phantom_stealer | f350549e93d794a656c42232bbc069781cf30a88ab3cb687a12a9366796a01a2

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 13:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f350549e93d794a656c42232bbc069781cf30a88ab3cb687a12a9366796a01a2.exe
Size 2.4MB
Sample260508-qpr2msds7r
SHA256 f350549e93d794a656c42232bbc069781cf30a88ab3cb687a12a9366796a01a2
MD5 4b5a90baacd920c024174df168b9948a
SHA1 2ec632300987285c0a9d955ddc340b376c3cb3a4
SHA512 a57599b1ef62c8d869d8e20e989274dbc2ab311c29443029bb9c58e3ff42d6e7a24bef6bee07161ef9100d05fdb4fa2d9c25c4878e07e6c8d3f1a875482f4b49
SSDEEP 49152:WmUzGl6vCmQ2IkDdwStD6d58XUx3ZzictAxV62qgbXOr6ROBNPejVcM:fmIAkJobV62qg6uROBNPeV3
TLSH
T1F9C5BE04F3E216BBF6A78730C6954336D671F4C017A9EDEB0255A41CAE3B7E26636360
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery phantom_stealer persistence stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.privateemail.com
Port
587
Username
[email protected]
Password
abacheke2

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
mail.privateemail.com
Port
587
Username
[email protected]
Password
abacheke2
Email to
[email protected]

Mutex

Z2TW46CR6IVTAQDH4WF2

Attributes

anti_analysis
0
cb_enables_ssl
1
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 3 IoCs

resource	yara_rule
behavioral2/memory/1044-1-0x0000000000BB0000-0x0000000000C6E000-memory.dmp	family_phantomstealer
behavioral2/memory/1044-5-0x0000000000BB0000-0x0000000000C6E000-memory.dmp	family_phantomstealer
behavioral2/memory/1044-7-0x0000000000BB0000-0x0000000000C6E000-memory.dmp	family_phantomstealer

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	icanhazip.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1464 set thread context of 1044	1464	f350549e93d794a656c42232bbc069781cf30a88ab3cb687a12a9366796a01a2.exe	80

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3252	chrome.exe
4212	msedge.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	jsc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	jsc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227204077963162"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2122505878-652277452-2375749442-1000\{95A10464-294F-4559-825F-85350AD90D37}	msedge.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
1044	jsc.exe
1044	jsc.exe
3084	chrome.exe
3084	chrome.exe
1044	jsc.exe
1044	jsc.exe
1044	jsc.exe
1044	jsc.exe
1044	jsc.exe
1044	jsc.exe
1044	jsc.exe
1044	jsc.exe
1044	jsc.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
1044	jsc.exe
1044	jsc.exe
1044	jsc.exe
1044	jsc.exe
1044	jsc.exe
1044	jsc.exe
1044	jsc.exe
1044	jsc.exe
1044	jsc.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	1044	jsc.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
3084	chrome.exe
3084	chrome.exe
1676	chrmstp.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
1016	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5332	firefox.exe
1044	jsc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1044	1464	f350549e93d794a656c42232bbc069781cf30a88ab3cb687a12a9366796a01a2.exe	80
PID 1464 wrote to memory of 1044	1464	f350549e93d794a656c42232bbc069781cf30a88ab3cb687a12a9366796a01a2.exe	80
PID 1464 wrote to memory of 1044	1464	f350549e93d794a656c42232bbc069781cf30a88ab3cb687a12a9366796a01a2.exe	80
PID 1044 wrote to memory of 3084	1044	jsc.exe	82
PID 3084 wrote to memory of 3440	3084	chrome.exe	83
PID 1044 wrote to memory of 3084	1044	jsc.exe	82
PID 1044 wrote to memory of 3084	1044	jsc.exe	82
PID 3084 wrote to memory of 2064	3084	chrome.exe	84
PID 1044 wrote to memory of 3440	1044	jsc.exe	83
PID 1044 wrote to memory of 3440	1044	jsc.exe	83
PID 3084 wrote to memory of 3252	3084	chrome.exe	85
PID 3084 wrote to memory of 3016	3084	chrome.exe	86
PID 3084 wrote to memory of 1796	3084	chrome.exe	87
PID 3084 wrote to memory of 2512	3084	chrome.exe	88
PID 3084 wrote to memory of 3960	3084	chrome.exe	89
PID 3084 wrote to memory of 2004	3084	chrome.exe	90
PID 1044 wrote to memory of 3960	1044	jsc.exe	89
PID 1044 wrote to memory of 2004	1044	jsc.exe	90
PID 1044 wrote to memory of 2004	1044	jsc.exe	90
PID 3084 wrote to memory of 2368	3084	chrome.exe	91
PID 3084 wrote to memory of 1032	3084	chrome.exe	92
PID 1044 wrote to memory of 2512	1044	jsc.exe	88
PID 1044 wrote to memory of 2512	1044	jsc.exe	88
PID 1044 wrote to memory of 3084	1044	jsc.exe	82
PID 1044 wrote to memory of 3084	1044	jsc.exe	82
PID 3084 wrote to memory of 5108	3084	chrome.exe	93
PID 1044 wrote to memory of 2064	1044	jsc.exe	84
PID 1044 wrote to memory of 2064	1044	jsc.exe	84
PID 1044 wrote to memory of 3440	1044	jsc.exe	83
PID 1044 wrote to memory of 3440	1044	jsc.exe	83
PID 1044 wrote to memory of 3016	1044	jsc.exe	86
PID 1044 wrote to memory of 3016	1044	jsc.exe	86
PID 1044 wrote to memory of 3252	1044	jsc.exe	85
PID 1044 wrote to memory of 3252	1044	jsc.exe	85
PID 1044 wrote to memory of 3960	1044	jsc.exe	89
PID 1044 wrote to memory of 3960	1044	jsc.exe	89
PID 1044 wrote to memory of 2004	1044	jsc.exe	90
PID 1044 wrote to memory of 2004	1044	jsc.exe	90
PID 1044 wrote to memory of 2512	1044	jsc.exe	88
PID 1044 wrote to memory of 2512	1044	jsc.exe	88
PID 1044 wrote to memory of 3084	1044	jsc.exe	82
PID 1044 wrote to memory of 3084	1044	jsc.exe	82
PID 1044 wrote to memory of 2368	1044	jsc.exe	91
PID 1044 wrote to memory of 2368	1044	jsc.exe	91
PID 1044 wrote to memory of 2064	1044	jsc.exe	84
PID 1044 wrote to memory of 2064	1044	jsc.exe	84
PID 1044 wrote to memory of 3440	1044	jsc.exe	83
PID 1044 wrote to memory of 3440	1044	jsc.exe	83
PID 1044 wrote to memory of 3016	1044	jsc.exe	86
PID 1044 wrote to memory of 3016	1044	jsc.exe	86
PID 1044 wrote to memory of 3252	1044	jsc.exe	85
PID 1044 wrote to memory of 3252	1044	jsc.exe	85
PID 1044 wrote to memory of 1032	1044	jsc.exe	92
PID 1044 wrote to memory of 1032	1044	jsc.exe	92
PID 1044 wrote to memory of 3960	1044	jsc.exe	89
PID 1044 wrote to memory of 3960	1044	jsc.exe	89
PID 1044 wrote to memory of 2004	1044	jsc.exe	90
PID 1044 wrote to memory of 2004	1044	jsc.exe	90
PID 1044 wrote to memory of 2512	1044	jsc.exe	88
PID 1044 wrote to memory of 2512	1044	jsc.exe	88
PID 1044 wrote to memory of 3084	1044	jsc.exe	82
PID 1044 wrote to memory of 3084	1044	jsc.exe	82
PID 1044 wrote to memory of 2368	1044	jsc.exe	91
PID 1044 wrote to memory of 2368	1044	jsc.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

C:\Users\Admin\AppData\Local\Temp\f350549e93d794a656c42232bbc069781cf30a88ab3cb687a12a9366796a01a2.exe
"C:\Users\Admin\AppData\Local\Temp\f350549e93d794a656c42232bbc069781cf30a88ab3cb687a12a9366796a01a2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:1044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3084
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x110,0x114,0x118,0xec,0x11c,0x7ff8b4b6c728,0x7ff8b4b6c734,0x7ff8b4b6c740
      4⤵
      PID:3440
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1604,i,8684106535273015332,1709793974292061138,262144 --field-trial-handle=2644,i,17313316229252804309,791220343046933856,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:2
      4⤵
      PID:2064
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg" --force-high-res-timeticks=disabled --metrics-shmem-handle=2004,i,2350347070769376361,10083403562483112089,524288 --field-trial-handle=2644,i,17313316229252804309,791220343046933856,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:11
      4⤵
      System Time Discovery
      PID:3252
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg" --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,14255584719691901685,5137018156214187662,524288 --field-trial-handle=2644,i,17313316229252804309,791220343046933856,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:13
      4⤵
      PID:3016
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3064,i,5506975688648440440,2827691292043777076,2097152 --field-trial-handle=2644,i,17313316229252804309,791220343046933856,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
      4⤵
      PID:1796
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3084,i,17975743400793889003,16208101677147824413,2097152 --field-trial-handle=2644,i,17313316229252804309,791220343046933856,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
      4⤵
      PID:2512
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3244,i,7915868072428412166,5983370343088272789,2097152 --field-trial-handle=2644,i,17313316229252804309,791220343046933856,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
      4⤵
      PID:3960
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3268,i,12032364506480303095,10745526924609908722,2097152 --field-trial-handle=2644,i,17313316229252804309,791220343046933856,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:9
      4⤵
      PID:2004
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4276,i,708067106825660116,13173121413038247131,2097152 --field-trial-handle=2644,i,17313316229252804309,791220343046933856,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:9
      4⤵
      PID:2368
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4368,i,18423902376079369783,8620154454036523866,2097152 --field-trial-handle=2644,i,17313316229252804309,791220343046933856,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
      4⤵
      PID:1032
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg" --force-high-res-timeticks=disabled --metrics-shmem-handle=3892,i,6674219213076983361,9855760336952608824,524288 --field-trial-handle=2644,i,17313316229252804309,791220343046933856,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
      4⤵
      PID:5108
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg" --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,9943800315643999260,7238344338166437632,524288 --field-trial-handle=2644,i,17313316229252804309,791220343046933856,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
      4⤵
      PID:1228
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5576,i,11097924983155502044,1191331752507761935,2097152 --field-trial-handle=2644,i,17313316229252804309,791220343046933856,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
      4⤵
      PID:3396
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5604,i,16641319154690485706,17787257121328093691,2097152 --field-trial-handle=2644,i,17313316229252804309,791220343046933856,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
      4⤵
      PID:1568
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      PID:1176
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff6a53855a0,0x7ff6a53855ac,0x7ff6a53855b8
        5⤵
        Drops file in Windows directory
        
        PID:3228
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:1676
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff6a53855a0,0x7ff6a53855ac,0x7ff6a53855b8
        6⤵
        Drops file in Windows directory
        
        PID:3792
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5752,i,2825942633347846294,6385672706440206540,2097152 --field-trial-handle=2644,i,17313316229252804309,791220343046933856,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
      4⤵
      PID:4392
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg" --force-high-res-timeticks=disabled --metrics-shmem-handle=5744,i,104797791988031877,7943394551022725389,524288 --field-trial-handle=2644,i,17313316229252804309,791220343046933856,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
      4⤵
      PID:1348
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg" --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,11944786937997875010,8710378855239110151,524288 --field-trial-handle=2644,i,17313316229252804309,791220343046933856,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
      4⤵
      PID:1672
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5880,i,6388354088664720456,8039250047724297961,2097152 --field-trial-handle=2644,i,17313316229252804309,791220343046933856,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
      4⤵
      PID:780
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5196,i,2465233372137328545,1548502585868000837,2097152 --field-trial-handle=2644,i,17313316229252804309,791220343046933856,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
      4⤵
      PID:1504
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg" --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,5778292613282238369,2764286013559912848,524288 --field-trial-handle=2644,i,17313316229252804309,791220343046933856,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
      4⤵
      PID:1700
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg" --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,17107252439141834952,7584207276538760466,524288 --field-trial-handle=2644,i,17313316229252804309,791220343046933856,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
      4⤵
      PID:1208
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5056,i,14075063703528575827,12102884476617109546,2097152 --field-trial-handle=2644,i,17313316229252804309,791220343046933856,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
      4⤵
      PID:5472
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg" --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,1127102819208236442,13465636807400258200,524288 --field-trial-handle=2644,i,17313316229252804309,791220343046933856,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
      4⤵
      PID:5552
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5744,i,1280656682877336352,17708651708451818364,2097152 --field-trial-handle=2644,i,17313316229252804309,791220343046933856,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
      4⤵
      PID:5872
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg" --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,15802995783348975316,3707020386552973663,524288 --field-trial-handle=2644,i,17313316229252804309,791220343046933856,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
      4⤵
      PID:5880
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5616,i,18120312649008389878,17466671796925100244,2097152 --field-trial-handle=2644,i,17313316229252804309,791220343046933856,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
      4⤵
      PID:5888
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5644,i,17136023058669956124,7042801875537188667,2097152 --field-trial-handle=2644,i,17313316229252804309,791220343046933856,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
      4⤵
      PID:5452
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5764,i,3254557667270973512,14214358365285244223,2097152 --field-trial-handle=2644,i,17313316229252804309,791220343046933856,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:9
      4⤵
      PID:5600
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5360,i,8719614402861867128,2490782649263065882,2097152 --field-trial-handle=2644,i,17313316229252804309,791220343046933856,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:9
      4⤵
      PID:3372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qc01nstf.rs1"
    3⤵
    PID:5312
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\qc01nstf.rs1
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:5332
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1488 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {539f3da8-4e02-4351-b816-36015bee5854} -parentPid 5332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5332" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:2816
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27133 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2192 -initialChannelId {850af930-b131-4fe6-8f51-b1a1ab88ae31} -parentPid 5332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:5224
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6ca26472-3288-43e1-b78c-ab051a8ac299.dmp"
        5⤵
        
        PID:5596
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2268 -prefsLen 27133 -prefMapHandle 2760 -prefMapSize 270279 -ipcHandle 2780 -initialChannelId {c2467bfd-f47b-4453-abc6-d613e78fed90} -parentPid 5332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5332" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:5560
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d55993a7-ef24-4334-a16f-0b2a2084f69d.dmp"
        5⤵
        
        PID:5832
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2792 -prefsLen 27133 -prefMapHandle 2888 -prefMapSize 270279 -ipcHandle 2928 -initialChannelId {d6fbe999-0735-498a-a119-f117e6c60a44} -parentPid 5332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5332" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:5480
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ad304b89-b273-4ca7-bcc6-81d60a3260f3.dmp"
        5⤵
        
        PID:5508
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2912 -prefsLen 27198 -prefMapHandle 3032 -prefMapSize 270279 -ipcHandle 3040 -initialChannelId {0c46fb27-93df-4467-b0c9-032d86864f93} -parentPid 5332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5332" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:5520
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\07db2995-15a8-4dcc-8b2f-9b5faa2bd995.dmp"
        5⤵
        
        PID:6064
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3040 -prefsLen 27247 -prefMapHandle 3296 -prefMapSize 270279 -ipcHandle 3380 -initialChannelId {30f9c77d-2f6b-4dc5-8748-69b692ed19fd} -parentPid 5332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5332" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:6080
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2828 -prefsLen 27323 -prefMapHandle 2808 -prefMapSize 270279 -jsInitHandle 3020 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2868 -initialChannelId {52a34156-5d3a-4acc-baec-83574e14bb99} -parentPid 5332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        5⤵
        Checks processor information in registry
        
        PID:4500
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e2ca353e-dded-4bf2-8a2d-22ab4e1d4727.dmp"
        5⤵
        
        PID:5140
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3372 -prefsLen 27323 -prefMapHandle 3584 -prefMapSize 270279 -ipcHandle 4084 -initialChannelId {b7085cf0-0d68-4b85-9e37-9bee8d8197b7} -parentPid 5332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5332" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 gpu
        5⤵
        
        PID:4776
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\997e60ce-117c-4ab7-b08c-b9e7fd5a7167.dmp"
        5⤵
        
        PID:3140
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4336 -prefsLen 27323 -prefMapHandle 4340 -prefMapSize 270279 -ipcHandle 4360 -initialChannelId {85670120-c449-4ac0-b221-d9445a365f65} -parentPid 5332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5332" -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 rdd
        5⤵
        
        PID:1668
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4752 -prefsLen 34822 -prefMapHandle 4756 -prefMapSize 270279 -jsInitHandle 4760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4780 -initialChannelId {5caadc08-b8d9-49ed-976c-183e668c1fdb} -parentPid 5332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:3228
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5068 -prefsLen 35010 -prefMapHandle 5072 -prefMapSize 270279 -ipcHandle 4748 -initialChannelId {8722b7df-88ef-4973-8485-1354a6285f0d} -parentPid 5332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
        5⤵
        Checks processor information in registry
        
        PID:4396
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5140 -prefsLen 32900 -prefMapHandle 5144 -prefMapSize 270279 -jsInitHandle 5148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5156 -initialChannelId {02cf35a6-8d86-4014-8cca-e0856ca47b41} -parentPid 5332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:4616
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5188 -prefsLen 32900 -prefMapHandle 5192 -prefMapSize 270279 -jsInitHandle 5196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5200 -initialChannelId {bab8f435-de69-405d-8d70-bee8ecad457f} -parentPid 5332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:4508
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5436 -prefsLen 32900 -prefMapHandle 5440 -prefMapSize 270279 -jsInitHandle 5444 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5452 -initialChannelId {ff2c89c7-20d8-4ac3-8909-33b998f51a26} -parentPid 5332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
        5⤵
        Checks processor information in registry
        
        PID:1648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qda34raf.lur"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:1016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\qda34raf.lur /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\qda34raf.lur\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff8b1fac188,0x7ff8b1fac194,0x7ff8b1fac1a0
      4⤵
      PID:1588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qda34raf.lur" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1652,i,15731590714224237279,2155470499825921157,262144 --field-trial-handle=2196,i,2437475861350423461,13147521819593024296,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
      4⤵
      PID:572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qda34raf.lur" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,7984407268404391759,17400622186971249167,524288 --field-trial-handle=2196,i,2437475861350423461,13147521819593024296,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:11
      4⤵
      System Time Discovery
      PID:4212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qda34raf.lur" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,11947214190583470857,6483389959748245740,524288 --field-trial-handle=2196,i,2437475861350423461,13147521819593024296,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:13
      4⤵
      PID:2692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qda34raf.lur" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3320,i,4783514732147526377,10832400824871305132,2097152 --field-trial-handle=2196,i,2437475861350423461,13147521819593024296,262144 --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:1
      4⤵
      PID:5488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qda34raf.lur" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3324,i,3762423839918775787,5027599511119372807,2097152 --field-trial-handle=2196,i,2437475861350423461,13147521819593024296,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
      4⤵
      PID:5848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qda34raf.lur" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,12433577023413141933,4427839063847172270,524288 --field-trial-handle=2196,i,2437475861350423461,13147521819593024296,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
      4⤵
      PID:5420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qda34raf.lur" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,3733691925026369166,11207244842509532717,524288 --field-trial-handle=2196,i,2437475861350423461,13147521819593024296,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:14
      4⤵
      PID:5632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qda34raf.lur" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,715127946558099430,7519587371588126522,524288 --field-trial-handle=2196,i,2437475861350423461,13147521819593024296,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:14
      4⤵
      PID:5844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qda34raf.lur" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3644,i,7852173757878623610,15162375059843328904,2097152 --field-trial-handle=2196,i,2437475861350423461,13147521819593024296,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:1
      4⤵
      PID:5436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qda34raf.lur" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3660,i,10190374644918081847,898750433356631332,2097152 --field-trial-handle=2196,i,2437475861350423461,13147521819593024296,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:9
      4⤵
      PID:5080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qda34raf.lur" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3676,i,5824852429030654637,14764469660724852337,2097152 --field-trial-handle=2196,i,2437475861350423461,13147521819593024296,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
      4⤵
      PID:3816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qda34raf.lur" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3716,i,2259414010506631738,15821829354581322920,2097152 --field-trial-handle=2196,i,2437475861350423461,13147521819593024296,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:9
      4⤵
      PID:3656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qda34raf.lur" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3736,i,2106209042563642958,3214729556390059620,2097152 --field-trial-handle=2196,i,2437475861350423461,13147521819593024296,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
      4⤵
      PID:5260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qda34raf.lur" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3764,i,10018339936063597687,10631327445381205648,2097152 --field-trial-handle=2196,i,2437475861350423461,13147521819593024296,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:9
      4⤵
      PID:5388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qda34raf.lur" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3784,i,17566264931833282685,5727862018024771791,2097152 --field-trial-handle=2196,i,2437475861350423461,13147521819593024296,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:1
      4⤵
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qda34raf.lur" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3804,i,13944788567723726230,6335183805860973013,2097152 --field-trial-handle=2196,i,2437475861350423461,13147521819593024296,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:9
      4⤵
      PID:6012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qda34raf.lur" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3824,i,16933654169071741024,18381684942540089645,2097152 --field-trial-handle=2196,i,2437475861350423461,13147521819593024296,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:1
      4⤵
      PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qda34raf.lur" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3844,i,16379796355952289159,8230708850581329261,2097152 --field-trial-handle=2196,i,2437475861350423461,13147521819593024296,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:9
      4⤵
      PID:5304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qda34raf.lur" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,2237587468334824027,11283787377389287622,524288 --field-trial-handle=2196,i,2437475861350423461,13147521819593024296,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:14
      4⤵
      PID:4644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:2588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qda34raf.lur" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,13211473670427542136,10908437549623656191,524288 --field-trial-handle=2196,i,2437475861350423461,13147521819593024296,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:14
      4⤵
      PID:4888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qda34raf.lur" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3972,i,11170297047119995371,4856767648626984919,524288 --field-trial-handle=2196,i,2437475861350423461,13147521819593024296,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:14
      4⤵
      PID:5972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=596
        5⤵
        
        PID:3404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qda34raf.lur" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,15931793011411109769,17534562102469309494,524288 --field-trial-handle=2196,i,2437475861350423461,13147521819593024296,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:14
      4⤵
      PID:5968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qda34raf.lur" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,15767495227694066047,9540450461661797253,524288 --field-trial-handle=2196,i,2437475861350423461,13147521819593024296,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
      4⤵
      PID:1356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qda34raf.lur" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,5960714895342605720,12872083900949947952,524288 --field-trial-handle=2196,i,2437475861350423461,13147521819593024296,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:14
      4⤵
      PID:3856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qda34raf.lur" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,5960714895342605720,12872083900949947952,524288 --field-trial-handle=2196,i,2437475861350423461,13147521819593024296,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:14
      4⤵
      PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      PID:5940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Crashpad\settings.dat
Size 40B
SHA256 7ad27bf15c4fe704d2207714b22417d010321bcb1f65573c7e6b04e67572d505
MD5 01f331b25bfba2fdd687d858f08cc957
SHA1 d49a568e9fd92a4e09c3a7ea60beb3b19938ccb6
SHA512 56f26c1550a730468cfdc978d4eadfcac11d89100b89ba5af8c9d9c2db981f8b3b8d7f03589195b9086a0132aab7afd9069c5ad1c0cb176edbd4d576449b7ea9
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\BrowsingTopicsState
Size 414B
SHA256 a3e301223c6759916ec5c35663ac4204354c5d3ed259bc95630d5b3a6e85ad03
MD5 6643dc073e470e247530b278d7b841de
SHA1 93f4a413cd881625b986fb464eb814641cf2443e
SHA512 2320c49e7a77688e917c35ab8925485274440719954f3234d4da016e6dcc981679ebb03c57805af96150fe664b53baed7c39b1eed3d2cd9cbac8135175e6c23c
TLSH
T10CE0EDBBD8219D3B18FD07296090674BE65417566B41995B3A3C820CCFB963A4686C1C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 b0cc7cf5f18f76a45339d42c18f17e0db0a9e61bacd46f17b0ce49a6fd4c9d86
MD5 d6e31877f6209581f5d3fd97dc9cd65c
SHA1 598a144923426058216e474b69bace7b8cfba32e
SHA512 25817276daddf7429fe1422761544489390758665aafb787735025564445a20defd216e16c17a8b4016cae9b181037e048ea5dc88307fe6c7106419f8644e7da
SSDEEP 6:/FoEXEQRYuXWN+wXboD8DE9+98+EePY9OT+EXgHvoYZkllRZe1Ip4t:d7XDYuiJEw49+9SxEgPQ/OI6
TLSH
T120135E2CBA511E6AC1E1443808473BB173F18467EA53AA43457C70307925725174D1E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 c072df57546ec66a55fb0bb097c84ce95de9b6295c1f5731fe8203957c67463e
MD5 3c1084f4c1227b167dc250adee52bbb4
SHA1 4cba76323c870835bc0ab9b6d52c2b022a21cfe0
SHA512 385153d6d9c57512d61f51d70b33c43f7ef67696e5b757b07d790bfede0bbbd359e2b533d65e8c50e9204cebb029559fbeca22a109774807c6b4a62ab186b790
SSDEEP 48:zlHqUY0AV1JM1Xge8XCTApZMmX5dVEPLVBKWwtl:JHqBt/Juge8SALj/VOLHKWol
TLSH
T18E4495F71D00DEC3EB15DAB95C41923C8D7246232D9EEEB9F628447201906F7322C6B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 cbf012333b4adc46fb184ae700fa5ed2a9fe1d24b87721f6b4719a814556d594
MD5 dfaeca01d26b8424dab4d72573a8ab41
SHA1 059cd5ffa58fa2ebd35c97c290e45247da086a8a
SHA512 3d6f014869b6ec35d0326d11f30103111e25e183cf661caf048008fb952816ff1481dbe34a49dc2dc0f562fd19797d3a550fcfaef57d4e58d900b82b8164fb1d
SSDEEP 48:phLCg1i+Nq5w1Ei9dBVybmzu9G7CCXiwpBTaTxXPetR74OVIsBvppIvF:pU5Hi2bp9MCHXl074AIsBvjw
TLSH
T1BA252A50B9296FD1DB0856B1350AC3E8CE5BC99CB771591B097E6C7CF40C809AB3507A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 656d3df43701cad8b6a64cd5b7d79986de9dfc945de12d307e0e82edb17913ed
MD5 ca60bca5a2bbef5a48fa177ba741cbda
SHA1 41ab8546b120dbf13c680aeface7286a5df13f07
SHA512 4a1faaf88d3a34bdb4eb7a83a5674bc96d6e1e90b32f815f96d2869204c9a3fc765e8b84d0d3239783fc2dddb753a09330a3e7d4cec7a7c10c7930e38fb57c0a
SSDEEP 768:Bxe4WfDPLSgcRUv+D4rxM4Mxv4GB7o4L7o4h7o4:iO/b3oSoAo
TLSH
T170163CE60F28A586EA46EFB0BBCDDD1C7CB022D2FCD36892E126827945E1BC417C515D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Cache\Cache_Data\f_000001
Size 35KB
SHA256 968e1cb2c7a6995a3aace1b0070e1f025fe149974d9c402e7cde9f3943f45368
MD5 50578fa915c4c97f24f2f68a0ad97e58
SHA1 808efb9fa46460a36c1c757f65b9ffb427c13f71
SHA512 a43eddb008548501d99613758a982e19ea8851e8a6b7571935c6dfb153a53864eaed156c1f4128fc2071021d79e4a117f878e32d4ddb7a0977a68a20bc031a54
SSDEEP 768:N+Rvr8UJP4uzQ1mS5dMYEV+L7Q7L321p9MO3A0zw6BoyMNnSzed:kRjZ61L0YEV+3Q7LGpup0zw2oyMNSad
TLSH
T170F2F11A59EC46B1247BAE3697251E4FA40CADD4A81B2F4C72EC4C8B1845C3DEE0CFE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Cache\Cache_Data\f_000002
Size 67KB
SHA256 5561b7015108c0d761b2f646ef6a2941d8d9c710792215107625756e597be305
MD5 83f1f185736d51aa38a53c9f59a9bb8a
SHA1 e0e6d897f7edea01e2156fb83e0fb5c9950ca7cb
SHA512 283e8f77f1c6d013feb74dc2b188d3431bfe887028d1b15e772495b8322b9c3f465afc3a161044abada30a37dd9d697b99a54c3811fe23b9200ddddd4720bc7f
SSDEEP 1536:pulGSzd2shU1evf8gZQE+DOm+m6+ywGlmxry3DTCfL:4lGShl3k0YZ8irSOfL
TLSH
T18763021B49318931DA93A8A7A0F472818BC26D73BB1C53A46F4583C4574C3EAE9CD0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Cache\Cache_Data\index
Size 256KB
SHA256 1eea38dcd831ab8bd5d58c7d245232f3128e1e84e847e5d84073364714211709
MD5 1b2b6d4c0bc0dc05a5d6292bb8c05df8
SHA1 10e7d9d08cd547f87b529edfc37d48599866ebcf
SHA512 3681f7caf261857e3a9d0990da1a421c18906e7a8dd9b97439077ba8f43babe5a8e4f3b74b596a59a5635d766d7bf16252588e382707eb2d75bcea0a5489192b
SSDEEP 3:LsLllFlklNllklkXl4+K/lSllx/mltcll//2NtlNlXl3Nl/lpllll/ZNtlQl:LsRa3lP8/4eOlt+Ntdlllh
TLSH
T1B244025E53956E17C2C402FD844347507374C415DA4F8753170575702DC17515F1F154
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 0900c4b06277979f9b178d0ccd8eb687782a87811dfa9145b680319b085f2e36
MD5 eeaf1f5943d483de518131025357ec72
SHA1 d32958ba82dd7402ba1704023dc6ab37f050e6f0
SHA512 d0136eb6a37733412c8445b691b4d2db7176b08fc1fb094a3caf932ca8fcdb18d9f798c713bf14a467f059ae620b2e574181ba52c4ecfc9c10c777a77aa03843
TLSH
T196E02B91C34D0F0DD32D96F7CDA703048A0E42C42ABE3A43A980C2D133224241258523
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 708d8323d381602aef0ed14dae5b8503655df8d1dd4f454ce26037ac57464173
MD5 942fc13881ed6b2c6b36cffbee9a547f
SHA1 72a820cf30c66ffc18544d548fe99bdc725cda0f
SHA512 f7fb5a8166f73aea5984c6a330532a218302ce2fe142c15020d04815e572fb536930c5b23effe6ada63b8d8bdb83fef5f1eae2273e58e5ed177d4f58d5a78f85
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 6dabf0beaecb08d44f00f8f3d2b47cfb32fa90cc4df62eb747669a0cf6b91c2c
MD5 7230da4ecd2552982a1f806842d9f74a
SHA1 fdf11a936a6f66d14adc9fc8bf66f993ea67a85d
SHA512 5a93a69246d6f8e9ce4101b6e08f263cefaadc53c553c992674cd79609fd6bbdac12c874693e8e1fe8d40d8817c0cbd96f909868eda05f45cda6c7d5dc0b99aa
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\DawnGraphiteCache\index
Size 256KB
SHA256 a315469a5d5fd674c7340da1e75412220de645d2a6dd25a873ff6d84daa9b064
MD5 5a7a64ab761dbc8d9962dce8db6799c3
SHA1 5b4d1fb8e37dc9d51e745e99e6d46ea00fd1f3b4
SHA512 3d545e4dd4af6b9c04041daab4d1cd017c137958fbefebaf7c60ac8f8c7927b617f7a5be08ad2267e0c2f882af1d426829b2f6bc216b824919c1cb212628e704
SSDEEP 3:LstlNllklkXlSw:LsX3lPSw
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\DawnWebGPUCache\index
Size 256KB
SHA256 672001269fb509988641a7abf9a82b2b61e52eeb93beb09e429145aaded4f198
MD5 e1ac56515fe3495d6bf7d6fb3a1d65ef
SHA1 785774957b549ce9beb003d8423ff3383e05aa01
SHA512 b61f89656d2bfba3384e632c660dc281a55673ee009551c5cd9f39710e350fd485f6160d2a2e696f56a50c07a0332b7b9f34e1b811fb4d474a48ce5a501c3a8b
SSDEEP 3:LstlNllklkXll:LsX3lP
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\128.png
Size 4KB
SHA256 41b21cd721317759a1391ec66ec4606b1f1b0a66fc6542ec3e69f9a6ba9a60d3
MD5 a6e517fba00c44d26f516d2bc473042f
SHA1 bcedbf549056bfacff8820cac38713a1eacd95b9
SHA512 8c58b58a05b60420ff187c2dc8b71e019fc36cd6bcec050257b5532f131ba50ecd00fe2ca734805753a39f6911125d2d8684286207b1d1d039e862904279a145
SSDEEP 96:4niq7dWteEb8MsIhE+bf+rgEPQCGJxc4bOdpI0xeblJpzSkLqdsQ4pXnW3P:e97kteEnJEu+rxoi4b3RJpfhQ45nGP
TLSH
T14AA1AFFA12E3DA94303E91711B20659B4D7909385624364DDBB2AC7140C7A0D9B7CF63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\manifest.json
Size 2KB
SHA256 4375dfec1feb4295bdee57adb32a4cbaf351904be807160eabe87ca692b2b5b2
MD5 a60bd7255f6a78622887303990f4b4af
SHA1 61d77694628cdaf7f5ace1332a01d05e79f13772
SHA512 96b411c6b37e927de84cd363e37d0203bd692cbe2cc1aea56780830f23889562a8a512a07316c2c0ca7909a43a7ab879d9e908421ba6e7b99fdbeba1202e2282
TLSH
T173516DFBBC10AC634BB08594991A710EF729735E45CFC4DBB2BC60734BE4CAA1D60598
MD5 SHA1 SHA512 TLSH

Submit Download

offscreendocument.html

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\offscreendocument.html
Size 97B
SHA256 b9fa2d52a4ffabb438b56184131b893b04655b01f336066415d4fe839efe64e7
MD5 b747b5922a0bc74bbf0a9bc59df7685f
SHA1 7bf124b0be8ee2cfcd2506c1c6ffc74d1650108c
SHA512 7567761be4054fcb31885e16d119cd4e419a423ffb83c3b3ed80bfbf64e78a73c2e97aae4e24ab25486cd1e43877842db0836db58fbfbcef495bc53f9b2a20ec
TLSH
T132B012EE6C03C10004551E8A38E092146412638870D1A1445CDEE0334D4075C9C0B44C
MD5 SHA1 SHA512 TLSH

Submit Download

offscreendocument_main.js

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\offscreendocument_main.js
Size 115KB
SHA256 f6b3a786b1178d0d853f37559c83a4b5e40e2af451dca20af583137416af8416
MD5 5c3d8dc7447cc707f8da55f8c3b7d2b9
SHA1 1ff4cf8647c578a29a7b75c56d3dad86fce729a0
SHA512 0c09e9b71e0721e45ea3cc8797eb1e9b2bd2d762c0939eeb63b4bcb2c2508d4f09c5dd8c54fd51fa422d621a848367219f3bde8ab10a9e9a3dbb5e5fc22433ce
SSDEEP 1536:bdcu4XPM3pxqVv3AZWN4pI6PfRYPCf/JKIcAemoa1mAXC+4UKSomSWmmqekWdsXU:SApA34cmI6Pf3JKICnaPXC+BmmxkQbN
TLSH
T1D7C3FACDB6A574624363A5F5002F010BB23AB8AAE44C81E8F189D9E97DB446D4377F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

page_embed_script.js

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\page_embed_script.js
Size 339B
SHA256 e9bdab7a401dd22885c7a7a8bb9c55f27783807a64402e62b39758c7fdccb345
MD5 19280b929163e1c79f981de8804826e6
SHA1 aa0b31d2ba9609100a914b70943cfdee3eff8708
SHA512 0cdcdadf3d04aac9bb15ee1d074879e1042816c1ecbc96e0cc6a23d4eab29231f7e85aaa66c985dd7a209ec0b707906d1866508b12a83a67c227ea971cfd6e14
TLSH
T12EE04F070F095929F0BA890EEB133A03AB3541106C35954F26CE0451BB4339BD1192AC
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\service_worker_bin_prod.js
Size 121KB
SHA256 ed3803ef5bac39e8b153d283695ee3562398e5d771a6c7fe5d1a85805672ab3e
MD5 aac97879e3f1c5a71cfb46b0fdbb29a1
SHA1 0cb02f7bbcbf207606888361be551e6d682c4c05
SHA512 8878736f8500a668e51e1f543ad7fe13eb7b4e19632918714dc64e952cb1f8400fa2026cfdac9ec757f4a285eacf6ce89f606a395500c56d2f2f39f8a64aa760
SSDEEP 3072:L3zCum5nHBRKbYK2ANj6a/4rxMwDLE2sk:LwB34GASx/DLETk
TLSH
T15FC3E9CCB7A574664363A5B6002F000FB23AB8AAE44C85A8F188D9E97D7446D4377F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences~RFe5876f0.TMP

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Preferences~RFe5876f0.TMP
Size 3KB
SHA256 3fa5bb133c68708d672cbbebd06f1e9537e825690e18041915bfef8734463891
MD5 ac3442b0b5e5c13c525464527a26b2ab
SHA1 3efd8c3c0f131b223aaae72b452a945c513cf323
SHA512 22ecc6ee15e69d02a65b1dc1cc10517f591290a5641c7da6a9fa22c22718e90621f779412513bc7acc79e9f7ba5cbb1f44521730a77a3a3a9cc2078ea70c1b28
TLSH
T14C617369D4A45CE71EB27B66792E0782F904837F1180281A7ABF49CC0FB386B8045F99
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png
Size 1KB
SHA256 bff3a19327fd09a24c1aa4e7f34c508d7e668a8eb32f2cc7c33bcaa7e9ee2319
MD5 2f1881da261cfaea89605ee7a5e33e40
SHA1 fe61ed428aa3636adcfbeb66162f43f0ee091d25
SHA512 a9d8a4172c83030bf4472e900540b2ef3bbbb5e565c39f278cb8aae355354f063a4723c5ed8c3b32dcea45c70903271d170e56879a096b169697fc28dc768494
TLSH
T1FC413B2333F81ABFD81CD69BE465C8A50F395483DA39060706031CE8116343B19DDAF9
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png
Size 2KB
SHA256 afbfdd55b59a6385a28bfe27ef81ffae07f9d77b8c073dc299c6060b5d964a89
MD5 4d5d17c7e7c06b887bb383077131f50e
SHA1 8b29cf29af8358672e31bee5472025b7b07e7df8
SHA512 ccb20424ba2566e11a359bd04cbcb54bc21947bc254f4939c334f7db8c784a1da35461f60a1fc559ab5bde5cda443c82b633b8cc5bda89f5019b391148050be3
TLSH
T179515DED0389C698FB6F764206866917621D39F824EC51E09AE816A3EB101AC1CC1FD2
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png
Size 1KB
SHA256 23fb4d1613fb426612119928a7222ca84a9cba4ba081a8b1be7f2565c013c590
MD5 520121a67f0bdc7a327bd49d50090dac
SHA1 648e3fbcbbffa431fd2480edf0a342b6920fb3b5
SHA512 36a89b73c4de9d9ef98becbbd31f286014163617063600ed22779e1e87ac35cbfb8341f9e4300994352570b1223719256c0d698dfa4aeb38e7d3907927a79a92
TLSH
T12D11E5B643275C67A2B3011708E03ABC8D605898F02B4A9C90148799360BBAAA4ED3DD
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png
Size 1KB
SHA256 7b1aa50219251762867246b79677fac99c1b61a4ef4e471ae3473c10ada2c50b
MD5 c633806d580f67b98743782c74dde9fa
SHA1 8acb5f35cd7ee2e7d3174ce06d399d46dd275ccf
SHA512 04cbe1571369525f4aab0b2a9fddbb425e9a935d9307d3b4fd2623899644e15419d0f7e0d33372a46442778043c03448e8130d892b4978aedbbcc0a785eaa9e7
TLSH
T1A9210BF662715F4EC79B05AC1FC14A676310122D665033AC5C2594047E4BCE78DB4D17
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png
Size 1KB
SHA256 2a560cdee5965876269d30cf82a85b83aeac16903d4f325209ca3354b971c25b
MD5 310d0edac146f7ce3e4394c066348637
SHA1 b1f1be49560ccb7007700fdf86a5121eb99eaffb
SHA512 1db1aebc30d4912eb9f3474476a2ca3683d078e3e141fbb7964402d01cc5fa5c2e24a1af7b4fad2f19b731d4b26ec9616f5406bf84d66d164a716e9084921156
TLSH
T19C3187F0F47B2D96DF75AD3427028960E6559E962D93DC109D482EE94B0C70981CE163
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png
Size 952B
SHA256 e566796c18517e7084e3a892b3291cc189b85e7830800503c256998ab697a507
MD5 bf7aa030f9cbc7aba123d10adb3ab321
SHA1 d210f3194a494a65d1e32ade703e24fbbef7b444
SHA512 3be8123811222e1d5aa92e7144d41a8ace20ea1d5b082aa51d11df8f573c17f294ead72ee9e94b31259035ebd0eecb904686cf4bb22f0e5313a02756e210b8a6
TLSH
T1E311889E6EAA8CBDD1C3AE4FBD2D22904F13CE54C534BA1B4C4759573A26E54704B501
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png
Size 1KB
SHA256 6a379d8e9545ee7885dcff4c53f1ca553dc9fb0cbaa18a0c71c0b75c8883d044
MD5 c053b2219c4c9e7e7080cbe4e6e3981e
SHA1 0470cf45babbbe1fad32b4dec3593e8ab7a8ac39
SHA512 1271ac3ef670f3b7104c3f4e678ef4bc9990d9427826b104bfa8d31f904895da50ed0f1b673727d39355428f6270d015c0953521b26d8f10f842854b79ec5525
TLSH
T1E021B7BE5B25DE1B97EEA61F72DA9900D89221E27183A6052ECFCB6057145A33C24172
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png
Size 1KB
SHA256 3772d9c9a6fabba60ac0c7b9c93bf230e3c99ebac9af480efc6c778d9881dd85
MD5 cf9a569f60db18903e86e6612cf90efc
SHA1 379dccdc92399b0e4e658ad8f04276bf99501836
SHA512 58f0b5130318069511452b11b1fbdfd898577c714150f5f88a4a4ff80320b33c287c103e464ef24c8543d90de71713f2ee293f538fb078ec2099f9871cef2caa
TLSH
T132210853AFCF4AAE5834129F565C460FFBA3623E2952D409DB2A41AB08CDC14E8462C3
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png
Size 960B
SHA256 c6fa451ecd1a8a9533801028bc70cf82ef48eba11bb835e53e6c530b43018938
MD5 8fc407c5a96f560cfbb46503741dd11f
SHA1 31eb59362b3c99abd75bdf605bdf46d793ef99b9
SHA512 7ed6d7c679ab5928427095beef9ae476e8bc57a5c81cb633bce1b646a896557b5b49112d489b2112ac2749e1adaf6b1a7544be36c570696fff80725352eac68a
TLSH
T1BC11CC5290BD5338C4D16953E04223E10E566CFCE4EE91366B8FC80D893EA5D9CCC621
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png
Size 1KB
SHA256 3fc8b8392989fb26381f0a14bb356cae5f998a4dde004c06a51e974034f9ccfa
MD5 b75ce0c6ffcbdcc1066a2e6c8c3aa5fc
SHA1 2ca49f0080b985a68692eee2582298a9353c7916
SHA512 a3ac3a8cb7de26b7e4fa126497dcc228462b04da9a99a0b4647c1d8f877131f6597af80c3d7e834b50938a6c1349ccb14e9e0dd0b06673fa789d78e3e499bf7d
TLSH
T15C2196C3239DF6E5E54D50A745CF1B12F7BF375829B4A058A08E42C502B77C192CA534
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png
Size 1KB
SHA256 f6ff978b0f4c0d28e96b27b6242565480a73615b03a4b95640f8d20136fc2a91
MD5 518326c327ce412aff2d0f63700b372e
SHA1 24b69d3fb978c36bd349b516cbb5720addcac515
SHA512 fa4c22a9c51cb75ef04984ac10ee068fc9d262b7cc2f969f537784bd71240359cb3c34d9789b043f43e7109e7028b17da50074cba2b8759ea31e5ef2898b0707
TLSH
T16E21E79532856E7C8FA21F4BE0642A1DF2761D0423258DA603B12CF10CE040829AD2A1
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\Web Applications\Temp\scoped_dir3084_1745953783\Icons\64.png
Size 3KB
SHA256 02bd0f5d045eb5247e576d8151da19d36dc0eee7746c9a426d4dc92ee83125c8
MD5 aceb6eccca82014c9472e49e8b4b6eb4
SHA1 91d2c703fe33ea1867dd3d87b760aa2e5e68a55a
SHA512 b18d0edf51fb6245dc730b5aca21601dc40c762d6c3d96c950b38312406bce16fe7165e786bd0d6ee106d95c90139094bfc4fca08b0f37eb88c086606821ade4
TLSH
T111814D53467373A8BC788965CBCDD0EA8D732D594E4244F884CAD93429D54049825BDF
MD5 SHA1 SHA512 TLSH

Submit Download

f2808769-93a3-4026-ba4b-a6a3db269ba2.tmp

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Default\f2808769-93a3-4026-ba4b-a6a3db269ba2.tmp
Size 12KB
SHA256 ccac48f43c0aa3f438cd834f1aaf05ae31111c68b738744b54a02a6a0fba0bfc
MD5 1cbf51ea9790e43d5189c91ab3009196
SHA1 4133948dd6dff328fd516e587bb02574f519dd85
SHA512 ad6b2765c9e5f471c6cd52db81b751a2a844e918ac8c0d4f0afc7c71e56c2de717e212cdbdb42d9543af11ad489e186c67f75a7f77200a6791d8edbf9ebfdb3b
SSDEEP 192:hRiLneDqtv77pAPRp2dXsb+WNnlD2sBL8uuGhviyIsnAUge:hRiLeON3UXiXwZ2W+Ne
TLSH
T1CE42C52EB958A47B4CCAD219FA25BA43D7FA143221D03D54DBFD8A1C09CB6CD2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Local State
Size 113KB
SHA256 b96099acae645c66389bc3f4db3c581aa1b79be57263dafbe95d2801664330a6
MD5 e43a56b8ebd645e1fec6202cc179e5b7
SHA1 ab6af9ea67fe985a6314ef40c725bb0d6967eaf4
SHA512 b85c30f516213b14ef1efe600dad0de0f5d203ecb2bcc4825c8cbbee7c5795f36afe93c2b4673287d4c849d569bffa51634d3cc67088b3c2533c0f4f609aedf8
SSDEEP 3072:V9j4mYpwoMqcG8BH4la1ozE3015nc0x6WGcBJH1lpW+Z:OpwTqcG8BYI1OC25ncdWGcr1TV
TLSH
T1C6B3121F792DBDE796BC11357510E836C02D22D8A1D5FC5DA13E03492E922A2EA1F3D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5876b2.TMP

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\Local State~RFe5876b2.TMP
Size 1KB
SHA256 c5ef9e58e5b835bce139865ff174c240757f63f6bf6e65bdfecba3ebcc74bed6
MD5 2aa33dd5ace1ecde6d4a24f25451d2aa
SHA1 09d6e8dc27bbe88fbe33eb814b64962c5e71f609
SHA512 8720ca725f6640616ac672ec1253c0680dbc3d0c8c96832aca96cfabc678d0ca0c522fcefa0fa7017d4d77813ec4d215a526822fc08a0b4913420c9669fe99e1
TLSH
T1C31175B264A4B575B8EA4A09BB619A970E381227C5518DC969CD060905AA3ECA30AD39
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Temp\jtq5evmf.ojg\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\qda34raf.lur\Crashpad\settings.dat
Size 280B
SHA256 a4c677e25547a88566f65b371f46155100705b0a4416fde279414ba0e29fded8
MD5 92958d5d2982a10ca6ed71d423162401
SHA1 5b9988f7c6675a16ff555b228e4fb6c72c9c638b
SHA512 51ddc9cc3e6b29c5d799d3ad32e3af24c52df87d8ed7f9209fd9341991a95df72ef2fa70d892dd2e6baabb7a83423a37d3d858c16ad8453ff224a93491388e89
TLSH
T16DD01102F33A228FE8A20EBB00300208CF08AE80208002A000200A820A020AB28CA8E8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\qda34raf.lur\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 bd21daf6c0d3db16bb7c255b422327b16648db802462e106496073038c71e7e7
MD5 adab9d8703ab80e24cd6588fc6a33534
SHA1 49c5fe9cfdd7a89e24189a37661e201eb631011b
SHA512 832f5bbeaa9552bb1a20087be20156bf672a8eaaae5124bd66e3f3d506eb0b4d9f1acbff06c7de7bd5c6b154d19144052de403a186278961245fc9e6864ce5e6
TLSH
T108D02BBB2D9668208DBF93E28031908040563CA8C945FC8D015CB1833DB0216381BC62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\qda34raf.lur\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 9b61da2a80527007f319d792bfed771eb220129a4a3eb615b54b6de24f0cd538
MD5 b98cead878aad156a87586989c8532d7
SHA1 cf92b41dd14095aecdc35a5c8315869f6b230e8a
SHA512 2f5a12a156aef98574a09de28ed3fd4ac5420d58a1c40b30774f381b801e4f1cbaf58739fcf3b537d2a723e4a9f7c1996103eba08487ed45b12e4813f8a2d562
TLSH
T1A6E068B73CE73C10ED7F93D14031544040593C98C408BC4E421AB5C335B1216245AC22
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58a709.TMP

Path C:\Users\Admin\AppData\Local\Temp\qda34raf.lur\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe58a709.TMP
Size 153B
SHA256 6a3610e6c3a1328fb0cd5e4fe39fd2d8291111eff7478f3503415bcf08837eb9
MD5 1dda4e8de0a5494254eb568436adec44
SHA1 6930a53fd329d6e54e1a69d582eddf535de2b2d3
SHA512 4402992acabc9ba1354356b57fff33e498d34d472d6640d0d9619d3793092db780fcc6f14a6335fac860cd2e0997dde6a77284633f4d8ccb8550f882a2d9420c
TLSH
T169C08CFB1C6A2820CA2A12D281318491812A3C8CC985AC4E822D708771701227426C20
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Temp\qda34raf.lur\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 310a88233d6fad166575b3bedde3aff10d1156b2dfb504d5210230a8c25e6d0d
MD5 545324c4fb2d0af7ce36c29fa8faab73
SHA1 c89aacd6121bef87cbe678a74983007475f01edf
SHA512 802cd1f30ade207fb7fdfae5be971cb8e080ef502e3d035a9702ee6f3aa2808bc3e683b244f32f6cb1d5f191ebb5744c0ca1b4184fe8aab7546056642b9da532
TLSH
T1C721FC627E3642413C3D2508CAD6F4179FC23462F01CA66B3FAD80678E26EA55CFE4C9
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\qda34raf.lur\Local State
Size 4KB
SHA256 9bd388fb3442fa44cbc84dcb4ba953d7d270fd465f789c8c599eab4dfe825e9d
MD5 76d5b45f350432645c9a38f627b71e2f
SHA1 ae08be83f2ad3939ef740f340dc0be7d9e5b3ea1
SHA512 b633f00e185ec9ca71cc970ffa8cd9a1afd4c6e6bf398c045d57e9800d842b777ac736a9031474f20a5d8b2a5c2ce9ea81523885f33d333625b2d259709f0e1f
SSDEEP 96:zEqGNkjsFf9+QPnNl1eDDBKBW3P6vFuEuEL0eUnSIVq4a:DGNse+A9igoNEuELqSf
TLSH
T1C481F8727428DD275AE66544B48926A38E3831B3D942EF54EAD9031804EF35C2F0EC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\qda34raf.lur\Local State
Size 5KB
SHA256 5dcc1206d8b059be3107e86c04f2599b9055ff587f175fb8f8e7453e910329c9
MD5 51ff19ca61916ec2fea9e3e75494325e
SHA1 ee3aadb89d29944793f21e57a8d866c271526236
SHA512 fe3eb85a63469ffe52ca5126eec9bbee18ffe0fe96502858a0112c1a92c0ce2fd8622d609b7bc14b10bedf871dd1dabc8eb1c6b2674863f0521ed1a5a6cfc4dc
SSDEEP 96:zEqGNkUQsFf9+QPnNl58Frh/cInURoDotovlPDBhBW3P6vFuEuEL0eUnSIVq4a:DGN4e+AiooDUw5FoNEuELqSf
TLSH
T1E8B1D7727578DC270EE2A944B4852763AFA43173D885BF98DAED0B0C04DB38C274AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe589a66.TMP

Path C:\Users\Admin\AppData\Local\Temp\qda34raf.lur\Local State~RFe589a66.TMP
Size 1KB
SHA256 993947d17ef9defe74eda0cd7e9d2cfa9e9db6041c0dd772041069190e639128
MD5 cfe96bc46344785749a47e14b9840dfd
SHA1 c113913e11bf1c4c0318dae50357302bada023b0
SHA512 68657c58c3ecf76fe3f3f97d09dc5557b193a2fb935155b312d56da6dd9a2707de169bd4ab71b46ed26eacae79fd812ea25871b8450beeaea6f6ecad60c5635c
TLSH
T13031D8B1BCB85DB7ACE2564273493B775E306131C1965F844AED0B1C04E768C124EC3B
MD5 SHA1 SHA512 TLSH

Submit Download

237039f1-bcd7-4122-91e7-a3838054031f.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3084_804280917\237039f1-bcd7-4122-91e7-a3838054031f.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3084_804280917\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

a25797a6-b24c-4e92-bc01-dd534ac2bae5.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3084_994596924\a25797a6-b24c-4e92-bc01-dd534ac2bae5.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 c3fd2defcec4617a164e9d4df0c2ccc0f172cce47153ae5c62ff68f245a3c386
MD5 9c5b90b36aeac3c338ec167ee4a9e0a9
SHA1 80d49357d33a115a46509e1f672cdc979a9c33c5
SHA512 602734f9751b948caf8ce1d7527933eb698581f7ce1612cd0db42bae29b12c0e1991d57e0da1852d357cd702b727853a609bb5239beb22a9cefce725652106b5
SSDEEP 48:85WvlWydO4fAznGF5QMTJ9zCNYIdLXuHemepe5WulWydO4fAznGF5QMTJ9zvYbgF:85WtqG7FJoFuGU5WyqG7FJvEIuW
TLSH
T139910541A7D60947F3F79AB29573B710AB3FF9154F088A0E004442080C33B489A6DFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 510ba96041becb80d1b801c29132fc9141fdec2a2d2aa2ef0272abd68d874b9e
MD5 5bec9e682fd13e70e3667ae35496818b
SHA1 df0ce59cc943d0a80e4b0af49fde5799a75a2344
SHA512 fc8acd5950fc4428a0eb7076521baf9dec3981b51966db2ea42459e82f34cf7a192eff30abfae19d3c8f6ea11f8ff53dabf64992d679745c5f178d2b6e09ac64
SSDEEP 192:tG1d66Joz0dzgCl6mc0dXjOv5zboHpZH/yj56mQ:tgd66JozQzgC1juboJZH/yjUz
TLSH
T1EFE1EC64E629867FC418537BCCA21F410F35388B984E2F2936ED65082D5B2DD3A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 a1e480b06f76f28b60b34210a87fad74fd2b8d7c57376b058cb0ee3f75e69f62
MD5 c21f18cc138b00e60437e034c5b3d93a
SHA1 05d903a00cccad3f49460e9a5c668a9dfeacb8d8
SHA512 2b33083eb1f4ae9bebaa5cd8ce049434006c7362114c2272a48f2e22bc9872059065862f5e29f77d4c0b7c72ef7263ada265cf00bfb5ab1c0e1c031f32e5521e
SSDEEP 192:bjOv5zboobH/yj56mjV1d66Joz0dzgCl6mc0dz:4boobH/yjUCTd66JozQzgC1jd
TLSH
T13EE1EC64E629463FC408533BCCA21F410F35395B984E3F2936ED65092D6B2DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 42ff66d87bd27a86b5b99c23e2abbbc65b191c5e0f363901c9492e7d0924fe35
MD5 71891e5178e8b194b6245251b541ecb8
SHA1 c4e4ca512b2dd9732760d4f2afe43366eb616158
SHA512 4c8f54c6472b9385025f23ba703e14d87a4145e1207ddd5f782ebf555ba7eb35cadd26f90c456161db22d3c800bc2a253378eee7b24f8b741187c62cf2673643
SSDEEP 192:bjOv5zboEbH/yj56mjJ1d66Joz0dzgCl6mc0d:4boEbH/yjUCHd66JozQzgC1j
TLSH
T1D0E1EC64EA29463FC404533BCCA61F410F35395B984E3F2936ED65082D6B2EE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\events\events
Size 1KB
SHA256 de5c23353c5d1de6b18859e0755a1b0e27e00f9d0bdf663d24891f4a569f2b97
MD5 380829834366f2c4a3a63baea16a73c3
SHA1 4415176433eead4f1f8dc067ee5b1135731377fc
SHA512 6a1e260dc552679572d1bbd83de1d2a72f88550b59c8156d28604442baec6ea1eefd6f66210aa805549417dbcfde234ed5863d226eb7e541e1c4cf29417fc643
TLSH
T16B11C0DC3AF44DAAADC7D29CB091068E63614E0705C75C030E22DF8CCD94ADA72A943C
MD5 SHA1 SHA512 TLSH

Submit Download

0ab80795-c727-411a-9c8a-66409b7453ea

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\0ab80795-c727-411a-9c8a-66409b7453ea
Size 235B
SHA256 69d49f75435a7d13a780a5188328974cbaeafe3917207294ebffc3c920883d60
MD5 c07d2ccf5cfa48a2dfd23e2a28739ae6
SHA1 62fb37a7487d76a716806dd6d590bf584830e4ec
SHA512 2f35f7c5cc980ca54e501edf2f5bcb7f75f6642e60ee4da755415121dc4cc1894e27fc6b7f5fa6e738baef68338bfb0f669ca36c24bc3db66f73bff7489b42fb
TLSH
T113D097C03888BB1C48100F12F0F0A8CA31588C3314655820C5B10138E9BCAD40153C26
MD5 SHA1 SHA512 TLSH

Submit Download

1538918c-8756-41a8-a487-10e0abd6f55f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\1538918c-8756-41a8-a487-10e0abd6f55f
Size 896B
SHA256 9219e44bdbbc354dd989e60e5186c86149ab844ace400243d40bdbd23a823e9f
MD5 edcc95b63bd6f0e3f6880d2dffbdbd9d
SHA1 86e67d331dfe8ea6eb59a967ded7808b43f3db2f
SHA512 5744fdf3650bdb932a6bb4bb59e4deb45f092461ce8355ceb162d4a75615a14116d7f5ba579c65ac15480f42689047a682a72c17fd1b1e2e81e8fa50e25ce35c
TLSH
T153110491C62175F2CCACD35B88A17B034AE43513C0CB4D543EB59B144EBF52EA65670B
MD5 SHA1 SHA512 TLSH

Submit Download

2689b02e-dd3e-4cf3-a527-1f7a026b81a9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\2689b02e-dd3e-4cf3-a527-1f7a026b81a9
Size 883B
SHA256 531ab8a702d47ec62de7f6677c20e1ca280c397cbef6d8a02381b36c5c67e855
MD5 0f3f7c5df426436282842df043df89c9
SHA1 054cc77580ebeea42293e78b043b5ea0afd00d57
SHA512 cfd804dcba3772d53c8ca25b47a6be51cf24886a678d4a892c76fe9eb6208e15e2f7c855a798dc1ee561618f65616c2ec6072b5f40fa260535d165682e7c343d
TLSH
T14A110081D631B9F2CD68C34F89963B029AE87013C0CB88243EF48E140EBE52EA356707
MD5 SHA1 SHA512 TLSH

Submit Download

2cdc2e97-9c57-4396-9665-254ed1deab75

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\2cdc2e97-9c57-4396-9665-254ed1deab75
Size 3KB
SHA256 975d3211b1e7534251116b43f5157e852bcc7e9150d25cf5bc08000faf493bab
MD5 e3e50cd173ce8d060a6d37275c803a8c
SHA1 74092dc56383478244d36f1e34f5248823916ae6
SHA512 396b079aafe724dc1094c83d7dbccc020d9f19024049cd65a9f940124adf866c3e60f44330696f9ee5ea08f07bde58e684ed7b4ff142f95bd21a86cee3637bcd
TLSH
T1BD616631051879339EE8A145E37BB9449DEE338F98430E8A2159CEA842FC478578B35B
MD5 SHA1 SHA512 TLSH

Submit Download

6938bace-45de-4e57-a833-fa92e5dba393

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\6938bace-45de-4e57-a833-fa92e5dba393
Size 3KB
SHA256 ccdf2fa24937fca9d0ee5742306e1a9682c65015559efd499e2cd444af9caf31
MD5 0dc2a3238eb6670348c6a9b76cfb68c7
SHA1 0b855668f04f5c83657024c8b23b09d2d4897a25
SHA512 26502dd3f61616bb3922f67963d54e3dd387401217e3d528d710d951ace81bb583abf775201cedc665237ccc40662c00a13ab84155b716197370c980b57ccb09
TLSH
T1AF616531451869739EECA145A3677A449DDA33CF98430FCA2169CEA842FC478578B35B
MD5 SHA1 SHA512 TLSH

Submit Download

712bc4f8-d3b0-4750-a24c-afe3193c3316

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\712bc4f8-d3b0-4750-a24c-afe3193c3316
Size 3KB
SHA256 a1dc693a356cfdaff0073bd8b01446b34bee641692f865f8af30638caa751c2a
MD5 43054ef3d743b7514790069063fa7001
SHA1 cba3ccb6be9bb7f544945cb5d9f966e2f8326f8a
SHA512 e2ca7148a1f097d05f12dd9529f3e862cb244e0f66fa6d4f85b109bc866a4794a68a7ec9160900fcced8633f2d7dc6dcb71d4fb7c4b2e79f05e839ab18bd7f13
TLSH
T1DC61553105187933DEECA145A3777A459DEA338F88470FCE2269CDA842FC479578B25B
MD5 SHA1 SHA512 TLSH

Submit Download

7582492b-7b44-4309-85dd-5dbbfb64f1fb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\7582492b-7b44-4309-85dd-5dbbfb64f1fb
Size 2KB
SHA256 68ee18956df663e2cfa99d65bbf79930ad2fcbec71919e75710b784558fc5d0c
MD5 4f3575c4f0f9cb1d1fbd7f0483a48ba0
SHA1 0e0d841255347b8ab96b502d09cbc6fea1d743c0
SHA512 5d4712bdfb908cf40bf5e1efb17d3240bdd9d55c65505267c9aa1b568e112db8ed8cfb67d57e0d2b4331fb9336e977f6ab0b1dc07c328b1b7b6f44f102a13574
TLSH
T1D341245835784C7B8DDAE25D9442324E67A0CA0300C65C536E61DF0C8D9B7EE736A51B
MD5 SHA1 SHA512 TLSH

Submit Download

903ad6c4-26d4-42ae-ab98-92e39444440d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\903ad6c4-26d4-42ae-ab98-92e39444440d
Size 3KB
SHA256 7b155b661401a8d535645eaf53b9e730b2db10fc5c45a7cea7e88a03fe1b7708
MD5 bde340129af00a3cbe3444264b6a8009
SHA1 f79a6c11f6d61eb31c51a8e6020e516523aad834
SHA512 ef740e5542bec50447c08b43ae34a0328dd31d4ae330a941f9b824f7cadb23d2e8acb307c11f1715579900a2f6a97cd4d7e102e83fa58a5227db1122ab86f330
TLSH
T1CF615330455879338EECA141A36779458DDA338F9C430FCA626ACDA842FC478578B34B
MD5 SHA1 SHA512 TLSH

Submit Download

9a1e9ce3-9d57-401b-9c4b-8aa2772b8936

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\9a1e9ce3-9d57-401b-9c4b-8aa2772b8936
Size 16KB
SHA256 63bfef3dd755393b92421713cd4149689e33d76738c64e53bd3b40021b677c64
MD5 f509bde154ce407a02dffdff654a059f
SHA1 bb333763300dfed870a0350893f1e5b423cf5acb
SHA512 29ad44caf1c242c8acf2f565d670a1054264dd3e8d662b1e16a51561250e139040c384c3064f0880fc75ecfb28accfcb2e290d029cf8b225603409ee30136b97
SSDEEP 192:JjJMdIkCZ1tmWzB43op6HHJjx4Pxyzxb7ijUi89G7P1sw0Pqv40X7iByDBjC7QFk:JjyddCFmIFcCPkNb7ijUimiPFCH
TLSH
T18472B8162820457A8251E3A899FCBFC3E5F538CF4C419FC99BE4BE486EDE05E512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a627d775-5d3f-46bd-8b54-c05af421a67c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\a627d775-5d3f-46bd-8b54-c05af421a67c
Size 3KB
SHA256 c1311ecdd654630b83c67bff062e5732ad9ae6b02e1de1e538e21c884c935d42
MD5 21ba599ca897d6ae70c5927b7166cc32
SHA1 3b17e1edb0efbc03610702257b1170021765b236
SHA512 ed45b9654ff4f842c5633a2a5b1f44e24cb39fc2d5fa6ff42e889fa5624aec7c288a0915ff3dbbcb0647dd62771d431488ff584c98f6ec777ebe9b27748b19e8
TLSH
T174615431051875739EECA145A3777D848DDA338F88430FCE6169CEA842BC478578B25B
MD5 SHA1 SHA512 TLSH

Submit Download

d40d0117-8f63-4e4b-9916-bdd90a604f30

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\d40d0117-8f63-4e4b-9916-bdd90a604f30
Size 235B
SHA256 aa0146dd2c7f85a17cddfe37ace7cb8d211839c0a7e690e4c751c17d5bc0ad48
MD5 941419bbfcda73c30362e43af12128c3
SHA1 2d1a6994848a7fe6a68511d1cfac9db5e6685bc1
SHA512 0502c79a47d2aa0b887bce933f02dffbb628e475482c34e9dd3b0667fce295d281b5f767d456570a2d5c9b265750265c98d4f391f788d92a024528437f37142f
TLSH
T11DD097C054A867AC08241F07B0B029DA31854C33A470582089B080B4EEFCAC4412181B
MD5 SHA1 SHA512 TLSH

Submit Download

e16694ab-0fdd-4e41-a890-46b297ae120f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\e16694ab-0fdd-4e41-a890-46b297ae120f
Size 3KB
SHA256 e32a46b3610cd88626454d259b769e1db6dc8073d01d7bc3e6512783aa305008
MD5 e4223f6c6ecb0d36369cf8fecf0ce4af
SHA1 d7ee7239006acf05c2cdd7b8dabc95b9c57bd09b
SHA512 472a3da0205d38efb81fe5999c690f91afdcff690abf096e668d3c49af2b10640737be9e9c688cbe9387d21006c520ecd7f4890c9e3a5a10ccda05735b3ceca9
TLSH
T10C614531051869739EF8A145A3677A449DEA339F98430FCE116ACDA842FC478578F31B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\prefs.js
Size 6KB
SHA256 652970723fc97bc39ddf01ab54b37aaeb3f5dedad14d50c233fd17bdc634786a
MD5 dac2fef29cd570a119f5455df0b54a63
SHA1 365e2a7b9702e0e236d62f0bea0848f327070b66
SHA512 fed4763e14e3c324b4ab1ab16f2e5756582343a8728fee0ef10272c730a1eb9f67446976f8e71a33bba16429989d0abaf224d1d5b3cf0fa96f92403d0f81c39c
SSDEEP 96:xHvUTU2qGqsf0KjJnj01zSLigoiKSSlldv9jf2nBRHFIGVkSw88H8L4cnLTU+:xxRsf06ocigoiKSSPC9FIjSw88E
TLSH
T172E12F7895088B7FA4B677AC6C6888316AB2013BB7BF68D750B54484051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\prefs.js
Size 6KB
SHA256 21a3eed55a5312edbc4cf24b8b5c1251c4d431f7bcd617b6ddf1fe4f6a9482ec
MD5 64681c0d158e2bae91ea5d67079e473a
SHA1 5d6ce461bb0dff46389e50bf886766799d3d8c61
SHA512 20709683a9e2a886588a7772929787b9c42ddb7be10fdb342061a7035ba48e038d40186cd6a394594d64651ee2e26ed24205de7c4d548c505e30780041cccf84
SSDEEP 96:xHvUTU2qGqsf0KjJnj01zSlFSSlldv9jf2nBRHFIGVkSw88H8L4cnLTU+:xxRsf06o6SSPC9FIjSw88E
TLSH
T1F6E12F7895088B7FB4B677AC6C688C316AB2013BB7BF68D710B55484011CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.6MB
SHA256 409869d2c13e0811d7d74c8aea67b6ecf92a4eb5168f63c023a3df6120450f59
MD5 a80bd0d162626fd9d18b2836f0a47b87
SHA1 6ca74d1b40cefd5693d7f00e1f6a700f455f04d7
SHA512 dd2e6929734ee25ea550ffd25f03483f086847a9f576c51dfae7000ea72fb9e5dca9e08b9c83d4c68c02ad67e7c2fb64ac8a35ebebcdb4379fab8f234b3513ca
SSDEEP 24576:rCWk+tIYI0LgrM63BDcYrVQpa9qVK9EQtly61haHSgTH:rjv7LN6pcYrVEa9qA9EQvl14rH
TLSH
T1B4063BF860D1A247F3424073B64593EB21EFD00C5027DE0847A956E9A478CEF9E56BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 b9575f7c168505fe2f0e8973e39cce80cd3a7f04693ff8252b9088ea7201e3f0
MD5 2d3a08ff1931c8ac124c1ba3bf701295
SHA1 25ce383235ad3b39410a00c35e04d8b30f0a8dc1
SHA512 8328a3298a9815b3ce5e1ebc912388c06ba41233968592a6626c475e599cc707b2ce8edc88c579607c3812f29219da2e054acf767d72ed2f182c616d694268b7
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 8KB
SHA256 4297f78498ed118ba0f3e620a7198e4cab752dc4ddfb1d06f73d112437bf1d4c
MD5 7b58ed92d1fc77bd14a51449f68af8bf
SHA1 79a23960e8a9b928f52d895edf7355055df2b61b
SHA512 d2921cf26779c5b338a12c661a359c331950f409b8d5171632dffb40bf5594df47dee21b58804abda4a410ad97ebd8d71451ac63685e8f49819cbabe26c4679d
SSDEEP 192:PwvjAMgANgAZgAUgA8RJWArPOLOOpsbmA/mHAmoH2S/ldfaA9c7K//uxESeNAW6c:PwvjAM3N3Z3U38RJWArPOLOOpsbz/MA5
TLSH
T19C128DD64E02447F7BC29B6B335325515EAB100BCBF4A4B23BEF9506B4CA965042F2B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1044-199-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-186-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-282-0x0000000005F60000-0x0000000006060000-memory.dmp

Download

memory/1044-278-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-277-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-276-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-275-0x0000000005F60000-0x0000000006060000-memory.dmp

Download

memory/1044-274-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-273-0x0000000005F60000-0x0000000006060000-memory.dmp

Download

memory/1044-272-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-263-0x0000000005F60000-0x0000000006060000-memory.dmp

Download

memory/1044-262-0x0000000005F60000-0x0000000006060000-memory.dmp

Download

memory/1044-257-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-256-0x0000000005F60000-0x0000000006060000-memory.dmp

Download

memory/1044-255-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-254-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-250-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-248-0x0000000005F60000-0x0000000006060000-memory.dmp

Download

memory/1044-247-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-245-0x0000000005F60000-0x0000000006060000-memory.dmp

Download

memory/1044-242-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-239-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-238-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-235-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-234-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-284-0x0000000005F60000-0x0000000006060000-memory.dmp

Download

memory/1044-285-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-2723-0x0000000006780000-0x00000000067E4000-memory.dmp

Download

memory/1044-287-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-288-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-292-0x0000000005F60000-0x0000000006060000-memory.dmp

Download

memory/1044-293-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-286-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-264-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-265-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-258-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-251-0x0000000005F60000-0x0000000006060000-memory.dmp

Download

memory/1044-249-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-244-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-243-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-236-0x0000000005F60000-0x0000000006060000-memory.dmp

Download

memory/1044-221-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-229-0x0000000005F60000-0x0000000006060000-memory.dmp

Download

memory/1044-224-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-226-0x0000000005F60000-0x0000000006060000-memory.dmp

Download

memory/1044-225-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-220-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-2724-0x0000000006820000-0x0000000006827000-memory.dmp

Download

memory/1044-46-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-160-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-181-0x0000000005F60000-0x0000000006060000-memory.dmp

Download

memory/1044-182-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-183-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-184-0x0000000005F60000-0x0000000006060000-memory.dmp

Download

memory/1044-185-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-283-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-187-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-192-0x0000000005F60000-0x0000000006060000-memory.dmp

Download

memory/1044-193-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-194-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-3-0x0000000000C70000-0x0000000000C71000-memory.dmp

Download

memory/1044-200-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-201-0x0000000005F60000-0x0000000006060000-memory.dmp

Download

memory/1044-202-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-205-0x0000000005F60000-0x0000000006060000-memory.dmp

Download

memory/1044-206-0x0000000005F60000-0x0000000006060000-memory.dmp

Download

memory/1044-203-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-195-0x0000000005F60000-0x0000000006060000-memory.dmp

Download

memory/1044-188-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-161-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-175-0x0000000005F60000-0x0000000006060000-memory.dmp

Download

memory/1044-165-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-166-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-1-0x0000000000BB0000-0x0000000000C6E000-memory.dmp

Download

memory/1044-5-0x0000000000BB0000-0x0000000000C6E000-memory.dmp

Download

memory/1044-7-0x0000000000BB0000-0x0000000000C6E000-memory.dmp

Download

memory/1044-8-0x0000000005750000-0x0000000005CF6000-memory.dmp

Download

memory/1044-9-0x0000000005190000-0x00000000051A0000-memory.dmp

Download

memory/1044-167-0x0000000005F60000-0x0000000006060000-memory.dmp

Download

memory/1044-168-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-10-0x0000000005EF0000-0x0000000005F56000-memory.dmp

Download

memory/1044-169-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-162-0x0000000005F60000-0x0000000006060000-memory.dmp

Download

memory/1044-157-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-158-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-154-0x0000000005F60000-0x0000000006060000-memory.dmp

Download

memory/1044-128-0x0000000005190000-0x00000000051A0000-memory.dmp

Download

memory/1044-129-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-130-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-60-0x0000000005F60000-0x0000000006060000-memory.dmp

Download

memory/1044-47-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-45-0x0000000005F60000-0x0000000006060000-memory.dmp

Download

memory/1044-28-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-27-0x0000000000D50000-0x0000000000E50000-memory.dmp

Download

memory/1044-16-0x0000000005ED0000-0x0000000005EEE000-memory.dmp

Download

memory/1044-15-0x0000000006A50000-0x0000000006F7C000-memory.dmp

Download

memory/1044-14-0x0000000006280000-0x00000000062D0000-memory.dmp

Download

memory/1044-13-0x0000000006200000-0x0000000006276000-memory.dmp

Download

memory/1044-12-0x0000000006350000-0x0000000006512000-memory.dmp

Download

memory/1044-11-0x00000000060D0000-0x0000000006182000-memory.dmp

Download

memory/1176-465-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Download

memory/1464-6-0x0000020381680000-0x000002038182C000-memory.dmp

Download

memory/3084-32-0x000001E20B0D0000-0x000001E20B0DE000-memory.dmp

Download

memory/3140-1698-0x0000022208030000-0x00000222081DC000-memory.dmp

Download

memory/5140-1696-0x0000026079910000-0x0000026079ABC000-memory.dmp

Download

memory/5508-1346-0x000001EC2B900000-0x000001EC2BAAC000-memory.dmp

Download

memory/5596-1350-0x000001FBA3CE0000-0x000001FBA3E8C000-memory.dmp

Download

memory/5832-1347-0x000001EAD8070000-0x000001EAD821C000-memory.dmp

Download

memory/5856-2663-0x0000000000890000-0x0000000000891000-memory.dmp

Download

memory/5856-2719-0x0000028BC8D20000-0x0000028BC9098000-memory.dmp

Download

memory/6064-1659-0x000001C45A950000-0x000001C45AAFC000-memory.dmp

Download