phantom_stealer | f350549e93d794a656c42232bbc069781cf30a88ab3cb687a12a9366796a01a2

Analysis

max time kernel
149s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/05/2026, 13:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f350549e93d794a656c42232bbc069781cf30a88ab3cb687a12a9366796a01a2.exe
Size 2.4MB
Sample260508-qpr2msds7r
SHA256 f350549e93d794a656c42232bbc069781cf30a88ab3cb687a12a9366796a01a2
MD5 4b5a90baacd920c024174df168b9948a
SHA1 2ec632300987285c0a9d955ddc340b376c3cb3a4
SHA512 a57599b1ef62c8d869d8e20e989274dbc2ab311c29443029bb9c58e3ff42d6e7a24bef6bee07161ef9100d05fdb4fa2d9c25c4878e07e6c8d3f1a875482f4b49
SSDEEP 49152:WmUzGl6vCmQ2IkDdwStD6d58XUx3ZzictAxV62qgbXOr6ROBNPejVcM:fmIAkJobV62qg6uROBNPeV3
TLSH
T1F9C5BE04F3E216BBF6A78730C6954336D671F4C017A9EDEB0255A41CAE3B7E26636360
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery phantom_stealer persistence stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.privateemail.com
Port
587
Username
[email protected]
Password
abacheke2

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
mail.privateemail.com
Port
587
Username
[email protected]
Password
abacheke2
Email to
[email protected]

Mutex

Z2TW46CR6IVTAQDH4WF2

Attributes

anti_analysis
0
cb_enables_ssl
1
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 3 IoCs

resource	yara_rule
behavioral1/memory/3228-0-0x0000000000BA0000-0x0000000000C5E000-memory.dmp	family_phantomstealer
behavioral1/memory/3228-5-0x0000000000BA0000-0x0000000000C5E000-memory.dmp	family_phantomstealer
behavioral1/memory/3228-6-0x0000000000BA0000-0x0000000000C5E000-memory.dmp	family_phantomstealer

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
342	icanhazip.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4528 set thread context of 3228	4528	f350549e93d794a656c42232bbc069781cf30a88ab3cb687a12a9366796a01a2.exe	85

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3976	msedge.exe
1068	msedge.exe
6212	chrome.exe
1080	chrome.exe

Checks processor information in registry 2 TTPs 44 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	jsc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	jsc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227204038705131"	chrome.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3228	jsc.exe
3228	jsc.exe
460	chrome.exe
460	chrome.exe
3228	jsc.exe
3228	jsc.exe
3228	jsc.exe
3228	jsc.exe
3228	jsc.exe
3228	jsc.exe
3228	jsc.exe
720	firefox.exe
720	firefox.exe
720	firefox.exe
720	firefox.exe
720	firefox.exe
720	firefox.exe
720	firefox.exe
720	firefox.exe
720	firefox.exe
720	firefox.exe
720	firefox.exe
720	firefox.exe
720	firefox.exe
720	firefox.exe
720	firefox.exe
720	firefox.exe
720	firefox.exe
720	firefox.exe
720	firefox.exe
720	firefox.exe
3228	jsc.exe
3228	jsc.exe
3228	jsc.exe
3228	jsc.exe
3228	jsc.exe
3228	jsc.exe
3228	jsc.exe
3228	jsc.exe
3228	jsc.exe
3228	jsc.exe
3228	jsc.exe
3228	jsc.exe
3228	jsc.exe
3228	jsc.exe
3228	jsc.exe
3228	jsc.exe
3228	jsc.exe
3228	jsc.exe
3228	jsc.exe
3228	jsc.exe
696	firefox.exe
696	firefox.exe
696	firefox.exe
696	firefox.exe
696	firefox.exe
696	firefox.exe
696	firefox.exe
696	firefox.exe
696	firefox.exe
696	firefox.exe
696	firefox.exe
696	firefox.exe
696	firefox.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	3228	jsc.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	6860	chrome.exe
Token: SeCreatePagefilePrivilege	6860	chrome.exe
Token: SeShutdownPrivilege	6860	chrome.exe
Token: SeCreatePagefilePrivilege	6860	chrome.exe

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
460	chrome.exe
460	chrome.exe
6088	chrmstp.exe
720	firefox.exe
720	firefox.exe
720	firefox.exe
720	firefox.exe
720	firefox.exe
720	firefox.exe
720	firefox.exe
720	firefox.exe
3872	msedge.exe
744	msedge.exe
696	firefox.exe
696	firefox.exe
696	firefox.exe
696	firefox.exe
696	firefox.exe
696	firefox.exe
696	firefox.exe
696	firefox.exe
6860	chrome.exe
6860	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
720	firefox.exe
696	firefox.exe
3228	jsc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 3228	4528	f350549e93d794a656c42232bbc069781cf30a88ab3cb687a12a9366796a01a2.exe	85
PID 4528 wrote to memory of 3228	4528	f350549e93d794a656c42232bbc069781cf30a88ab3cb687a12a9366796a01a2.exe	85
PID 4528 wrote to memory of 3228	4528	f350549e93d794a656c42232bbc069781cf30a88ab3cb687a12a9366796a01a2.exe	85
PID 3228 wrote to memory of 460	3228	jsc.exe	87
PID 460 wrote to memory of 6136	460	chrome.exe	88
PID 460 wrote to memory of 2320	460	chrome.exe	89
PID 460 wrote to memory of 1080	460	chrome.exe	90
PID 460 wrote to memory of 5368	460	chrome.exe	91
PID 460 wrote to memory of 2308	460	chrome.exe	92
PID 460 wrote to memory of 5600	460	chrome.exe	93
PID 460 wrote to memory of 3284	460	chrome.exe	94
PID 460 wrote to memory of 5460	460	chrome.exe	95
PID 460 wrote to memory of 1888	460	chrome.exe	96
PID 3228 wrote to memory of 2320	3228	jsc.exe	89
PID 3228 wrote to memory of 2320	3228	jsc.exe	89
PID 3228 wrote to memory of 1080	3228	jsc.exe	90
PID 460 wrote to memory of 2604	460	chrome.exe	98
PID 3228 wrote to memory of 1080	3228	jsc.exe	90
PID 3228 wrote to memory of 460	3228	jsc.exe	87
PID 460 wrote to memory of 3028	460	chrome.exe	99
PID 3228 wrote to memory of 460	3228	jsc.exe	87
PID 3228 wrote to memory of 5368	3228	jsc.exe	91
PID 3228 wrote to memory of 5368	3228	jsc.exe	91
PID 3228 wrote to memory of 6136	3228	jsc.exe	88
PID 3228 wrote to memory of 6136	3228	jsc.exe	88
PID 3228 wrote to memory of 2320	3228	jsc.exe	89
PID 3228 wrote to memory of 2320	3228	jsc.exe	89
PID 3228 wrote to memory of 5460	3228	jsc.exe	95
PID 3228 wrote to memory of 5460	3228	jsc.exe	95
PID 3228 wrote to memory of 3284	3228	jsc.exe	94
PID 3228 wrote to memory of 3284	3228	jsc.exe	94
PID 3228 wrote to memory of 1888	3228	jsc.exe	96
PID 3228 wrote to memory of 1888	3228	jsc.exe	96
PID 3228 wrote to memory of 1080	3228	jsc.exe	90
PID 3228 wrote to memory of 1080	3228	jsc.exe	90
PID 3228 wrote to memory of 5600	3228	jsc.exe	93
PID 3228 wrote to memory of 5600	3228	jsc.exe	93
PID 3228 wrote to memory of 460	3228	jsc.exe	87
PID 3228 wrote to memory of 460	3228	jsc.exe	87
PID 3228 wrote to memory of 5368	3228	jsc.exe	91
PID 3228 wrote to memory of 5368	3228	jsc.exe	91
PID 3228 wrote to memory of 2604	3228	jsc.exe	98
PID 3228 wrote to memory of 2604	3228	jsc.exe	98
PID 3228 wrote to memory of 6136	3228	jsc.exe	88
PID 3228 wrote to memory of 6136	3228	jsc.exe	88
PID 3228 wrote to memory of 2320	3228	jsc.exe	89
PID 3228 wrote to memory of 2320	3228	jsc.exe	89
PID 3228 wrote to memory of 5460	3228	jsc.exe	95
PID 3228 wrote to memory of 5460	3228	jsc.exe	95
PID 3228 wrote to memory of 3284	3228	jsc.exe	94
PID 3228 wrote to memory of 3284	3228	jsc.exe	94
PID 3228 wrote to memory of 1888	3228	jsc.exe	96
PID 3228 wrote to memory of 1888	3228	jsc.exe	96
PID 3228 wrote to memory of 1080	3228	jsc.exe	90
PID 3228 wrote to memory of 1080	3228	jsc.exe	90
PID 3228 wrote to memory of 5600	3228	jsc.exe	93
PID 3228 wrote to memory of 5600	3228	jsc.exe	93
PID 3228 wrote to memory of 460	3228	jsc.exe	87
PID 3228 wrote to memory of 460	3228	jsc.exe	87
PID 3228 wrote to memory of 5368	3228	jsc.exe	91
PID 3228 wrote to memory of 5368	3228	jsc.exe	91
PID 3228 wrote to memory of 2604	3228	jsc.exe	98
PID 3228 wrote to memory of 2604	3228	jsc.exe	98
PID 3228 wrote to memory of 6136	3228	jsc.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

C:\Users\Admin\AppData\Local\Temp\f350549e93d794a656c42232bbc069781cf30a88ab3cb687a12a9366796a01a2.exe
"C:\Users\Admin\AppData\Local\Temp\f350549e93d794a656c42232bbc069781cf30a88ab3cb687a12a9366796a01a2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:3228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:460
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff9157c728,0x7fff9157c734,0x7fff9157c740
      4⤵
      PID:6136
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1724,i,986104868035481273,15741507856129775671,262144 --field-trial-handle=1996,i,8580736537876553985,17787514032328627322,262144 --variations-seed-version --mojo-platform-channel-handle=1992 /prefetch:2
      4⤵
      PID:2320
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g" --force-high-res-timeticks=disabled --metrics-shmem-handle=2064,i,17153987769206221693,10108993336731211482,524288 --field-trial-handle=1996,i,8580736537876553985,17787514032328627322,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:3
      4⤵
      System Time Discovery
      PID:1080
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g" --force-high-res-timeticks=disabled --metrics-shmem-handle=2192,i,16007965171910030276,17625002608279049427,524288 --field-trial-handle=1996,i,8580736537876553985,17787514032328627322,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:8
      4⤵
      PID:5368
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2908,i,5534824528567876168,13999676809389225880,2097152 --field-trial-handle=1996,i,8580736537876553985,17787514032328627322,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:1
      4⤵
      PID:2308
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2936,i,4438933764866230335,5906892080162675413,2097152 --field-trial-handle=1996,i,8580736537876553985,17787514032328627322,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:1
      4⤵
      PID:5600
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3144,i,9622774777578413237,3214132012383711155,2097152 --field-trial-handle=1996,i,8580736537876553985,17787514032328627322,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:1
      4⤵
      PID:3284
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3180,i,8845719102752715497,15166545187439154548,2097152 --field-trial-handle=1996,i,8580736537876553985,17787514032328627322,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:2
      4⤵
      PID:5460
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3908,i,7668657834627552963,2413690684921567491,2097152 --field-trial-handle=1996,i,8580736537876553985,17787514032328627322,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:2
      4⤵
      PID:1888
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3296,i,3097483143333935899,15611077456557958809,2097152 --field-trial-handle=1996,i,8580736537876553985,17787514032328627322,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
      4⤵
      PID:2604
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g" --force-high-res-timeticks=disabled --metrics-shmem-handle=4216,i,5014452601619429976,9324158294285146632,524288 --field-trial-handle=1996,i,8580736537876553985,17787514032328627322,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
      4⤵
      PID:3028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g" --force-high-res-timeticks=disabled --metrics-shmem-handle=5072,i,7993289805861655757,12532156297401164464,524288 --field-trial-handle=1996,i,8580736537876553985,17787514032328627322,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
      4⤵
      PID:4064
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5132,i,10388200547833453005,3772255131983583935,2097152 --field-trial-handle=1996,i,8580736537876553985,17787514032328627322,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:1
      4⤵
      PID:4356
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5144,i,17854557734415789556,14020547674631433374,2097152 --field-trial-handle=1996,i,8580736537876553985,17787514032328627322,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:1
      4⤵
      PID:4264
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g" --force-high-res-timeticks=disabled --metrics-shmem-handle=5184,i,14588060291975539827,12895645717144769383,524288 --field-trial-handle=1996,i,8580736537876553985,17787514032328627322,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
      4⤵
      PID:4736
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:3048
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff7418855a0,0x7ff7418855ac,0x7ff7418855b8
        5⤵
        Drops file in Program Files directory
        
        PID:2792
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:6088
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff7418855a0,0x7ff7418855ac,0x7ff7418855b8
        6⤵
        Drops file in Program Files directory
        
        PID:4060
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g" --force-high-res-timeticks=disabled --metrics-shmem-handle=5284,i,15011696632848481808,14003898981844697937,524288 --field-trial-handle=1996,i,8580736537876553985,17787514032328627322,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
      4⤵
      PID:2060
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5332,i,11696769274637058889,12007125144350951870,2097152 --field-trial-handle=1996,i,8580736537876553985,17787514032328627322,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1
      4⤵
      PID:5676
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5216,i,4556151237451703373,11889972741456287126,2097152 --field-trial-handle=1996,i,8580736537876553985,17787514032328627322,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
      4⤵
      PID:4496
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g" --force-high-res-timeticks=disabled --metrics-shmem-handle=5192,i,3899387624508156533,18371470250950701798,524288 --field-trial-handle=1996,i,8580736537876553985,17787514032328627322,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
      4⤵
      PID:5852
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g" --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,14806103674239846735,14209761471426788117,524288 --field-trial-handle=1996,i,8580736537876553985,17787514032328627322,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
      4⤵
      PID:220
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5164,i,13398762866442707692,10344133004764402848,2097152 --field-trial-handle=1996,i,8580736537876553985,17787514032328627322,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
      4⤵
      PID:4772
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g" --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,14484375298107466741,4078911034502047278,524288 --field-trial-handle=1996,i,8580736537876553985,17787514032328627322,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
      4⤵
      PID:4056
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5488,i,14037918598497008423,9826128493217174463,2097152 --field-trial-handle=1996,i,8580736537876553985,17787514032328627322,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:1
      4⤵
      PID:1184
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5060,i,14552427577974732894,14362767180420838889,2097152 --field-trial-handle=1996,i,8580736537876553985,17787514032328627322,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
      4⤵
      PID:2348
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g" --force-high-res-timeticks=disabled --metrics-shmem-handle=5168,i,17016666548927863180,6168103384343103967,524288 --field-trial-handle=1996,i,8580736537876553985,17787514032328627322,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
      4⤵
      PID:3628
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5504,i,9051616129788837543,16365267470965700912,2097152 --field-trial-handle=1996,i,8580736537876553985,17787514032328627322,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:1
      4⤵
      PID:2072
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=4164,i,12108139264058875954,4768517171229760900,2097152 --field-trial-handle=1996,i,8580736537876553985,17787514032328627322,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:1
      4⤵
      PID:5488
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=4140,i,2076383017402607617,16341667582405817221,2097152 --field-trial-handle=1996,i,8580736537876553985,17787514032328627322,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:2
      4⤵
      PID:5560
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5088,i,7613666857673950614,1172888516231697918,2097152 --field-trial-handle=1996,i,8580736537876553985,17787514032328627322,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:2
      4⤵
      PID:4340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\byrj34fj.wjz"
    3⤵
    PID:4860
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\byrj34fj.wjz
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:720
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27099 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2076 -initialChannelId {23ecb691-1aeb-43ab-9516-10b659f7c26d} -parentPid 720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.720" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:4428
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2520 -prefsLen 27135 -prefMapHandle 2524 -prefMapSize 270279 -ipcHandle 2224 -initialChannelId {10a1d5eb-4836-4704-a4cc-2bfc1c66a1c2} -parentPid 720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:740
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\4a88e291-8c70-4bdc-ba56-3c8a56fb6cb1.dmp"
        5⤵
        
        PID:572
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2320 -prefsLen 27135 -prefMapHandle 2836 -prefMapSize 270279 -ipcHandle 2832 -initialChannelId {60be66da-21eb-427f-b150-fecc9904b239} -parentPid 720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.720" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:1616
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\22133d6a-e12f-426d-9a9b-504b9d7c1fe9.dmp"
        5⤵
        
        PID:4636
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2832 -prefsLen 27135 -prefMapHandle 2952 -prefMapSize 270279 -ipcHandle 2872 -initialChannelId {41461d9b-1f38-45cf-a04e-d96fed24f28f} -parentPid 720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.720" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:4024
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c479dea1-ab90-49bd-92cf-8b6aecbf3e1d.dmp"
        5⤵
        
        PID:5324
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2872 -prefsLen 27200 -prefMapHandle 2680 -prefMapSize 270279 -ipcHandle 3444 -initialChannelId {ecbf6c5a-50f6-4abe-9968-71974e4f08a0} -parentPid 720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.720" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:5972
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3896 -prefsLen 27325 -prefMapHandle 3900 -prefMapSize 270279 -jsInitHandle 3904 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3928 -initialChannelId {2e537007-5ba3-4ed9-b7b6-d4ea04797d44} -parentPid 720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:5648
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a116814b-6616-4c70-8b0b-5ea5ba25d68d.dmp"
        5⤵
        
        PID:5644
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2880 -prefsLen 27325 -prefMapHandle 3000 -prefMapSize 270279 -ipcHandle 2672 -initialChannelId {732fdc3e-c95e-4b5f-a5be-199b5468d711} -parentPid 720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.720" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:1524
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8de02ee1-12c1-4e6c-aa8b-c1f573340bd3.dmp"
        5⤵
        
        PID:2392
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4200 -prefsLen 27325 -prefMapHandle 4204 -prefMapSize 270279 -ipcHandle 4220 -initialChannelId {cdc51821-7e15-4ccb-adb3-6e2d8f878d5b} -parentPid 720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.720" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:2880
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4576 -prefsLen 34824 -prefMapHandle 4580 -prefMapSize 270279 -jsInitHandle 4584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4596 -initialChannelId {ea8a1693-5a5b-4606-b60c-6af1331791ad} -parentPid 720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:1404
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2792 -prefsLen 35012 -prefMapHandle 3236 -prefMapSize 270279 -ipcHandle 3188 -initialChannelId {27350442-d388-41e6-ae80-41053e777260} -parentPid 720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:1408
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2960 -prefsLen 32900 -prefMapHandle 3308 -prefMapSize 270279 -jsInitHandle 3568 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3116 -initialChannelId {3043a031-696e-4731-81cf-6ec9b9feb6e2} -parentPid 720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:3948
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5204 -prefsLen 32900 -prefMapHandle 5208 -prefMapSize 270279 -jsInitHandle 5212 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5220 -initialChannelId {414a8b89-7e0e-44d1-80fa-b0960f4816a0} -parentPid 720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:2184
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5580 -prefsLen 32900 -prefMapHandle 5584 -prefMapSize 270279 -jsInitHandle 5588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5596 -initialChannelId {2d2e09bd-e994-471f-a2d5-fb11b786a543} -parentPid 720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:3872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7fff821fc188,0x7fff821fc194,0x7fff821fc1a0
      4⤵
      PID:4820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1724,i,1251367561447655978,13626475256789736987,262144 --field-trial-handle=2212,i,7810961145680161217,2251407298040213519,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
      4⤵
      PID:4008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,7042405459328315782,15765898290278009273,524288 --field-trial-handle=2212,i,7810961145680161217,2251407298040213519,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:3
      4⤵
      System Time Discovery
      PID:3976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,17899666889850853911,887747421998948585,524288 --field-trial-handle=2212,i,7810961145680161217,2251407298040213519,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:8
      4⤵
      PID:5928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3120,i,14160631096377838377,10699942709552747133,2097152 --field-trial-handle=2212,i,7810961145680161217,2251407298040213519,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:1
      4⤵
      PID:5844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3124,i,3947149712188767920,3108571395007027558,2097152 --field-trial-handle=2212,i,7810961145680161217,2251407298040213519,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:1
      4⤵
      PID:1604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,4337975425080554470,1776193461612063053,524288 --field-trial-handle=2212,i,7810961145680161217,2251407298040213519,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:8
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,2687044648879645209,3579524404707702605,524288 --field-trial-handle=2212,i,7810961145680161217,2251407298040213519,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:8
      4⤵
      PID:1380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,16653055187643333037,14429415526810360738,524288 --field-trial-handle=2212,i,7810961145680161217,2251407298040213519,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8
      4⤵
      PID:520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3640,i,7122735217606108550,7757965062245467509,2097152 --field-trial-handle=2212,i,7810961145680161217,2251407298040213519,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
      4⤵
      PID:764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3548,i,17264055033281898606,13282335179586488154,2097152 --field-trial-handle=2212,i,7810961145680161217,2251407298040213519,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:2
      4⤵
      PID:208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3696,i,17090894853528909494,4218013821932794821,2097152 --field-trial-handle=2212,i,7810961145680161217,2251407298040213519,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
      4⤵
      PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3724,i,7427662531894148145,9534984544765251845,2097152 --field-trial-handle=2212,i,7810961145680161217,2251407298040213519,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:2
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3756,i,10060675865866334091,2241003502356858614,2097152 --field-trial-handle=2212,i,7810961145680161217,2251407298040213519,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:1
      4⤵
      PID:3884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3732,i,5199289875350440395,3919794235036756601,2097152 --field-trial-handle=2212,i,7810961145680161217,2251407298040213519,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:2
      4⤵
      PID:4964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3740,i,7551421821514043986,6883144300189012274,2097152 --field-trial-handle=2212,i,7810961145680161217,2251407298040213519,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:1
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3888,i,1874268484703733808,6986977728642384508,2097152 --field-trial-handle=2212,i,7810961145680161217,2251407298040213519,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:2
      4⤵
      PID:3628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3936,i,8936211332299994347,12204475317627009421,2097152 --field-trial-handle=2212,i,7810961145680161217,2251407298040213519,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:1
      4⤵
      PID:5300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3748,i,4351759152764367497,8021484782025067654,2097152 --field-trial-handle=2212,i,7810961145680161217,2251407298040213519,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:2
      4⤵
      PID:2200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,14333953845409716551,16658907565983477733,524288 --field-trial-handle=2212,i,7810961145680161217,2251407298040213519,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
      4⤵
      PID:5024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,14797872445023100793,10720177704275304686,524288 --field-trial-handle=2212,i,7810961145680161217,2251407298040213519,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
      4⤵
      PID:5096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,17299541920447865269,12897179477100827687,524288 --field-trial-handle=2212,i,7810961145680161217,2251407298040213519,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:8
      4⤵
      PID:844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,10742936478889172536,17004802189787095994,524288 --field-trial-handle=2212,i,7810961145680161217,2251407298040213519,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
      4⤵
      PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x250,0x7fff821fc188,0x7fff821fc194,0x7fff821fc1a0
      4⤵
      PID:1584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1740,i,18247589416258811156,9314978016525140521,262144 --field-trial-handle=2220,i,690740823463492556,15196330590364538715,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
      4⤵
      PID:1032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,5924454514387704342,10179461905791896041,524288 --field-trial-handle=2220,i,690740823463492556,15196330590364538715,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:3
      4⤵
      System Time Discovery
      PID:1068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,53232986874888759,3073704757908003558,524288 --field-trial-handle=2220,i,690740823463492556,15196330590364538715,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:8
      4⤵
      PID:2348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3132,i,5630706029520745788,10065465881187628978,2097152 --field-trial-handle=2220,i,690740823463492556,15196330590364538715,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:1
      4⤵
      PID:4752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3136,i,18439814909742694606,7034504904320663605,2097152 --field-trial-handle=2220,i,690740823463492556,15196330590364538715,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:1
      4⤵
      PID:472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,13434533667408345078,758767685778858372,524288 --field-trial-handle=2220,i,690740823463492556,15196330590364538715,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:8
      4⤵
      PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,14565239601223747609,791511558414715239,524288 --field-trial-handle=2220,i,690740823463492556,15196330590364538715,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
      4⤵
      PID:3852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,662601821796104893,12129545258974334986,524288 --field-trial-handle=2220,i,690740823463492556,15196330590364538715,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:8
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3628,i,13993462495094904573,8386552924372267487,2097152 --field-trial-handle=2220,i,690740823463492556,15196330590364538715,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
      4⤵
      PID:3092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3716,i,4742090426393882864,13737986437579496443,2097152 --field-trial-handle=2220,i,690740823463492556,15196330590364538715,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:2
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3768,i,15684233284410718637,9826936120893249950,2097152 --field-trial-handle=2220,i,690740823463492556,15196330590364538715,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
      4⤵
      PID:5124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3800,i,6542336631761566253,3819725934653058489,2097152 --field-trial-handle=2220,i,690740823463492556,15196330590364538715,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:2
      4⤵
      PID:5888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3836,i,10378766954192762031,12648090544563974562,2097152 --field-trial-handle=2220,i,690740823463492556,15196330590364538715,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:1
      4⤵
      PID:2092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3852,i,18068807063843297026,5800373959036709557,2097152 --field-trial-handle=2220,i,690740823463492556,15196330590364538715,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:2
      4⤵
      PID:3496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3884,i,9387761534556706700,6394328858731910486,2097152 --field-trial-handle=2220,i,690740823463492556,15196330590364538715,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:1
      4⤵
      PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3908,i,11261632646235391190,12343167619903926677,2097152 --field-trial-handle=2220,i,690740823463492556,15196330590364538715,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:2
      4⤵
      PID:420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3952,i,1578896905660623607,8003144712390944771,2097152 --field-trial-handle=2220,i,690740823463492556,15196330590364538715,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:1
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3996,i,7873648014700259358,2131212334068147525,2097152 --field-trial-handle=2220,i,690740823463492556,15196330590364538715,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:2
      4⤵
      PID:3908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,11579005794084844040,791833079662187643,524288 --field-trial-handle=2220,i,690740823463492556,15196330590364538715,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
      4⤵
      PID:6816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,12582764937821113778,4139157202845900682,524288 --field-trial-handle=2220,i,690740823463492556,15196330590364538715,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
      4⤵
      PID:5332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,8224681311471103699,11452723826050322673,524288 --field-trial-handle=2220,i,690740823463492556,15196330590364538715,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:8
      4⤵
      PID:5360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ervt01vw.tsy"
    3⤵
    PID:2652
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ervt01vw.tsy
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:696
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27099 -prefMapHandle 1988 -prefMapSize 270331 -ipcHandle 2076 -initialChannelId {b3a6ece7-89a2-4ddc-8e9e-f89bc4de2113} -parentPid 696 -crashReporter "\\.\pipe\gecko-crash-server-pipe.696" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:1544
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2236 -prefsLen 27135 -prefMapHandle 2220 -prefMapSize 270331 -ipcHandle 2208 -initialChannelId {58213a29-60a4-49d0-ab19-9ffc723b8e2f} -parentPid 696 -crashReporter "\\.\pipe\gecko-crash-server-pipe.696" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:7152
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3c745f65-dbed-4ab4-9781-60262c3e7958.dmp"
        5⤵
        
        PID:2420
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2248 -prefsLen 27135 -prefMapHandle 2828 -prefMapSize 270331 -ipcHandle 2824 -initialChannelId {0bb2c517-2368-4ab6-9e5a-355ad61ab712} -parentPid 696 -crashReporter "\\.\pipe\gecko-crash-server-pipe.696" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:6868
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\34eb746c-501b-419e-9852-b1697fa05aa2.dmp"
        5⤵
        
        PID:6460
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3116 -prefsLen 27135 -prefMapHandle 3120 -prefMapSize 270331 -ipcHandle 2824 -initialChannelId {0df36c67-b5b2-4a76-a223-5cd2232b4f5b} -parentPid 696 -crashReporter "\\.\pipe\gecko-crash-server-pipe.696" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:6448
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\565c110f-6634-4927-85d1-4271eb4d62e4.dmp"
        5⤵
        
        PID:6408
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27200 -prefMapHandle 3488 -prefMapSize 270331 -ipcHandle 3052 -initialChannelId {199fe386-6705-4bba-9d39-ace1f35b28d6} -parentPid 696 -crashReporter "\\.\pipe\gecko-crash-server-pipe.696" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:6636
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3732 -prefsLen 27276 -prefMapHandle 3736 -prefMapSize 270331 -jsInitHandle 3740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3780 -initialChannelId {d7e58cc5-c2ca-460d-bfbc-82ec816a1061} -parentPid 696 -crashReporter "\\.\pipe\gecko-crash-server-pipe.696" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:6544
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\87d679c2-8fd2-4fac-9239-f6764fd1edf6.dmp"
        5⤵
        
        PID:5472
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3976 -prefsLen 27276 -prefMapHandle 3980 -prefMapSize 270331 -ipcHandle 3916 -initialChannelId {ee8ec543-32fd-4e9e-9853-1727fd9be551} -parentPid 696 -crashReporter "\\.\pipe\gecko-crash-server-pipe.696" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:6700
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\22ccdc7f-a7da-4c4e-92c6-284278b015ca.dmp"
        5⤵
        
        PID:2024
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4100 -prefsLen 27276 -prefMapHandle 4104 -prefMapSize 270331 -ipcHandle 4124 -initialChannelId {3506f2ab-e31b-4f2f-9d7f-e481ee0f86fe} -parentPid 696 -crashReporter "\\.\pipe\gecko-crash-server-pipe.696" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:4636
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4428 -prefsLen 34829 -prefMapHandle 4432 -prefMapSize 270331 -jsInitHandle 4436 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2688 -initialChannelId {c3abed04-61ec-4db4-8b49-fa24c777693c} -parentPid 696 -crashReporter "\\.\pipe\gecko-crash-server-pipe.696" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:5172
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4692 -prefsLen 34878 -prefMapHandle 3188 -prefMapSize 270331 -ipcHandle 4932 -initialChannelId {b733b84f-9c81-4105-8499-a4a6480851b1} -parentPid 696 -crashReporter "\\.\pipe\gecko-crash-server-pipe.696" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:7000
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4852 -prefsLen 32766 -prefMapHandle 5032 -prefMapSize 270331 -jsInitHandle 5028 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5044 -initialChannelId {20f18d93-7895-447d-82ea-1dcd5aef06ea} -parentPid 696 -crashReporter "\\.\pipe\gecko-crash-server-pipe.696" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:2124
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5244 -prefsLen 32766 -prefMapHandle 5248 -prefMapSize 270331 -jsInitHandle 5252 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5260 -initialChannelId {060ae7db-5bab-48c2-8c25-711790fd7b28} -parentPid 696 -crashReporter "\\.\pipe\gecko-crash-server-pipe.696" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:6316
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5472 -prefsLen 32766 -prefMapHandle 5476 -prefMapSize 270331 -jsInitHandle 5480 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5248 -initialChannelId {bdb18f5d-2f40-40c3-b0ff-9e4f68521656} -parentPid 696 -crashReporter "\\.\pipe\gecko-crash-server-pipe.696" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:6308
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a2ocvpzg.dts"
    3⤵
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:6860
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\a2ocvpzg.dts /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\a2ocvpzg.dts\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\a2ocvpzg.dts --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xe8,0x10c,0x7fff9157c728,0x7fff9157c734,0x7fff9157c740
      4⤵
      PID:3928
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a2ocvpzg.dts" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1688,i,11669856950937501298,2584215363348768361,262144 --field-trial-handle=2420,i,2440952627619876003,17266089634779188533,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:2
      4⤵
      PID:3280
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a2ocvpzg.dts" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1964,i,2176056137515188660,8263029280952055575,524288 --field-trial-handle=2420,i,2440952627619876003,17266089634779188533,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:3
      4⤵
      System Time Discovery
      PID:6212
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a2ocvpzg.dts" --force-high-res-timeticks=disabled --metrics-shmem-handle=2076,i,11773117872030356234,11561934556070453522,524288 --field-trial-handle=2420,i,2440952627619876003,17266089634779188533,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:8
      4⤵
      PID:4184
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a2ocvpzg.dts" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3160,i,15876231569071387596,569783727886125473,2097152 --field-trial-handle=2420,i,2440952627619876003,17266089634779188533,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:1
      4⤵
      PID:4388
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a2ocvpzg.dts" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3172,i,16053144690806486786,13403878582863848328,2097152 --field-trial-handle=2420,i,2440952627619876003,17266089634779188533,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:1
      4⤵
      PID:5024
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a2ocvpzg.dts" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3500,i,16891561595646651569,9262536955292777074,2097152 --field-trial-handle=2420,i,2440952627619876003,17266089634779188533,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:4944
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a2ocvpzg.dts" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3516,i,5183391886490916069,17304930576092888404,2097152 --field-trial-handle=2420,i,2440952627619876003,17266089634779188533,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:2
      4⤵
      PID:6248
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a2ocvpzg.dts" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4236,i,3673033401825209799,14080846704708765536,2097152 --field-trial-handle=2420,i,2440952627619876003,17266089634779188533,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
      4⤵
      PID:6980
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a2ocvpzg.dts" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4352,i,16630157582477787400,14544773075955010073,2097152 --field-trial-handle=2420,i,2440952627619876003,17266089634779188533,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:2
      4⤵
      PID:6708
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a2ocvpzg.dts" --force-high-res-timeticks=disabled --metrics-shmem-handle=4428,i,15345939713697103924,8948551414246226079,524288 --field-trial-handle=2420,i,2440952627619876003,17266089634779188533,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
      4⤵
      PID:4052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 399a99fe14caea485ebe5e46b0b0c247e4577cdd59658a180244dc56589422ce
MD5 bea26b4084d7025d9e0cf466778914d7
SHA1 e8022aa0b789ecf929ee53d67a04d66653b0f501
SHA512 229d3cdfe1dbd15b346460df8c4c7b354cef223f7c44ef43c1984d3635b15f29b6066268bfd0d4bf513f27ccb75384f00be97aeb49fa57020d7c3c3114586a20
MD5 SHA1 SHA512

Submit Download

3048_13422720403792674.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\3048_13422720403792674.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

6088_13422720403778735.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\6088_13422720403778735.pma
Size 696B
SHA256 da9a8ae0c04da6ceae900796a026f4777895bf149eed2c495fbdae098362f596
MD5 3f5af086a83b749aa34a3aac1b986a0a
SHA1 0e67e17122beec914722d98cef0e669541560ff3
SHA512 0a12749b3971d0023cc1dd4f87113c94cc2c961ef824009c89a32ba24fe51de83357bb0757af7612ffb3a638302f5a298a2fc823dec8d117cf27255d2996191b
TLSH
T153010E49A3144F77CC828D3584FE27412BB0FA501B821BBF7B10724F2E021C9AED9168
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 9KB
SHA256 bf9098ffb23af32f636a4fca76df06ef54deeabcdaf9ffe9da8553a177915951
MD5 12dadd6cb02e9aee537c8c3857d603b3
SHA1 c7b5b13454fe8a5c0ff29ea1e2c5899ca9602878
SHA512 e41c00af5df7c377a84a482f66e461a16017dabe0fc91388cb2ea9547ae662a2e51af3449876ecfe811d66d66e79baacd83df67f852eb8dd8c502d474fbd877f
SSDEEP 96:Q5aKe0LOzlkoN5hK3yK37zsVz8bckehK2RK24GUOESbaCMaohK3zK3G+/J:frfz9JC0zrnCsbAQ7e
TLSH
T1CF12A1D59E02486F3BC2DB2B335326946E67540BC7E895B277FF5106B0CAA64011F2BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9hv4mshu.default-release\activity-stream.contile.json
Size 4KB
SHA256 2a50f86a08042cf1fd4bf5bf72cb1d17f3613133d25d13513e542c8983c0b28e
MD5 8153578efdb28bddbf162ef91b3e0a0d
SHA1 85fe731405d4b7c983f6dce27fea28a72d7ac8c1
SHA512 3ab9b57720dbda6d46370d84f37d9f0343fb5469eee41b598940f6db2170b103b5987eec84b7b3a2fdc88fed3acc62d1149c398f200dd3064b49f0bc1eb3e80b
SSDEEP 96:KswuqtvfXEO10VdMhhnFS8Dlsv9QtIeN33Bf9AWXl:KTtvsO6dwPdl49QtIet33AWXl
TLSH
T19FB11AFF983DC40B57326AE06D5F228DF04B7147DAE2AD8A7BC55C05D6C128D51E0AC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9hv4mshu.default-release\activity-stream.discovery_stream.json
Size 74KB
SHA256 4dcd308a12e7db6607d4e5f6e9a302b310ba8cbd2d632451e687423a96c008e6
MD5 996d56983503821bb06a1f88d9924679
SHA1 f8e389904d566f3394ef85b25e067db590e3684a
SHA512 ec08305a07a9a6654fcf321917cc38f0f516a597398598598edc5881219727adca1c7b6fba051dba2b881939c661074c1f49e077d8126a52b36129842964942a
SSDEEP 768:FyaNCOkwzOnUg7NgCGClxhdcs0/4Gel+d25Su8Ziuu4tSBXlq/VCCdYFua/7:keXkR4sygsu8Ziuu4iHCi0a/7
TLSH
T1E07308E397E8B2FB2BA127C72C4BBD9B62D14146E38505C9FCE9C90CC19C654123B5AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9hv4mshu.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 768c14d295b1ab8ac882088a765aac1123d43bbff0367dc417b63676d8deaafd
MD5 3902013033fadf24ea89bb7b73a6d697
SHA1 e204831609c01c5849ea470543dfd6171b135f5e
SHA512 8a964a455787c5dee452f9369661944585d4bfbb40807b553f504548a2cea0705b1a0ae4e554f4b24c7775a4b386faeed682a80f6c9fab14c555acdf92f02593
SSDEEP 384:HHMO0iO024YArFuhw+5EL1pPsac4j0lpDII+C9wA9w/:nrZYoFuK+5EB9sac4ID8Lp
TLSH
T18E528E7EAF1138BA1A27D1C4D8EA5204CF08E6BBEFD2D06605543C45C684378B8F64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9hv4mshu.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 170aca5e51acd8ceca776200a8944b97274ab39a40e9746805cf677a4b1ce54a
MD5 91a049583382ff738eb117dfd427f169
SHA1 5c7de212e944e132f35ef68fe0bc8b3abad7ca79
SHA512 dacda9be71ed66d443669bceda5249ab82cc5e3bf68da00c1a1a52eea6913d6828b5ccf025d880c16e260aae8d796b01466e3806536309d97d21549e4d02dda9
SSDEEP 1536:jTrliGj/DDqZQY9OO/P8UI0LWN4ExiP15S7a53K0oLkpsZw3OFhZ9UyXEjQv7suX:j3lEQYjF9y4EAnzpNOx9U70sqdJ3
TLSH
T110A3AFFACFA2CE3C55FFD02D5A82893EFD262404B3A73019C963671461C6BB87675648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96ae7c95-109b-46c0-8d83-5e739e5cfc53.tmp

Path C:\Users\Admin\AppData\Local\Temp\96ae7c95-109b-46c0-8d83-5e739e5cfc53.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Crashpad\settings.dat
Size 40B
SHA256 1b891431e9703a73f529b55424af25765041c852f1275de49c3ee5ace406abee
MD5 6a36c18e047b4d35aa1e4ccfdad5c121
SHA1 f122005c68f734babedcfb98afa9ba237f26088e
SHA512 616f072c0757a3b43971f0942920d4dec89b75a989d68bc1fe33c8e07753a69a973be563f1fb43f1b1017f8ee0b51b139b3d61cd8a76da056f4e4c6228ddaad3
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\BrowsingTopicsState
Size 414B
SHA256 c5917967e339df8715b3888acc09f4143e2c299fd7e3d58fbf36ae7808343922
MD5 247d8ad3b029c952d9292499d68ad2be
SHA1 db052e144d0db68a86508fb95f71078f942fa028
SHA512 c1b5acf1885d3f08b3b432937bcd74684fc2f00c3888ddbd13f53047a653a411d88252968988ce4a1ad7966df822cad6514beb46d22303871bd3a639edaf9eef
TLSH
T1BAE022BAC9719C371CFE472D6460424BEB50135B2B4089AF3A3D860C8FB9B364686C5C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 160663f9a4a569090cb670b4ab2b635d9c1d577689daea10dee2c8375a84ed0e
MD5 b8de4d92e61dbf551808accc4bdf4d68
SHA1 8eb08901930a9883fd71f28c61ff30fa2be4d3dd
SHA512 5879ce458c9893d72c65f33bc4a3e8a859935536dc43a5cf7c3cb4ec9d00860ae3f867ed7a885561fbcd2d3f1eb9b95bbb9bcf186ef52cc385498b43bb3524e5
SSDEEP 6:/FoEXEpQkNmT4QKS/6vXyW9SdGkEXSSRkll1pf:d7XeNmkiECWxkESSy/1
TLSH
T17F135EFCA9815E63C29415BC4C8B2770B3F6885FE99682D3086C74B274087409F5E254
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 5c47db1944c3c21d94882c25d096cdc79840187cce99a15c38f82cee2fa097bc
MD5 4fdd230aa464800b59108ebd3290ad97
SHA1 5c31f6e4fef3167199db4b7ac69c7f51e07000e8
SHA512 9ee0ebf2f351c8ade6c69ac887f84d2c5adfaac0541a13ea589531efc98ff5bb66334e61057bff0df7b564dae0e779c796bd1826628fa5acfe66be78d9cca29b
SSDEEP 48:WlAWYlshv41YM1Xge8XasoMmX5dVEPLVBKWwtl:iAfls9oYuge8asoj/VOLHKWol
TLSH
T1834495F71800DAC3EB15DAB85841922CCE7246232D99EE75F22844725550AF7322C6B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 cbf012333b4adc46fb184ae700fa5ed2a9fe1d24b87721f6b4719a814556d594
MD5 dfaeca01d26b8424dab4d72573a8ab41
SHA1 059cd5ffa58fa2ebd35c97c290e45247da086a8a
SHA512 3d6f014869b6ec35d0326d11f30103111e25e183cf661caf048008fb952816ff1481dbe34a49dc2dc0f562fd19797d3a550fcfaef57d4e58d900b82b8164fb1d
SSDEEP 48:phLCg1i+Nq5w1Ei9dBVybmzu9G7CCXiwpBTaTxXPetR74OVIsBvppIvF:pU5Hi2bp9MCHXl074AIsBvjw
TLSH
T1BA252A50B9296FD1DB0856B1350AC3E8CE5BC99CB771591B097E6C7CF40C809AB3507A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 4a2d1e7277098c6a5695e7db0292161e484d10199c61f8f0a637795871910cf5
MD5 2ce97e334e63f28a18d702ad55fa211d
SHA1 08dd6e2f8150ed30906c3f190112bfe6a38bdc73
SHA512 16edf9b9bb442819dee5dcaa9e210423190f8512f1c3f10d21938b46031ff009a7c5d6aee16b251a77b62112b52eb08c9c7ffe9cee3c3afd9f0f803e10b5af05
SSDEEP 768:kUfDPLSgcRUv+H4LxR41UfDPLSgcRUv+N4m2e44/j7o4T7o4W7o4:2OUm6oCoTo
TLSH
T135163BE60F28A586EA82DFB0BBCDDD1C3CB022D6FCD36892E126927945E1BC417C515D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Cache\Cache_Data\f_000001
Size 35KB
SHA256 77ee60dc747aee3a1da7898c826b8b3af4d37e662b1fffa7ce49951251a0e8b0
MD5 f1a6423674e1b0aebcad521b98bcc350
SHA1 429dd5f8e1bc1dc9f9590e9f18045b953699287c
SHA512 2cb9b912cd31129cf2992b56047f956c1069f2c471002b0530d37dbe8c80248b6183c8a88bb04fd6be77c0de98ee143103b07aec6761bb18f86d8dfb96500c5f
SSDEEP 768:N1O+jCmgfArPGVS7GZjeq4Cvt/eBDGzn0A/m/MW8CHF:9OmgfADZGZjeAexGz14vl
TLSH
T1BFF2D025813978D0B25D6C072CAE489CB89BA93ED62F09B1734B81747705B67392C7F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Cache\Cache_Data\f_000002
Size 67KB
SHA256 5561b7015108c0d761b2f646ef6a2941d8d9c710792215107625756e597be305
MD5 83f1f185736d51aa38a53c9f59a9bb8a
SHA1 e0e6d897f7edea01e2156fb83e0fb5c9950ca7cb
SHA512 283e8f77f1c6d013feb74dc2b188d3431bfe887028d1b15e772495b8322b9c3f465afc3a161044abada30a37dd9d697b99a54c3811fe23b9200ddddd4720bc7f
SSDEEP 1536:pulGSzd2shU1evf8gZQE+DOm+m6+ywGlmxry3DTCfL:4lGShl3k0YZ8irSOfL
TLSH
T18763021B49318931DA93A8A7A0F472818BC26D73BB1C53A46F4583C4574C3EAE9CD0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Cache\Cache_Data\index
Size 256KB
SHA256 6d0b829a0904edcf94bffd0fd796e5dccbb480d717167529cfdaedb39a0dabd5
MD5 9e29260b375378011d0937291f6628bf
SHA1 c38f7493d013cbdf9e370ad30f0f0d1228867cb4
SHA512 5b175f7e5694100a487f6ae3173f35fca5afe4492f7cbb78d7700845ab4b3d877df96456208a39722fa343fd7249e422cf941f4a6e6bcf110898a1b46eaa2774
SSDEEP 3:LsLllFlklNllklkXlBTblP/tSllLll/ncll//ZNtlmNtl3Nl/lpllll/glNlXl:LsRa3lPxN/AilthkNHdlll
TLSH
T1C844025E93555E16C2C501FD845797507375C505DA5FC783570C26612DC27505E0F554
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 a637baf690f21f1e6a5e50de772d43ac9bd8af862f511fbaa84ce853c8540788
MD5 a22d08fa6f1a59472345b57033df42dc
SHA1 dce1fc588fb19fb15429f50d920bcf2a604a01c4
SHA512 5b8a138ff877c6ba5d812ddfe733984f8fe202def7828ad43ba4351c493363005e0141216493b98694a9e1a50cc827d55e475b8384bcf6e4b7be4a9811558aa4
TLSH
T1B0E02B81824C0F0DD33D96F7CEE603444A0E82C42ABE3603A880C2C237125241248222
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 35d795035f65ff0a594c996f3c5c1c672d7413111162f563f956f688829af8a0
MD5 312a900828cbed15340b2c412c8682ab
SHA1 f95e686f90aca424de7e6e7414a23030681130d1
SHA512 a2706f75ee30eb43cd473c94ec07687dd279011c2b3ec8d0a059c852de55a83cda9f8bcd4292e4b2fa9b76d06bd3dd16b5722515af2477e779a5b4b596c1b4d5
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 9e067315bd9422a3c5c218bede15fd448d437e26377e2c61822b5c98425183a0
MD5 14d0e358672e96d0ce020c8d3d299e3a
SHA1 73f1e0cacc6a648fb5fc76a21e4ebc235e4b4cb7
SHA512 6d796cededc9b5dea42261f26b923d6e42708ff33d468a13abcf325884356c16448b8b04e00211c125b2c1b3830480c7832af2e4a330166056726f894a1befbd
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\DawnGraphiteCache\index
Size 256KB
SHA256 a53139fdc6d5c6151abc23fadb5a8f0dac34610da175a531058c95bfd49f4757
MD5 4081cba71731c90ac7a95d4683a1708f
SHA1 006aaafffcda6d071a7c735205116a2e6b8110a6
SHA512 7c5f106ba2b2335f17d53b45eb2a4abf67015e3e322d98627fc78c0b0017ff0197696de33e9f09d0ffb98a6484b00d49fbe5cb94312707f557c8cd135f02932b
SSDEEP 3:LstlNllklkXlJK+:LsX3lPJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\DawnWebGPUCache\index
Size 256KB
SHA256 3be3ae219b5075877ed014255308c8d4305375ad6efb97c8356c3a4f1fb19621
MD5 670ea9e161af2614b53ae63e058460d8
SHA1 6ff9714f857ec23ba41b5094147d9bef3715da67
SHA512 8256440616bd834e1a08c898f45c70dcee6180eb9819d45be864d50e806d1500ad4d84d266015f6db6040d4dd7677940ab417b7943dfe71695a02694d5c0da57
SSDEEP 3:LstlNllklkXlT:LsX3lP
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\128.png
Size 4KB
SHA256 41b21cd721317759a1391ec66ec4606b1f1b0a66fc6542ec3e69f9a6ba9a60d3
MD5 a6e517fba00c44d26f516d2bc473042f
SHA1 bcedbf549056bfacff8820cac38713a1eacd95b9
SHA512 8c58b58a05b60420ff187c2dc8b71e019fc36cd6bcec050257b5532f131ba50ecd00fe2ca734805753a39f6911125d2d8684286207b1d1d039e862904279a145
SSDEEP 96:4niq7dWteEb8MsIhE+bf+rgEPQCGJxc4bOdpI0xeblJpzSkLqdsQ4pXnW3P:e97kteEnJEu+rxoi4b3RJpfhQ45nGP
TLSH
T14AA1AFFA12E3DA94303E91711B20659B4D7909385624364DDBB2AC7140C7A0D9B7CF63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\manifest.json
Size 2KB
SHA256 4375dfec1feb4295bdee57adb32a4cbaf351904be807160eabe87ca692b2b5b2
MD5 a60bd7255f6a78622887303990f4b4af
SHA1 61d77694628cdaf7f5ace1332a01d05e79f13772
SHA512 96b411c6b37e927de84cd363e37d0203bd692cbe2cc1aea56780830f23889562a8a512a07316c2c0ca7909a43a7ab879d9e908421ba6e7b99fdbeba1202e2282
TLSH
T173516DFBBC10AC634BB08594991A710EF729735E45CFC4DBB2BC60734BE4CAA1D60598
MD5 SHA1 SHA512 TLSH

Submit Download

offscreendocument.html

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\offscreendocument.html
Size 97B
SHA256 b9fa2d52a4ffabb438b56184131b893b04655b01f336066415d4fe839efe64e7
MD5 b747b5922a0bc74bbf0a9bc59df7685f
SHA1 7bf124b0be8ee2cfcd2506c1c6ffc74d1650108c
SHA512 7567761be4054fcb31885e16d119cd4e419a423ffb83c3b3ed80bfbf64e78a73c2e97aae4e24ab25486cd1e43877842db0836db58fbfbcef495bc53f9b2a20ec
TLSH
T132B012EE6C03C10004551E8A38E092146412638870D1A1445CDEE0334D4075C9C0B44C
MD5 SHA1 SHA512 TLSH

Submit Download

offscreendocument_main.js

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\offscreendocument_main.js
Size 115KB
SHA256 f6b3a786b1178d0d853f37559c83a4b5e40e2af451dca20af583137416af8416
MD5 5c3d8dc7447cc707f8da55f8c3b7d2b9
SHA1 1ff4cf8647c578a29a7b75c56d3dad86fce729a0
SHA512 0c09e9b71e0721e45ea3cc8797eb1e9b2bd2d762c0939eeb63b4bcb2c2508d4f09c5dd8c54fd51fa422d621a848367219f3bde8ab10a9e9a3dbb5e5fc22433ce
SSDEEP 1536:bdcu4XPM3pxqVv3AZWN4pI6PfRYPCf/JKIcAemoa1mAXC+4UKSomSWmmqekWdsXU:SApA34cmI6Pf3JKICnaPXC+BmmxkQbN
TLSH
T1D7C3FACDB6A574624363A5F5002F010BB23AB8AAE44C81E8F189D9E97DB446D4377F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\service_worker_bin_prod.js
Size 121KB
SHA256 ed3803ef5bac39e8b153d283695ee3562398e5d771a6c7fe5d1a85805672ab3e
MD5 aac97879e3f1c5a71cfb46b0fdbb29a1
SHA1 0cb02f7bbcbf207606888361be551e6d682c4c05
SHA512 8878736f8500a668e51e1f543ad7fe13eb7b4e19632918714dc64e952cb1f8400fa2026cfdac9ec757f4a285eacf6ce89f606a395500c56d2f2f39f8a64aa760
SSDEEP 3072:L3zCum5nHBRKbYK2ANj6a/4rxMwDLE2sk:LwB34GASx/DLETk
TLSH
T15FC3E9CCB7A574664363A5B6002F000FB23AB8AAE44C85A8F188D9E97D7446D4377F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 15e2f27afea1823628b04fb9af7e5730924884e69b89b1afa45b327b67585ed9
MD5 c0b518c6b9dcd86ebc2d93de2bbb0eb7
SHA1 637c037c521f304b1dae978c9701b4a50b7b112b
SHA512 79d6721af45f72641888a29304651445ad3a28578486398740286457c603389dc30bd29b66f8cbb3e244037cd4e55421e0de5dcafc2f9ea5d93b0b6d65aed245
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 ccefdc2d816137b5954b591e8954c392e0cf27388fef2e437991e3999d9ad3d8
MD5 efa437b6fe5031994d5917a91c19990f
SHA1 d46a1115227ead4e92346b600c28e9ac72cce96f
SHA512 ab52261f15a3f21728b41b4765da5ec6c9e71051b720204ee2decf6f09ac8a0c9a5c12313d921f232f1e698a7425d34415eca8db21a37f423535806bcdf238bb
TLSH
T1F3310AC7644047BA52EDDAF37F6B0C57DC12210107D4A440599F56E17FEEEC86015478
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 bff87e21fa845d8ce3c266db6d904e9c7a3bf9fc2b95a1f1a5ca375f3fdb045a
MD5 097f67b0d583db3f8487ac27379c7eae
SHA1 18acf62fb9bc4e95899c4597cd72de66b6bef763
SHA512 0b6b323fa14e5b0dd6bb87fce791bbd0b7a867988d8332385ba76a35d93d4dd5b67f6be9be5a69fbdcd5da68c30bc840712daa83b9a0187b727d963dc9a9a045
TLSH
T15E514C54BEF34CB2EBC67C7254E65BF5A564C1E62D407A0C86B9CA1245BDD410CCD003
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 3KB
SHA256 abe4eaa1a6fa423bcef61b423dc72386a9cf1968b1041de5270c56a7780254ad
MD5 8e589c60e0ba95ca1b178bad0a8298db
SHA1 d981cd3f9eb63636471e3bd4c0fd7585460ad6fd
SHA512 e8c7b5d340e698f3b1b42d6c3b7653b666e0add095611c00f502782928eb788070ca977b54b42f9515127861e55138a3cc0f02540f0bc2e44694fb0ea595ee34
TLSH
T196517D1B4B8AC56A0E53770E02E57ED454996C569EF383CC2106E7C0081A99F43EBBE7
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\32.png
Size 1KB
SHA256 06c00fa3cb29713aa4317b352fc1e1e035c0c7720a42f107cf758fbb21eaed0c
MD5 247675501d3cf1f7987fe8e20dc4a994
SHA1 c0630fbc0c9c7c2aec627667b21b5b9add1d7925
SHA512 6b6f5e0feb15ecde82191178df36fcf9cebb762289116b88a466ab31152d6f8e769e97252e3a41f7f538867920866ce12bd60c9c87fbb5019783de0c5158bfd8
TLSH
T1C721DB9786803C5AE71F76BD5402AE9BF92060197254970E1A560A15C93C5D3FD873A0
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\48.png
Size 1KB
SHA256 bebe7c8f23573efeedb8259fd9e866662dfad2c8e974d2715bb5aebdac870f6d
MD5 93f26885517b76f003062053ad718275
SHA1 eb97bbd3de38ad8efd87e112ad76d6a6d78ffda9
SHA512 34f8a81113a9ca950a07c5f5c3511e3f11f8f9e9a2a1040872015064e2146154d4eb31b33d8ee291434535881f82685c0e90c52e76ea731ecafde73771595520
TLSH
T10031F95284AF0C128406F5E5CD57910B7F37ACBA9AC2A589023B7E7A105824D7B6C449
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\64.png
Size 2KB
SHA256 f5fcedc00655f8a9b63b379feb04ef904a64328e9ef79e7a411de5139d398ebe
MD5 18b13f82a338cf91ce3ec3ad9702622f
SHA1 403a48626de0cb33ddea61e6de7c895eb7482bca
SHA512 08a6fac277ffdbbc18c5166032b426e7d8a7856f7dd03ab01938000b28a869d80476017164a6728643ae8908616c574fddd8fabf946bd66b841ef13f5906969b
TLSH
T1F7413AD73E887CDDACB22A746A6175C1F0E846B24687DF44E60D6918CF61C43001638C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\cd2pakpy.42g\ShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst\Crashpad\settings.dat
Size 280B
SHA256 5a2cfe2d2a63bcb642079e62057f556e07a68af4040b7af799de6ef7581eb767
MD5 b1055cab3eb7e18857292f6e1bf0163f
SHA1 c33b4e71d40a7b7b0f58f052ea9bd50c520bdf3f
SHA512 771f233d9877012d9765e9eda7e9eb0ad6a37b41d64cca46dd25addcbe4632b5cafd55b42295e3d13846561381980b8c22d1deeb71a13eaeab0a02db93fb99f3
TLSH
T14FD02200F23E2C30C00A20FC822CBB880F80CCAC02A282CBC30C30C8AC0080383828C0
MD5 SHA1 SHA512 TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst\Default\Cache\Cache_Data\f_000003
Size 66KB
SHA256 3f5d46711fc4ea973b0341fa657e87f1a3893d892977119284ab1450961de8d3
MD5 9d52c3b03e224bb14709737e1cd5061e
SHA1 90e946e11dad09ea0f1936dc158e7dd91d111f53
SHA512 7aef7bdb1cf366fa357920b406fcae175bff2f8b023bf547bc48143f825376b19930515e7c7567c85b7e68fcd29e0cd120fa3c6110d5252699b0e954539e0965
SSDEEP 1536:VhVSVO6QhTyX2jEFts1fxkC+sNi4TkMU6gm9ymK5Mz4fK:VnSVuC2St68J4amcmKiF
TLSH
T10263123E9B2A87C12CBF1DD4851F17090E75486B062FC8DD4745143CAAEAAD44B2FD6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst\Default\Cache\Cache_Data\f_000004
Size 401KB
SHA256 be3d8d00bb4a70c233c41d77ef19ec94388010ed01b3c05cff8427b501759c9d
MD5 1eb01c3c50d6d0d1508b5d4bbf2f89e1
SHA1 8587d9fa42eecf82477f67a5cab473e190a8e76a
SHA512 3f27d01e3a4897343ae63b499821376bf48795ed4ea5d3487a618845e218c483d9c201d60b7fe2485e7ac3246361752e0e795efee663417c20963adc2ef322ee
SSDEEP 12288:BvV0o7xTYGHvlvtDb0jSbuqd9B76Z0xoJ+F:Bt06xEGHvRtDbVfdDF
TLSH
T1229423F0D7BF1804DE0C21136E0A18E6507934E26B7F72C67A75CA7925A6E7103EFA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst\Default\Cache\Cache_Data\f_000008
Size 27KB
SHA256 d2fc1c6ebd88fb175be2c5dc3c27741e32df41e8c05e92184b3cb9ace6753782
MD5 ea242e020e5e5815ec0941667295bd2a
SHA1 78ec8f478a64a4c373db8295d378efa0d6a79684
SHA512 df022556ed72994d5d6ebd480c826ef722812e0b4e00764f74833a24aa6fa8ff1ca4c776fed06ec6823942082926e1a2afd9016589c82298c811031f345989ac
SSDEEP 768:XWm0HR/ESa4tuUsaCGIbZhLLsaETud7yj:GlH04Ypd9xLsLTfj
TLSH
T1F4D2F28F866AC96775CF29143B5D8BD71859F35094483A832F0369D86F9CB3B173B884
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst\Default\Cache\Cache_Data\f_000009
Size 78KB
SHA256 9b8c9105b814adfbdede8637069b1ba79a00ddc11d1e675fbf0b472fb6b20490
MD5 28039095487c6b897b6b9d1376f501cc
SHA1 77b640b656b6acfb7ddaa08eee7710e6a114f92c
SHA512 90e9d260b9a535d539a82771867dc19c37bd204aaeb1d96cfeae428816c5dccc8537101e4a54eb3b6566cb713ac7e2fb190f84d6531f0efb3b2e4a120e35cb7d
SSDEEP 1536:NF89d5MMhmPl/IglPCCcvNpQ1OIHqlpRWXx6bF8yrumPlMEj9Mr:ARtAPl/LPvcvNpgqy6yjmNMEj9W
TLSH
T1027302E425C9C72BAE4155162E7A9233E7B05FDFE5FAC082E61BC5808C98D335712C67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst\Default\Cache\Cache_Data\f_00000a
Size 19KB
SHA256 04de4b822cda39d55bd6ebde97c09a578a4f63242e7cf804977da383fab17618
MD5 646c73cd9bdc03d8c616bfbf868d9672
SHA1 4d93fdb8c3740ac0f32ad437fa68ae1464e7dfb2
SHA512 b7a4460dc6e75d30d559646cb85b56b210fa5326ee948057e4c819432d5bb35634a7ccd9ab334e180a4ed6b00be6b76ba4804e178053b763224a87b1b71108ba
SSDEEP 384:B3N5kjhDv5mbCOcR61oWpQt3QIIuhzTEEr6XDrPFeuCsOVeQF1sKkiXA:Bd5kBhO461oWpQtAGhzQv0u5ZQFGK2
TLSH
T14C92E0AE6C191707B47AFC8498B671E5C4C71DAEA0E22537179BCF774CE0079882293B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst\Default\Cache\Cache_Data\f_00000d
Size 59KB
SHA256 c722c19fc53a8cf11507511be0a0f425d256d0edfaa0c43b9177dbd9d4a538fd
MD5 1fc9d12e079e8053730adb8c5d9769f5
SHA1 6db462ca8de6ccd660bf01e497b886ddbb0ce571
SHA512 96e68c0e4eff5f88287c32c4d29381145245b101af8eec994eebcec35bd39899705f6f74e40f424335160bd5f26e79bcc4772c3320d274ad0ce4c81487866c56
SSDEEP 1536:crMbi15cl7L9+vf6tE68YdwfitnJh/C9UuOqTRt+pyS/+st:crv124f6tEHwFrK+uOqP+p1/+Q
TLSH
T1CF53F12E9CFFA07F2AB0D9EEEB7910F5DE9601BA65009FCC797524431BD61718923908
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst\Default\Cache\Cache_Data\f_00001b
Size 36KB
SHA256 505fcfe97a69fe8c3e8fc858655160738a27738bdd0f551dd59959b119643bde
MD5 dca7b964f5badcd6f6fa7e90d5bc7597
SHA1 05374bf4bd43825203b17f40ed345a5faf99e32d
SHA512 303996534cd3ac11a35ea25e4306dab13fe17cf1c27f4daae90078b983e7c447524814eb56082fd55c123a65f49c9824f145d76fc0a7a67d2b74bd91be301d18
SSDEEP 768:PJOwLgWLIj5HiHzghjBtMwN3wc5U7BBORbAI70RKq1Q:PJdgxj57hAw6PORbAIg8q1Q
TLSH
T1CEF2F20440225A366B6ED1EE58E1E36A21624BE7F5EE0D3D28978F5B373BD4D21E8D01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002c

Path C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst\Default\Cache\Cache_Data\f_00002c
Size 16KB
SHA256 4dd852db06ff143f9d38126264c1ea54cd41d9cd9ed8181dff01d2d490c23848
MD5 21fc722a9fea6a4d3b414d22adc45a95
SHA1 4f332f3b14e5e256050a235e6be576ab7b5b37ce
SHA512 7b42d3557249c743ac97f477a2b4f17fd9c77dac7de3384c67c2a907d0b18f1c975aaab7f1d3ea6221ab6b7d8f8040a83eba041e6eae16114c817ed3b31412d5
SSDEEP 384:20hm3JWH+xKG7WptbJB8IIBlHsmTWqNfOeoC3SHRIPlUvG:2u9+oUWpfSnTs05fOISy
TLSH
T1BB72DFCF9D77947AAA2674FA43594302CC65293C49E944FFB9D0AC4E81B15E21F24C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002e

Path C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst\Default\Cache\Cache_Data\f_00002e
Size 41KB
SHA256 f619896bc4ee1f36eb151c99c1907272e9ca45de718fd2f385dfd4ea54d25f75
MD5 c0c227e5ed3d63bc2c6020e10650e3ab
SHA1 1300445e56ba5f6ffaf4b3a4492d7ce1b87982d5
SHA512 ce97fe1127ae08630bf728edc56d8a7de6da8c9df71eb0a03519414b226d6c8893b07305600df51f2d33210c3635e6dcea082867fbb2d5e02cccac3942c70b9d
SSDEEP 768:S29IndCGXtrNKt4CLTp5P+hImCgZ3e7AYSvP2+r07+7XWGtn4jE6E35MPfLgW1rt:0n9rmvp5P+EAeRSX3R7BozzPfUWv
TLSH
T1E61302589346423460241CFA5A4C635FBAC85C0DEBE8691D30516B7C5D7F5123D7B91D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 a6fd622687cc9aa36c4c87c7fd8a18294adb766822d330c747c2118f7467e7d6
MD5 9495e0797487d792de0be7f92bae8405
SHA1 568ec0f275c97495a497e3af44d023bcac440162
SHA512 48887edf8e326cb3153afc93ada69044b5d5f6934f7c9e0f9ed33ead8b0c6db6d0ce58bb5bf5cad28c4783bfb12f9971e27b803c5f0c7f40b317378cb06a926f
TLSH
T10AD02BFA18A61894ED6F93E218B114E041637C65CD00BD8E50B9B383A8702123507C21
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 8e19ca4331e50bd831479a9c5fc1c938bb2a2b807e73879fa3e7bb7097c8ae6f
MD5 a0ad470fba73215173be6686f2c638c5
SHA1 a2c0dc4bc6186249fb46d4b77f7daeabae644d22
SHA512 b31bfe637ed7f665c615907c574d8d0a74576e1e9ce1e55a597289daf5bdabfba5079d575d1a4094481bae597585b0a05c19850c80b38f97ec5a3769e0997cff
TLSH
T160E0D8B66CE72C54FE1F93DB58B119E441567D14C800AC8FA46AF293A4702152446C35
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5894b9.TMP

Path C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe5894b9.TMP
Size 153B
SHA256 22a6aa8453b3084b914657fe0e452138fa9a7b72c9f52a7625d2a7b14a42bfc4
MD5 f7c3a7def02615f4b1cb76227c1df07a
SHA1 d8b0d878b42382e8c456052654cc72468d6e5a5e
SHA512 8334b2d5472ff64bb400e9d830df0f3fe444bfb1b5074505e0928235674febdc9ff196b313a34d2fe25a3cc49aa635b67f31c11a906bf78180c692746c10249f
TLSH
T19AC08CFB1C6A18009E0A82D248B128E481226C88CD40ACCE806EB283B4302223216C32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst\Local State
Size 4KB
SHA256 9df7ae1e043a760bbd15548c247beb900196b9d75798bff998842a51ad72df25
MD5 ddcc95099a7790a44d07c32ded4946c1
SHA1 923bd0e45139c9c5f11de95b901423a6d9496144
SHA512 a7b0d354062c0a103c131bf8e905a70f8ee4ef28e8432b4ea9851774926295f2d67dfb40eb9cf4cbb8ac07013daf61d8568fc7de5afe55c8f474c56c9edfecd6
SSDEEP 96:jqGNk/sFfGJKUy15dDFkBbPyLdvVxe3pW0eUnEKTBq4a:mGNQbCjFILyY3gqEh
TLSH
T1E88194727828FC2746E57544B88936938E6831B3D941EF54EAD853180CFB75D2B0AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst\Local State
Size 5KB
SHA256 22518c99f1b599e4db016b0c6571eaf7a4749ba3a193c2ac6cd957dec41e3a17
MD5 5b2d30f527cd3652c06bef9370468767
SHA1 d7858c5914eabcc07641a58fb888a7339eb50fb0
SHA512 5280ea8b3dd5800710020eb87105bb35e35840e4693fde46cc596ceb907995bfd86beeed31eeb6cb4e891266cba9d88443f09faffca4d1692b99020087dca5b4
SSDEEP 96:jqGNkwQsFfGJKUy58Frh/cInURoDotov8CDFjBbPyLdvVxe3pW0eUnEKTBq4a:mGNMbvooDUwPF9LyY3gqEh
TLSH
T177B196726478EC2B0AE1B944B8C536536FA42173D885BF99D6E8170C09EB7591B0AC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58878a.TMP

Path C:\Users\Admin\AppData\Local\Temp\hzx2pc4u.dst\Local State~RFe58878a.TMP
Size 1KB
SHA256 9872ec370dab33fa9827d357e1c3dac5d0c904d2f04f510df797d3ad8bea9411
MD5 56781551fccdd62a1cf5b81c8dbf1826
SHA1 41071f57651dd23d545f2b765749e3f2bb71006f
SHA512 992b1f31ad6141bc61cd8284d1b55ba78159f11f75ff04b8601e553f1286d97b4dbdeb94ee50afdfc2aa74e765181dc7a8123d7c2d63d1e28b71eec3e659522f
TLSH
T1F23194B1B8B83D37A8E03681658D37531E706271C181AF9496FC1B180EFBA4D560AC3F
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb\Crashpad\settings.dat
Size 280B
SHA256 e4a7541aeeea62a00ca647b8f95609394bbb2b98fe530d9383046b98ddb19392
MD5 a70857d5bf54d18c9c0667523a2c6ec7
SHA1 61f1103a0911e33cb87637c00b969f9b3bbfeb44
SHA512 f1ed53656b5c83ef543264f8fb3055e2add941395c2305686d93aaf273c1456550d23cd6df03abd90b654939f2fa112d136487aa2ba54bb89ada4215f8bc00d9
TLSH
T1DFD02220B303BC0AC038B23200A3F3000A80EF28800202A3083380288C88A0C088F8E0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 3a179acb248fc7d924d40561061bb0b62c06bc1ab5c864cbf3aac456047d872b
MD5 8b6bef289c44673c44e2360caf4a7288
SHA1 677e08d0925e0f89ad97d412bca244db69340f60
SHA512 893d06b2523a027dde51c49861de44537dca6668a78e3014cb04d99d3404c788a4c2fd47ea7080744eb19d3e21e70237edf073a3bc728822e75ab044356fdc98
TLSH
T15CE068B33EFB1C14FD2E92D3143140A006147C14C805AD8E511BB5C7A1B0311204ACB2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 a06690f2982bd0cf9b84fa78591b00ce43ce9ce2f2aa10cd2e20abc4536b4a95
MD5 bbdb430ce8b667dc2b84b0d03674a302
SHA1 6e91ea380f65b875c465f616654790b6359d08ca
SHA512 600df5bdf6dc71ab3cef602a5677872db324d38e52fa27c66f10221adf7ae7ea9a3f140f46159218da158d83285e7193574e4b77c3e6c976241142ed68456bdb
TLSH
T152D02BB63DBE0C24AC6F86E3043180D802267C54CD45ADCD011AF58720B03232407CF1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe587ea1.TMP

Path C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe587ea1.TMP
Size 153B
SHA256 d37e0d20d4091cc10307af9138fa8180c94cb8f8ac0b0493b84aa32ebdc21221
MD5 50e9c97001b3fb7934978b1a34528075
SHA1 800c812202aa580906ef192faaaa4a2a5369fee7
SHA512 875e4960862f5f75b6ff83b9a1735bc605d6c529f8f4be5617e81d89abf52df22bdfe8a3d19de19bd70c799270f5b1b55a1a66c6de8b19d275692d4157f19f26
TLSH
T121C08CB73E5E0808ED4692D2003184A1432A3C848D48AD8D812FB08720701227112CB1
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb\Local State
Size 4KB
SHA256 86bb556fe692d294b62bc870fb896b2cd4b596aefe618f81ce7192d00b06a6cc
MD5 f1df13e7362a60a05c03107b0a50432e
SHA1 781fedef96cb8ccb3daf5af4cb95e6b26b7f0c7f
SHA512 277c08da64b9eddfa113c09daddf54d518cdd68a7eb8dcca8da7a77c0bafdd3683bb3fc9ddb83905b42995edf374c63c0d9bdb52f151df2077232c6f8d6e84e8
SSDEEP 96:tqGNkfsFfGJjWW1xqDNRB8P4vJOgUW0eUnO1Pq4a:EGNEbfeNnGNg7qOC
TLSH
T17C81D7B26828EC6359E65A44B48A37939E3831B3D902EF45E5D8571804EF34C2B0A837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb\Local State
Size 5KB
SHA256 480801e5c8b09689fb0da1781da578674ed2489e3e1a68dafe16d00353ed00e9
MD5 e0a0176328e8bf04c5be890ac93a6009
SHA1 b902d244476201134a2faa7c6a0697a08c16312c
SHA512 a34de406d01e9a2c28734a3cd63327238075b46825132b07cd308e62780b15234bf3d346d777ad72f845428341690c6b8debf3a34c7c9ef54a9d90026a7ebea4
SSDEEP 96:tqGNkQQsFfGJjWW58Frh/cInURoDotov0WDNyB8P4vJOgUW0eUnO1Pq4a:EGNQbkooDUwPNSGNg7qOC
TLSH
T11AB1C6726478EC675EE2A944B4C637536FA83177D881AF99E6D81B1C04EF38C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58721e.TMP

Path C:\Users\Admin\AppData\Local\Temp\j0zmn2fj.cmb\Local State~RFe58721e.TMP
Size 1KB
SHA256 06dcee62ecfddd32f0e179f14d991fe581412445ce118506e907378268256685
MD5 0d694b677a2f9b4deb3cb41427d15b14
SHA1 196e6d02a455f0870a49e04247bb2473d6b7dec8
SHA512 e730ec3cf03ad49f443a149c5411c6625869e06ab956b1a8dcfa5ae5e55603dc6393509815cf6fc1ef80cb204e70796a6da0e1106cd291f8cd13ad037037e822
TLSH
T1093196B2B8B86DB7FCE24A46B2463B936E383175C1529F4855EC5A2804FB78C5507C3B
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir460_820457743\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

b240e26b-6e52-434e-b41b-d933085c9f7d.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir460_931525559\b240e26b-6e52-434e-b41b-d933085c9f7d.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64ZPTREGWTPCF3LBLZ98.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\64ZPTREGWTPCF3LBLZ98.temp
Size 4KB
SHA256 8abae1fa49d98c736dc273d144c112a72f6efac8dacc2249215622ee46c2cd8b
MD5 99e6e5f0b9bdfcc15610ff2f6e30e5d1
SHA1 821d2988e339098684f31dcdfac6a496a8719161
SHA512 adf79475ead74497baa942b5af27d805288bdbbfdee1ac643214eab38540aa6f778e169fcc02829c5b5e88934bc58d49404fdb6428793552adc026ec511218e2
SSDEEP 48:L1KocdOoSPZ9BJ9zCNYEdLXuHUpL8KocdOoSPZ9BJ9zvYHgdLXuHv2L:LDhzJoZu0lOhzJvYIu6
TLSH
T10891BE11AFD61A56F3F7DA72A5B37721AB77BA455D085A0D018442080C73B089A7FFB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\crashes\store.json.mozlz4.tmp
Size 6KB
SHA256 a80b4c061988116da432d7d972d19107bfeca1c606818e1527b4c7910067a2b4
MD5 8e601a0fb0e73e418f5cfdde6ae5ffcd
SHA1 aac367fa8361f76470c4f3e2fc635882fec4a0c8
SHA512 472de59fa1134cf4378319a8c23b89978ad70f20489cbd4bfec352a529cfdaae4762577b3a564f3c6b49c84b4fcd5ca2a1d3127784e3d1c38ebcb9e0ceddcdb0
SSDEEP 192:EabC71hZ0O59oW+kSGiZO37jAF+ubvIgJ1hlFNU0EEz1WpiV4uyL:Vb+PpkZOLjAFtfJjNUtQ1ce4u6
TLSH
T137E17EF6E98863F34A418C14A0E79F8113385E2774B9D785380EB6B2DCF1A608F19F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 434ec81adab563ac4051561060f433cf0903c03d4b8f6563033ff8d9218804a4
MD5 7951ba72e267706e4066ec464ca093e8
SHA1 69cc38122d8c96f65aadb336a5ad4ac1177d8fe6
SHA512 fe792cc50cb10a7dc2b9cd32a54750260e10bdfc60e072e5e89ee7a6a09d1dd0d0dd48407b3f28db3b708b0dec7f959c47458e4593c3307cf2513988446981e2
SSDEEP 192:F6mOv5zboPyZHLfyjWo6mKo1d66JozGzgCl6mc0dz:F6dbo6ZHLfyjWhhCd66JozGzgC1jd
TLSH
T110E10EA4EA28463FC804127BDDA61F410F36399B9C4E3F19359D640C2D5B2DD7A8E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 3c60924346d36abffb88fb1bd9d269e8a1d213ab3a9394e9fb1846fdac733f1e
MD5 58a0e1381feb8819a31f2590bda4c0b1
SHA1 3ad06f5753009ab4f86a51a23a1fe6c6604e05ad
SHA512 8bbde9f2119857bebd90f92ac0422042a3570928bb3d58f8600284aa8abc43c9e2853beb1d165e4a7936743a728ca863fc16c2679a4dec6300b5332ed97a7797
SSDEEP 192:U1d66JozGzgCl6mc0dj6mOv5zboebHLfyjWKI:ed66JozGzgC1jl6dboebHLfyjWd
TLSH
T12DD1CC64FA29463FC805423BCCA61F400E76795B984E3F1932DC740C2D5A6DE7A8D27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 660700bad282b8c32d2a8288d124a4f50b44fa7a3e9730253d2585a751e755ad
MD5 d8ea9a37c5fa06b9ea945b1195152b3b
SHA1 15f334d8a2256c66c9d25b9db3fa65fa7244b362
SHA512 206b03f8377b578fd933eb4ef070ad36bb2973f9b6a165dee2eb1822561e655ea80415748e3d112d29adc2c3786c30404207334f5a67fb66f447bdc9ec85458d
SSDEEP 192:PH1d66JozGzgCl6mc0d46mOv5zbonbHLfyjWo6m:PVd66JozGzgC1jq6dbonbHLfyjWh
TLSH
T155E10E64EA28463FC804523BCCA61F410F76395B9C4E3F19369D640C2D5B2DE7A8D27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 0737c7bea6635181f71878f953108d24ae55e90898297f7f632a6b7a8dd9cdf2
MD5 49de2c791a093218020d50ac31b5790e
SHA1 5a6b03ae77e2998d5f08c2d531e24547bbbbf5e9
SHA512 9d683f7a157c12776818b81455719639c7cf4e11bd528b09af3d68f44437dd18e0cd249100bad27ceff3fa49cf379ccd495172adfe2dffc620be866d66183507
SSDEEP 192:mT1d66JozGzgCl6mc0dh6mOv5zboP3bHLfyjWcxI:mxd66JozGzgC1jf6dboPbHLfyjWb
TLSH
T113D1DD64FA29463FC809023BCCA61F400E76795B988E3F1932DC740C2D562DD7A8D27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 ad5a94ab37481f2956b8518cbc6e8b531428434f927a2d768776f3cc878ce4ec
MD5 602c4e6940d3963d9134ac3e3f5621da
SHA1 20f869fbfc2e73eb8fd4ac57916c04d4ee45af31
SHA512 c985af2566fd3cb1201abd5049e5743bc413a8080f39577f3c5e401263b3cb70739e14cd0a6df244f8d1e66ace0113fb288d0a19eb6e40a336eb96bb9ef587b2
SSDEEP 192:B6mOv5zboPyMHLfyjWo6mKo1d66JozGzgCl6mc0dz:B6dbo6MHLfyjWhhCd66JozGzgC1jd
TLSH
T1DEE11EA4EA28463FC804523BCCA61F410F76395B9C4E3F19359D640C2D5B2DE7A8E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 d22418b72bab6ae9eea0eed50b9a5182ce09dc96f11b47704f8302c0b509a41e
MD5 0b380eb1ec544b1bf1d2459900f50d40
SHA1 10bc15f519606484a9b6f0afec9090b17aa686c6
SHA512 84eb8a269772de35149c9dea6c53b8eb98288f44ee2a6ee6308e1fc67b562ac4e302cda49eaa699e4195a3c50a847354ab827b0a4f8b6fd707ba65bd1f95ff26
SSDEEP 192:Pso1d66JozGzgCl6mc0dr6mOv5zboPyZHLfyjWo6mQ:PNd66JozGzgC1j96dbo6ZHLfyjWhz
TLSH
T1BAE1FDA4EA28463FC404127BDCA61F410F3A399B9C4E3F19359D640C2D5B6DD7A8E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 9e7819bf56f76860641edfa6ee8b1909e7f01d4eae212c64b546e7eda92f8282
MD5 9b43c148741744e518f4a62ce3858bf1
SHA1 44a8bd15f0a2b36565f65be487c335021c23d323
SHA512 55faf44a761f0b35698cb75e4559915faa9b3ef96bb06bd1d4321ccb605f5ecf2fe34025f0880c8c60fec809c123558eadf5acc3f9ee186686ba80f1c04bf11e
SSDEEP 192:a6mOv5zboP3ZHLfyjWcxHG1d66JozGzgCl6mc0dz:a6dboPZHLfyjWMgd66JozGzgC1jd
TLSH
T197E1DE64FA29453FC809023BDCA61F400E75799B9C4E3F15329C741C2D566DD7A8E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\events\events
Size 1KB
SHA256 6ae5e8ec8ce787edde350b39dc4eb02696ed9a615f634ac7fa1caada8c1c6e97
MD5 e61ea69e2cf0c86b64c0668263e0cc19
SHA1 45f56e01bbd302e833cce6ad6d95d06129f7b1d8
SHA512 20d50a9ef1ce7c2c5f7578232b86bc05ae821a5d34fab868c1f1e69d9ae95a9b3f7247390691f7745ee551e0969bc555e3bcc24eca47abca3b6a924339a0fbc3
TLSH
T112217C9C39F94D6BAEC7E25CB441028E63524E0706C75D430D22DECDCD95AD9F2AA43C
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\events\events
Size 1KB
SHA256 fdb2860e3c0283e6edf4e95c4888213109fabc4687ab42271ca46850e46fc662
MD5 0091907424c2a16e4959a996bf0ada14
SHA1 ba2a190e38b84741ee5558f0c408dd55e1f39525
SHA512 e6c4231901d0e389ab5dc29869f447f80ff3294b1c7dab5506038ec302047c95c3afc061d8970ecb63198a72c5203840f6d25cf5c2a2fb0c8185f1c8f78fad97
TLSH
T1B9217F9C39F84DAA6ED7F29CB441018F63914D0605C75D530D22DE8DCDD5AE971AA43C
MD5 SHA1 SHA512 TLSH

Submit Download

1bd4298c-0452-4774-bb40-6c555b02a018

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\1bd4298c-0452-4774-bb40-6c555b02a018
Size 235B
SHA256 7db4f88d01562cc1edf5cbdf4217165bd10a6bd72380ea03209c8c9a9beb4fa5
MD5 4aa4ff80fe5bf0360692026f479a242d
SHA1 ed121c802ea575c82d207d957f23620397bb2fd5
SHA512 158ae42f8a6d40aee413adf7b0b8a542e1b8ea4fcf1b5574e7dc6bba7f436fb99942f4799acc74bafab369225c77e0a0feb33b9dfc3fe27a35ce0098ae400ff2
TLSH
T16DD0978014AC6B5C08080F17F0E068C63444CC3750649860E6A08978AAFC9C9112288B
MD5 SHA1 SHA512 TLSH

Submit Download

5581a587-10f5-4eea-810a-345aef6268ac

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\5581a587-10f5-4eea-810a-345aef6268ac
Size 235B
SHA256 940f555f663467d263d0ccbe67c1f45765d1fdce1443bd2a0be9204e352a01f8
MD5 da1be16b5805d9616c445a8e41050b4e
SHA1 5afa6596db2a73bce5dfa2817e1390bfea628983
SHA512 35162bb269cab4986926a3ffa41364f1752235c06db1d62e1a1ea3afc9e7c29663b6b2a47984e442181fd10daaf36780b1f696c37a96da79ce77fa1cdc44b839
TLSH
T1E2D097C42C98A73D08240F0BB0B428C671888C3350B068108A620134DEFADC84251A36
MD5 SHA1 SHA512 TLSH

Submit Download

56bb923a-9468-4298-b84d-af40a5b651ef

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\56bb923a-9468-4298-b84d-af40a5b651ef
Size 2KB
SHA256 0ef534d4cb37057895c2055bc0551f01000403a0eaeac72ba10405b79d31b0df
MD5 07509c1056302cffe65c4ea9f4746487
SHA1 29510bea7765e41fc622e8b21d7c3e91fff1f040
SHA512 8475fbb40d16ac5a58401ec14098cd00196f5ea5e7b790d6a060f86ecf57c3d7fe7be898848f1c4e7b37c40fc747da103aeb7207d4f9b47cfa9e21a8c461812f
TLSH
T1C441335C35784C7B4CDBF25DE482378E57608A1300C618532E51DE0CCC99AAE736A62F
MD5 SHA1 SHA512 TLSH

Submit Download

708e47bb-0cc5-4560-83e7-7899d136964d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\708e47bb-0cc5-4560-83e7-7899d136964d
Size 3KB
SHA256 156fdc5f7a4b32f7d011622b637613677cbce44e329296843f1f39af5470291f
MD5 c3a2d407c43b2346f849f1f10eaf434a
SHA1 425930a63a0392aff76f570fad6fc52a5649c77d
SHA512 a223d8065cfdce9150459d1aacce7f55cd57d818f730a0235688bef351371ead9cc57a2590955623343bda09e25641a662de5719846d230e282039a709bfaa48
TLSH
T1316154B1956469738FECB040A37B79458BDF33CF584B0BCD259D8D6446A482847CB36B
MD5 SHA1 SHA512 TLSH

Submit Download

78e63548-df07-44ad-bec3-4a4254be80e2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\78e63548-df07-44ad-bec3-4a4254be80e2
Size 3KB
SHA256 700ff4f5d75de9138ca43879b377bbd9e990264ae120ed15dbf134e70ad81698
MD5 4ad819b884fbc6848106a7d37b7c1152
SHA1 36f5212f8b55a4ed3fa838a6ee698262ac2a1b61
SHA512 0c85ce2d5ddd464db44c4f098f945be13efd75e0d4b46be13b31ccc2c74b015e379eedb79e22add487a08df48cd3ebf0374eac2f43994001c869a88eb7cca036
TLSH
T12E6175A1955469738FECA040E3B77D418BDE33CF584B0FCD21A99D2842E886887CB35B
MD5 SHA1 SHA512 TLSH

Submit Download

7c2c0d9a-094f-4b99-9f51-92f1930fb0cf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\7c2c0d9a-094f-4b99-9f51-92f1930fb0cf
Size 3KB
SHA256 d851e9a1424f9297eb33bbff6d8a40051d05fdedf7fc5c593058918273f2df13
MD5 84267d0b98f1477175262bbbda92c108
SHA1 d076c62a9832f0eb56894e3ae7b1cb4cba075735
SHA512 a59f49fa21410d5881aeb086e251b260d40c184585e4018c93767d99682e61176603c651411f946a1b3aa766b38ea6400744e4be086ee16021eaf26062d1ec3d
TLSH
T1B661A6B0966469338FECA041A3777D418BDE33CF58470BCD21A99D6442B88688BCB35F
MD5 SHA1 SHA512 TLSH

Submit Download

80a55e1f-b27d-422c-b272-505c36e8295f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\80a55e1f-b27d-422c-b272-505c36e8295f
Size 3KB
SHA256 071805b7c302f1ac7e5917ba6b3faca2c9dafc5d4f72ea94d22f159b502dcf7d
MD5 7d537072b1a9859a0c9aaf560417a49a
SHA1 0a28f7e3d8df0988d5fc2ac0a4e6cd001a352f2d
SHA512 85de3332d070105774d61e94e2357cd23e0b0032c10d89ce89d5275e2ed1d6fb07c23250ce3995d8cc34079632676dad005e0f796c8e5990f41505afae39cac0
TLSH
T11B6173719554A9339FE8A040A3777D418BEE33CF58470FCD25A9DD6842B8468478B35F
MD5 SHA1 SHA512 TLSH

Submit Download

8d87d50d-a978-4779-a230-e5312ddf9743

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\8d87d50d-a978-4779-a230-e5312ddf9743
Size 3KB
SHA256 68c4f911ae6912c669e16324b63fb449e0b3881d6d8fa87f93064802b499a4c0
MD5 5f6401406debf87cabb8218674af5bdc
SHA1 4281aaf0fb1cf8a024aab05ec1d4a4562b9a692a
SHA512 2940acfc4f687408ad3444640a024d32289bb9093036bbe00762e22a1d3b026953fb8945a7371cb7c24d1e6782a06295096aae385cb2641986c89b3abc42b68c
TLSH
T1346152B19554A9338FE8A041A3777D418BDE33CF584B0BCD21A99D6846B846887CB39F
MD5 SHA1 SHA512 TLSH

Submit Download

992ce3cf-17e5-4bd7-b22e-0ed8bcfa43f6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\992ce3cf-17e5-4bd7-b22e-0ed8bcfa43f6
Size 235B
SHA256 396f4db43e703bf7aa956a0c3e9b980a2ad06c363b03897263fb2cc7a1ffbbe1
MD5 8b9cb5288d94d60c0be804bfde3a983f
SHA1 2d6c54e6c56fa4c99bbf4ecea254101d53da01fb
SHA512 d7082f3ba101eed7684bc409b491a391cb4d659a258c75d43bf8a009c38c3437b109924438852b7ff1d59fabb5367a57b968d1cacb0a6803a10ded1b4781f6e2
TLSH
T161D097802488772C0C205F0AF0E06CCA30894C3724A86850CA520A7999FEAC801A281A
MD5 SHA1 SHA512 TLSH

Submit Download

9e2b9883-5a0a-46fa-b964-b20594f484e6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\9e2b9883-5a0a-46fa-b964-b20594f484e6
Size 3KB
SHA256 07bd5bbd588f03033a989e85e408c2f26fd1d6805cde0778a8e8b11032b900be
MD5 ec2972d81da49a2083985b1dc6afadff
SHA1 3395f3d4823b9e92fa719e90aa23aae2c1b61f8b
SHA512 5da26f538e88a772c304cb2ba412b174d8acf4c3fa1923b0239bcf638bad38fc6fc15c8d868ef8ee46f09c9c44076f5378e4da3a572b71cf28c35f7ff8470a25
TLSH
T1116162B19564A5338EECB000A37779459BEE33CF580B0BCD21698D6446F8868478B35F
MD5 SHA1 SHA512 TLSH

Submit Download

a094b17b-e6a9-4194-adb2-cc00e2bd64d3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\a094b17b-e6a9-4194-adb2-cc00e2bd64d3
Size 871B
SHA256 d0b418ee0629d9fe573b58c243ed71a538a2144854563bd2eb025086ffd757f7
MD5 7430115a7a52391a51af6104e6e4d649
SHA1 89cd4748f86a0c735d48263f889cc867c7fb1db4
SHA512 3cd37ad30c40228405d6460f55011cb842499eab7cd4cd3ab51b759939b6c6826a9069fc882be9e381c86774b10e21941488771f127d437050c7199c22c6c75d
TLSH
T1FE112F819A64B5B38C29D257C89537028BF47523C0CA48043EA91E085EBE92EA3A634B
MD5 SHA1 SHA512 TLSH

Submit Download

a9170f2e-f49c-41fa-8d94-9778905dddb1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\a9170f2e-f49c-41fa-8d94-9778905dddb1
Size 16KB
SHA256 764cf07905b62614e3efd2d33e6accce3de9e146f69111e713e4f584d91d6b59
MD5 2ace8b684f2e8c4857adbba6f7e5f0b2
SHA1 85031e29361b70b2547deffbf0ab8b53a1e487bd
SHA512 2022f7a6985933ee0d778d3a2f26ee173c0b14c50400020ad8b07ac045bc4f5f58968ea001d5d940cc357003db62b6ed47bd8b28a219dd9fd98ff20010321464
SSDEEP 192:a3oyzjq19BAD80Z89iRtDLLonzO/D4qszsWWy4hQvol2Fqr7UTDKuFJIGu791EDp:xykc80O9iRtDPoneC4UTbu7XQ07/5LNU
TLSH
T15872D956186044BA8251E369D4ECBFC3E5F62CCF4C419FC99BE4BD086DDA06E112788B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ade1f2e2-4d91-4af3-a405-f348149897bc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\ade1f2e2-4d91-4af3-a405-f348149897bc
Size 896B
SHA256 78ada2ab39409b8528fa7a4540ddf146e59564e8786de766f7664f444201c5d0
MD5 88547192757ded999f2728fb56d4af65
SHA1 ccda30188349764482a2dd0afa7416613ef7c571
SHA512 6a67a47004dd2e0f8c66189f8d7e7793c6a2f35f52ed665aa18614fb66979edd839bbf39a314da26b13d0f02ab0ad82ec3b3cde9eb27fd282372086bcceddd74
TLSH
T15D1100919A2475B3CD29E257D8907B434AF47A2380C60D083F606A085DFA52E97A730B
MD5 SHA1 SHA512 TLSH

Submit Download

b25d6e10-9eb9-45ad-908f-5d2d6f510a2d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\b25d6e10-9eb9-45ad-908f-5d2d6f510a2d
Size 3KB
SHA256 57f46cca6ebc117c5292b535f52dc5484f18b300b11c8b326f9455c7711f44f1
MD5 c5d4c5a683bf6e5deec92386399f23dc
SHA1 790732a20da56d4f0024eaf2e2d250551bf319f1
SHA512 7c557aed2b04f868fed3fc686715d6963e2028ff3a583804c6130b351a036574cfb0c8a8774f2c87a09ec982344b1cf25e17ab7480471cad6603163a3140e279
TLSH
T1FA6186B1956469738EECB000A37779459BEE33CF584B0FCD256D8D6406B8868478B35F
MD5 SHA1 SHA512 TLSH

Submit Download

ce05f3c5-adc0-4881-975f-30c80ded80ad

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\ce05f3c5-adc0-4881-975f-30c80ded80ad
Size 3KB
SHA256 ce11895e8e544f11d09d23629021ae1e69817684ef237783fdb27cd780844dbc
MD5 531fd51ba1d121a7e94eb2224cdf84a3
SHA1 fd190829dfcb8d6763501eac8c13edc5535ff913
SHA512 8d5865711cfac35c029d1a8bdaf9bdfa6811a82aa47c03b89b5eeb65288b8f49005ba221c6f00c94cf90ec1151027de4fcbebd54c367b9eedb2493aba0fc4779
TLSH
T1266163A1956469338FE8A041A3777D458BEE33CF58470FCD21A9DD6842B8468878B39F
MD5 SHA1 SHA512 TLSH

Submit Download

d39d074d-e841-45e3-93ee-eb1c431e37cd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\d39d074d-e841-45e3-93ee-eb1c431e37cd
Size 886B
SHA256 0a488850463e7d091dafebaa73c89ea05e203b952366e60797bab0c3625f4509
MD5 6e1961d0d9788b8c53b5eec4745e9ad6
SHA1 e4e10b03cfe809cda07c69d9579829185ea105e0
SHA512 0460b2783f5236d7fd650f7e285c717a06d45e7f092317bce5ccfb8904bc50977d3f2d0412e184f80ca460d06d5052661c2194d5115973b1017377f561990af7
TLSH
T1491140908A7479B38C28E15788D137428BE87523C0C60E083F515A085EBA92E936670B
MD5 SHA1 SHA512 TLSH

Submit Download

d6dfcabb-3599-48f8-a1af-35931fda5a07

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\d6dfcabb-3599-48f8-a1af-35931fda5a07
Size 883B
SHA256 e8cd2a6f4b65b9a1f89ea507cb9061370b493c6cc5ead378a9f027506891729c
MD5 93caa2383a25bb8a7a66683c68654267
SHA1 32a973bf66bd8bf5dc9d74e1e602fa89f7541e38
SHA512 8842df68346430429c01aa9d2219443aa5c8697ed3aed03f257fc07d3f2a1385e88ab7bdaedc0c7064a718797c5f5edb071470716c04cfefa4f2661873726038
TLSH
T13F112381EB3479B2CC78D25BC89137019FF47523C4C645083FA159085E7E92EA36B70B
MD5 SHA1 SHA512 TLSH

Submit Download

dedaf077-59af-485e-ab18-91f6dff7d1de

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\dedaf077-59af-485e-ab18-91f6dff7d1de
Size 235B
SHA256 3766bc05ddba665cec8d59dbd91511885109ee59378da3ca2dea7c2a943aefbe
MD5 201721a4b7b4fdddcc765bdaa65e1999
SHA1 e415420f7028193f599bac9454c1a86309bfafd1
SHA512 5e22f2593dcb65d3dee4f4e2490ecdc646a5fbe173b9899199a28153dd0d86c784ae42a53f46b76ad6f67e73f33b64bfe5be9dade1b92e799f281f57d42a30e5
TLSH
T19AD09780949C631D48050F03F0A06FCA30888C33A8B0B820DDA102388AF8AC442A281A
MD5 SHA1 SHA512 TLSH

Submit Download

e7ead178-63bd-4efa-8e6a-5e40d6381207

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\e7ead178-63bd-4efa-8e6a-5e40d6381207
Size 2KB
SHA256 71b0cf3aeb040d6fc830965a76ab267661fdbd379948a276ae300a071a0fe7ca
MD5 17b7f46e62fc72ec901b22e3f29e2b3c
SHA1 877c1730dd21ec6c4a4bc57bf0f156c041bf08c0
SHA512 87777839ac0ef4f3855444800c2a8143a5bc81c5b63a4c70393818b8e5294b596af7ee7c972280b7b25cabd04a0d0952993208b837237bdd68f950ca64b4c388
TLSH
T1DB4136A835B84CB75DD7F15DD482364E57A08A1300C65C832E21DE0CDDEA6A973AE53B
MD5 SHA1 SHA512 TLSH

Submit Download

f5db948a-5409-42e0-817e-f37a531e833e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\f5db948a-5409-42e0-817e-f37a531e833e
Size 3KB
SHA256 df9b8593e2e3b20af7c01d00f62feff6b302fb3f56db16e007e8687ca6bc3e8c
MD5 655fd0d41fe8e3e64bc81edd48d66f97
SHA1 75bc9d967f2325578476073d531f8e38ed4eb9bf
SHA512 58c5ce9590ec082ed4ba65aa9dc9ef1aa4da12ed410300550bf9f48f216ed08364621cbe881523716def7508c882c1e44d7dd8ba68d59ebaefc705f4705105b9
TLSH
T1A96144B1956469738FECA040E37779458BEE33CF584B0BCD216D8E6446A8868478B35B
MD5 SHA1 SHA512 TLSH

Submit Download

f5e43e04-26fc-4f74-a37a-158d64e7ae3d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\f5e43e04-26fc-4f74-a37a-158d64e7ae3d
Size 3KB
SHA256 2248c3c11b0af22db2a7539845e583e81b235e0965a3d3be55a360e232d5f259
MD5 5f53a12f45c2d09afd6bfc79aaedd373
SHA1 f9c98dde3eafeb652f92217fa3ea44fa762680e6
SHA512 ff477978d62ba11f00e7273c7e7b1885e5764f3fec56f6c5302ce1fa65e6f1976250beac1b7b7e59e34f3b460bb2bebe86881932ca504e37bb1eb3c4a0c9fcdd
TLSH
T1206153B1A56479738FECB040A37779458BEE33CF58070BCD21698E6846E8868478B35F
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs-1.js
Size 6KB
SHA256 1551d528494670695092ed240d41fa74f2669a839636f79166b4aa9bc7cc12af
MD5 175afc968c328c0f1c0bd56c1b17ebfa
SHA1 70d3efacc3c3662c3ac6673c4a0774819615f3dd
SHA512 e8e905884ae19226f7a3e3ae6d805ccce127c034d0833a0ad28851b75862591e1b05753c891791623a2a669e7bd3dc945e5adba6b670833fe6afc418107947d9
SSDEEP 96:xH89UTUfqGq8fCqVTe1zSHSSl8pdv9jwlcnFIH6OBw88n8L4cnoV8YLFHn:2CR8fCqVTeKSSGm6OBw885yuH
TLSH
T19CE12F7895088B7F78B677ACAC688C715AB2413B77BF68C350B94484051CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs-1.js
Size 6KB
SHA256 f12116b3036022b533912d8c03148807e6227e1ae4588eef0f85edf96093d933
MD5 f18c2ed893c9e7d327bf7d92dfd2407d
SHA1 c38d3743554ca9d0c7f456b696d8b56a7d5ba84b
SHA512 c4c529cec6b6768c9b1d27f26c0a546ded6f48aae81c572dce489ca9c4b5d1bbf30a4f2d50fbd6f614d53ae33ab11f6ba85bdc6b1d15e9d86b808c5795ef5280
SSDEEP 96:xH89UTUfqGq8fCqVTe1zSISSl8pdv9jtnFIH6OBw88n8L4cnoV8YLFHn:2CR8fCqVTe1SSGo6OBw885yuH
TLSH
T1EEE12F7895088BBF74B677ACAC688C315AB2413B77BF68C750B94484050CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs.js
Size 6KB
SHA256 7ed60b576334e06d04a9bde122d249450054686ce2ec95023bc327c0906da0f7
MD5 a54c19c1853af01be3f95acce35e062d
SHA1 c0ff5be3cdce3eccc34ef60577c05c9730e647cc
SHA512 be11c09f6c98eea937c33d134b65778f6f9fc158696528d2cf5830230e89672d31351cf19b9d58300945b31dd9eabbcaeb47c11207401c83cfaec61e646e308a
SSDEEP 96:xH89UTUfqGq8fCqVKjfnjz1zSpT+SSl8pdv9jOnFIH6OBw88n8L4cnoV81FHn:2CR8fCqVYvoT+SSGz6OBw885y3H
TLSH
T1BCE11E7895088B7F64B677ACAC688C315AB2413B7BBF68D750B95484050CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2320-135-0x000001DDFF8A0000-0x000001DDFF8AE000-memory.dmp

Download

memory/3228-243-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-196-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-258-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-257-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-256-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-255-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-248-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-247-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-245-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-244-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-293-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-241-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-240-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-274-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-267-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-259-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-1110-0x0000000001360000-0x0000000001480000-memory.dmp

Download

memory/3228-1111-0x0000000002E20000-0x0000000002EB6000-memory.dmp

Download

memory/3228-260-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-254-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-251-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-249-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-250-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-252-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-253-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-246-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-242-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-239-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-205-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-210-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-224-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-214-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-215-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-217-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-216-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-213-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-206-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-208-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-268-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-281-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-294-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-298-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-207-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-204-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-184-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-269-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-185-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-194-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-189-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-270-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-271-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-190-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-3-0x0000000000C60000-0x0000000000C61000-memory.dmp

Download

memory/3228-266-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-192-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-193-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-191-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-186-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-180-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-178-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-155-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-163-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-164-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-165-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-156-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-157-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-146-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3228-151-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-150-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-147-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-143-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-144-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-139-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-136-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-137-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-272-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-273-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-15-0x0000000005860000-0x000000000587E000-memory.dmp

Download

memory/3228-278-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-297-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-296-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-14-0x0000000006C90000-0x00000000071BC000-memory.dmp

Download

memory/3228-13-0x00000000064C0000-0x0000000006510000-memory.dmp

Download

memory/3228-12-0x0000000006440000-0x00000000064B6000-memory.dmp

Download

memory/3228-295-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-3878-0x0000000001360000-0x0000000001480000-memory.dmp

Download

memory/3228-279-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-280-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-285-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-11-0x0000000006590000-0x0000000006752000-memory.dmp

Download

memory/3228-10-0x0000000006310000-0x00000000063C2000-memory.dmp

Download

memory/3228-9-0x0000000006130000-0x0000000006196000-memory.dmp

Download

memory/3228-8-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3228-7-0x0000000005910000-0x0000000005EB4000-memory.dmp

Download

memory/3228-286-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-287-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-6-0x0000000000BA0000-0x0000000000C5E000-memory.dmp

Download

memory/3228-5-0x0000000000BA0000-0x0000000000C5E000-memory.dmp

Download

memory/3228-288-0x0000000000EB0000-0x0000000000FB0000-memory.dmp

Download

memory/3228-289-0x00000000061A0000-0x00000000062A0000-memory.dmp

Download

memory/3228-0-0x0000000000BA0000-0x0000000000C5E000-memory.dmp

Download

memory/3228-3866-0x0000000001360000-0x0000000001480000-memory.dmp

Download

memory/3228-3868-0x0000000001360000-0x0000000001480000-memory.dmp

Download

memory/3228-3870-0x0000000001360000-0x0000000001480000-memory.dmp

Download

memory/4060-423-0x0000000000370000-0x0000000000371000-memory.dmp

Download