3d700b799106

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\9237b917-06ed-4dae-a859-3d700b799106
Size 886B
SHA256 8aaf4613aeac53c38e549af547494df2b08a7baa0494fe80599eed1866f5337b
MD5 0322c1b003a0ac8ffe8373bb3c87c548
SHA1 e1d4e28345f33e5463297036a7e3e76c6bcee0de
SHA512 2d39ff1ec065010f64b8b96db677aceb60a51e3c97130102e4e3b9192c1408421f27a423abc8555ee0d1b6e1a62abca374a4720e6bececa099f654f6f92caffd
TLSH
T1AF1123519A7475B3DC28D29B81913B4287E4B13380C71D043EB14A084CAA62EB77720B
MD5 SHA1 SHA512 TLSH

Submit Download

b335d9b5-e436-4c3d-9964-95494e852367

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\b335d9b5-e436-4c3d-9964-95494e852367
Size 3KB
SHA256 f4f66be7a6abd81c2782c32ca694a123fcc0961b017e45c90499189efda15629
MD5 928925ff447387edcf5f841a554ea385
SHA1 fc7a69a92cd780035ae3019dd82e9598d978f060
SHA512 6d8ac43dd7e9dcb5b4323178f6c326bb9ba6b43b62fc1ec038237015544fa0ef04a6cee6120a17b21a7e089f108ec2269e52c82511cfc93063468f80f1a970f9
TLSH
T142615421451C79738EE8A001E33B7A549EDB339F58470B8D1579CD2482E84B897CB25B
MD5 SHA1 SHA512 TLSH

Submit Download

ba36d4e8-250f-4888-94b6-9e4a4247b692

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\ba36d4e8-250f-4888-94b6-9e4a4247b692
Size 3KB
SHA256 ae681a15e442465d0578d071a9d9bad0069ae8ab432ca491fa645f8538806a76
MD5 4e24bfd23581f829d1effb7643a5571e
SHA1 fe8b00ba6a5b330a6f37c628d836dcaead14a24a
SHA512 479b9585542516d113b01262694e5375b7f963a03d82fec970725a06ef4937d4d4f095e7ca2a332759c3277e7fa483a1fba76512e01479a2af5124d719131384
TLSH
T1E5614431451C69738FE8A101E336A9559EDA339B98470BCD1579CD2482E88B89B8B25B
MD5 SHA1 SHA512 TLSH

Submit Download

bc558380-2154-4a8f-933e-0033a4b22e1f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\bc558380-2154-4a8f-933e-0033a4b22e1f
Size 2KB
SHA256 0972d11363467c18343038504966c07abfe7565b3951c0b905c41e33a1e482b9
MD5 a0ae4303101d3ba3d70871218254c316
SHA1 f3248cf07a720a8167c20b37901771d92f374dca
SHA512 dbcdefea51831b8bfb1b2123beff095959fafe3c65295c246f809538140e62a02323783c92e918f53dc31e85483b09f561ce358328f6f515b9ab6f86294428ee
TLSH
T1EA41522C35B84CB75DD7E25DE182264E4760CA5300C629431DA2CE0C8D8A7AE736F83B
MD5 SHA1 SHA512 TLSH

Submit Download

dbd808d6-cd14-4ba1-8ae4-0299689ec561

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\dbd808d6-cd14-4ba1-8ae4-0299689ec561
Size 871B
SHA256 a36717d9010ef8ab56ebef119fef24de60556ef5655663f52a15d5c7d6887a7c
MD5 b4dc3703ada83cd4ec3c7a6459560a7c
SHA1 0fb867c04d4753c1717a7f8f4a97ac90eab8ebdd
SHA512 2f833d1b50eaf57c0ae88e92c185d63be495050b3848a936ebec5e71fdeef80f27fa27e33f23c2febf7eaa651336d521822328c2485624362ca3f31e52efc106
TLSH
T10A1123919634B5B29C28D35F85953B018BF47123C0CA19042DB15A084CAF52EBB6A30B
MD5 SHA1 SHA512 TLSH

Submit Download

e9d856de-480f-45c0-9413-8422bf6a2a55

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\e9d856de-480f-45c0-9413-8422bf6a2a55
Size 3KB
SHA256 1da7925061ba01fddaa5ccd06f589b772f0fee8d180df440ba4078c5112ce681
MD5 6bc4e558f55d32ce7e68792fe64434d7
SHA1 4699af0c8287f8e655f4d280cf913e0b04e1c38e
SHA512 404744675dc372811c1c94b08f6ea2ec2edf6b6eafa929094d9efb9c42572d9f7e5dfece70a5fcebe1fae9d39a3b6106238ec4dc276ada020af76c653fe416ff
TLSH
T155615131055C79739EECA041E3777E589EDE338F58430ACD15A9CD2482E84B86B8F25B
MD5 SHA1 SHA512 TLSH

Submit Download

e9e53d9e-cbd4-44bb-b314-c6ceec42b507

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\e9e53d9e-cbd4-44bb-b314-c6ceec42b507
Size 3KB
SHA256 ac83263e50a6c55f560ae48acb47bd3773464c29f1f90e19bf4f4587d97dfc31
MD5 aed9fe864698956549b07dc7fe37dee2
SHA1 0097ae0457a84156a15ca092c9df96a8488af3bf
SHA512 528fd19248f716c736e2761a18d6b59647ffea4c3a50fbb4c6261c37e05f01c5b07ca7136f82698b471e3cb90702f08886304731aae070d0543d3caa3b0af2dd
TLSH
T195614231451CB9738EE8A001E37B6A589EDE339F58430FCD15B9C96882E84B8578B35B
MD5 SHA1 SHA512 TLSH

Submit Download

ee06f4db-fc03-4dda-9c55-3c89e5f1c8da

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\ee06f4db-fc03-4dda-9c55-3c89e5f1c8da
Size 3KB
SHA256 dbe0b82a8dfaa1c36176fddbd33a62191182d7a3ee5d8da0964e74be887a13c8
MD5 cc5922500f42456b05eb06fe2aedcea9
SHA1 e9e2be1700ed1f5e42a930621b269b2732ceb444
SHA512 9eb8c563353a57a871b4037b6f23ebbcd8e1cecab74d53324231fc4e20e4885143550b51308fb876ad870b0902a19f2ea2755bfba6d04e7c457880d7ba1f3152
TLSH
T1B2613231451C69339FE8A101E337B9689EDE339B58431F8E1579CA2482E84F8578F35B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\prefs-1.js
Size 6KB
SHA256 5d0393ab769a631dde7167f39d596c2a3d1c710a5dbfba0668f8953cdbf6b456
MD5 676842a0b47c817ede99b00e95d97ad5
SHA1 13c911d1ce5b3906fb2a6f1349c35aa1e7998685
SHA512 b7f5b2ed89e3f87387f59c4fd3445a67b53f2eccae07b9fcd94a1b35edd37f46b7ae59aa441a04a0c08082153054614e966daab38cd7f5ed595c04902c7325c2
SSDEEP 96:xHmUTUhqGqm1ftjt1zS1RSSl5dv9jNnnSRH/CgBw88H8L4cnUV9xI:ssRm1ftjtARSSw91Bw88l2
TLSH
T10EE12F7895488BBF78B6776CAC688C305AB2013BB7BF68C610B544C5054CF3486F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\prefs-1.js
Size 6KB
SHA256 c3a8a2421f967d0d74982bd572e75983bb4e18dabc9e64ba71299471b023e036
MD5 13c355d2d82c40ff338ec1cba91c240b
SHA1 876c8e59eb3f31f2e059e7ada16c7f2d7cd85098
SHA512 010b0476c840dcbe7e75924ec68d5bd87c7e7f2aed23902ada7892bdb40d636bb446a9fed4e0ed8b33e82d150b3578f1c5e11d007a921a1b9c2e0f67e4c30356
SSDEEP 96:xHmUTUhqGqm1ftjt1zS+pSSl5dv9je+nSRH/CgBw88H8L4cnUV9xI:ssRm1ftjt/pSSo91Bw88l2
TLSH
T1E4E1207895488B7F78B6776CAC688C305AB2013BB7BF68C610B554C5050CF3486F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\prefs.js
Size 6KB
SHA256 a1b1c676895130aaedf5d767de5bd9a3a7a0a573afce5945ff80fb5f6d29d7a7
MD5 956c0c49bc0eeba8ab1535aef5754493
SHA1 932d2accaf53aa485a6d7271d6cfeab7ab429fea
SHA512 f5061e9c0a936c3e85496557927286403b5ece6c34613200207b5587a3a7831d64324beb2eec19964be9b678dbd7fe11d218a0ce486762dcd4fbdceec0c262bc
SSDEEP 96:xHmUTUhqGqm1ftoY1zS4SSl5dv9jn2EnSRH/CgBw88H8L4cnUVaI:ssRm1ftoYBSSs91Bw88lx
TLSH
T174E13F7895488BBFB4B6776CAC688C305AB2013BB7BF68C650B644C5014CF3456F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

memory/848-3-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/848-18-0x0000000001210000-0x0000000001232000-memory.dmp

Download

memory/848-1-0x0000000005CA0000-0x0000000006246000-memory.dmp

Download

memory/848-5-0x00000000058B0000-0x000000000594C000-memory.dmp

Download

memory/848-0-0x0000000000960000-0x0000000000ADA000-memory.dmp

Download

memory/848-6-0x0000000007FE0000-0x0000000007FF6000-memory.dmp

Download

memory/848-2-0x0000000005610000-0x00000000056A2000-memory.dmp

Download

memory/848-7-0x0000000001210000-0x0000000001232000-memory.dmp

Download

memory/848-4-0x00000000056C0000-0x00000000056CA000-memory.dmp

Download

memory/848-9-0x0000000008090000-0x00000000081DE000-memory.dmp

Download

memory/848-8-0x00000000058A0000-0x00000000058B0000-memory.dmp

Download

memory/2396-87-0x000001B5A5D70000-0x000001B5A5D7E000-memory.dmp

Download

memory/3064-2642-0x0000000000960000-0x0000000000961000-memory.dmp

Download

memory/3568-1802-0x000001D9DD970000-0x000001D9DD97E000-memory.dmp

Download

memory/3828-34-0x0000000006400000-0x0000000006450000-memory.dmp

Download

memory/3828-794-0x00000000052E0000-0x000000000530F000-memory.dmp

Download

memory/3828-31-0x0000000006240000-0x00000000062F2000-memory.dmp

Download

memory/3828-32-0x00000000064D0000-0x0000000006692000-memory.dmp

Download

memory/3828-33-0x0000000006380000-0x00000000063F6000-memory.dmp

Download

memory/3828-3846-0x0000000007100000-0x0000000007457000-memory.dmp

Download

memory/3828-19-0x00000000053B0000-0x00000000053C0000-memory.dmp

Download

memory/3828-35-0x0000000006BD0000-0x00000000070FC000-memory.dmp

Download

memory/3828-36-0x0000000006750000-0x000000000676E000-memory.dmp

Download

memory/3828-20-0x00000000060D0000-0x0000000006136000-memory.dmp

Download

memory/3828-3845-0x00000000068D0000-0x00000000068F2000-memory.dmp

Download

memory/3828-795-0x0000000005310000-0x000000000531B000-memory.dmp

Download

memory/3828-16-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/3828-374-0x00000000053B0000-0x00000000053C0000-memory.dmp

Download

memory/4232-1892-0x0000020F94B60000-0x0000020F94B69000-memory.dmp

Download

memory/5188-21-0x0000024FB9580000-0x0000024FB9590000-memory.dmp

Download

memory/5188-417-0x0000024FB9580000-0x0000024FB9590000-memory.dmp

Download

memory/5188-418-0x0000024FB9580000-0x0000024FB9590000-memory.dmp

Download

memory/5188-23-0x0000024FB9520000-0x0000024FB9542000-memory.dmp

Download

memory/5188-796-0x0000024FA0E20000-0x0000024FA0E2C000-memory.dmp

Download

memory/5188-797-0x0000024FA1060000-0x0000024FA1072000-memory.dmp

Download

memory/5188-22-0x0000024FB9580000-0x0000024FB9590000-memory.dmp

Download

memory/5188-30-0x0000024FB9970000-0x0000024FB99B6000-memory.dmp

Download

memory/5404-1874-0x0000026473DA0000-0x0000026473DA9000-memory.dmp

Download

memory/6100-1025-0x0000027E27A30000-0x0000027E27A39000-memory.dmp

Download

memory/6240-3583-0x0000025C8ACE0000-0x0000025C8ACEE000-memory.dmp

Download