phantom_stealer | d4f2a8731db28ded7dfe939e8f50827df4c3399295eeec156003507ae098bf83

Analysis

max time kernel
148s
max time network
57s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/06/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
G54NBV10.ps1
Size 3.3MB
Sample260626-ffzd9agy8v
SHA256 d4f2a8731db28ded7dfe939e8f50827df4c3399295eeec156003507ae098bf83
MD5 fb3238bc5d1254643ce9507a9560420b
SHA1 343cd1005f3f0130843dffb40e256c733dfcb931
SHA512 2d32ababd0e616689121c35f9b27c5a73d8d8dab2630d7edc4dea88c0d4aa61f85710d20a665ef31be147f901f70be10b98669d5e17c32e29bbb3c15fd697904
SSDEEP 49152:rUMez9Wu/KJvmcc9N4kyb3xEhxLAp71AAZUuB:7
TLSH
T17AF533232EB07DB84798E3AFA5AB6E121C015F41D515E0D737D061C7279BBD2CA0BC69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution phantom_stealer persistence stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.prensiptur.com
Port
587
Username
[email protected]
Password
Muh1234pre

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
mail.prensiptur.com
Port
587
Username
[email protected]
Password
Muh1234pre
Email to
[email protected]

Mutex

2PH1Z4JBYBBSUCNWOUVE

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
1

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 1 IoCs

resource	yara_rule
behavioral2/memory/6016-21-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

Executes dropped EXE 1 IoCs

pid	Process
6196	aspnet_compiler.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3730367222-316663987-825798519-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-3730367222-316663987-825798519-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-3730367222-316663987-825798519-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3730367222-316663987-825798519-1000\Software\Microsoft\Windows\CurrentVersion\Run\aspnet_compiler = "C:\\Users\\Admin\\AppData\\Roaming\\aspnet_compiler.exe"	aspnet_compiler.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	icanhazip.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2204 set thread context of 6016	2204	PowerShell.exe	96

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2204	PowerShell.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1412	chrome.exe
1444	msedge.exe
1120	msedge.exe
8120	chrome.exe

Checks processor information in registry 2 TTPs 40 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	aspnet_compiler.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	aspnet_compiler.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3730367222-316663987-825798519-1000\{10381E4E-4D93-4317-A1AD-1253D89ACB0D}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2204	PowerShell.exe
2204	PowerShell.exe
2204	PowerShell.exe
2204	PowerShell.exe
2204	PowerShell.exe
2204	PowerShell.exe
2204	PowerShell.exe
2204	PowerShell.exe
2204	PowerShell.exe
2204	PowerShell.exe
2204	PowerShell.exe
2204	PowerShell.exe
2204	PowerShell.exe
2204	PowerShell.exe
2204	PowerShell.exe
6016	aspnet_compiler.exe
6016	aspnet_compiler.exe
1016	chrome.exe
1016	chrome.exe
6016	aspnet_compiler.exe
6016	aspnet_compiler.exe
6016	aspnet_compiler.exe
6016	aspnet_compiler.exe
2204	PowerShell.exe
2204	PowerShell.exe
6016	aspnet_compiler.exe
6016	aspnet_compiler.exe
6016	aspnet_compiler.exe
6016	aspnet_compiler.exe
6720	firefox.exe
6720	firefox.exe
6016	aspnet_compiler.exe
6720	firefox.exe
6720	firefox.exe
6720	firefox.exe
6720	firefox.exe
6720	firefox.exe
6720	firefox.exe
6720	firefox.exe
6720	firefox.exe
6720	firefox.exe
6720	firefox.exe
6720	firefox.exe
6720	firefox.exe
6720	firefox.exe
6720	firefox.exe
2204	PowerShell.exe
6016	aspnet_compiler.exe
6016	aspnet_compiler.exe
6016	aspnet_compiler.exe
6016	aspnet_compiler.exe
6016	aspnet_compiler.exe
2204	PowerShell.exe
6016	aspnet_compiler.exe
6016	aspnet_compiler.exe
6016	aspnet_compiler.exe
6016	aspnet_compiler.exe
6016	aspnet_compiler.exe
6016	aspnet_compiler.exe
6016	aspnet_compiler.exe
6016	aspnet_compiler.exe
2204	PowerShell.exe
2204	PowerShell.exe
6016	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2204	PowerShell.exe
Token: SeDebugPrivilege	6016	aspnet_compiler.exe
Token: SeShutdownPrivilege	1016	chrome.exe
Token: SeCreatePagefilePrivilege	1016	chrome.exe
Token: SeShutdownPrivilege	1016	chrome.exe
Token: SeCreatePagefilePrivilege	1016	chrome.exe
Token: SeShutdownPrivilege	7788	chrome.exe
Token: SeCreatePagefilePrivilege	7788	chrome.exe
Token: SeShutdownPrivilege	7788	chrome.exe
Token: SeCreatePagefilePrivilege	7788	chrome.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
1016	chrome.exe
1016	chrome.exe
6720	firefox.exe
6720	firefox.exe
6720	firefox.exe
6720	firefox.exe
6720	firefox.exe
6720	firefox.exe
6720	firefox.exe
6720	firefox.exe
2492	msedge.exe
3124	msedge.exe
6564	firefox.exe
6564	firefox.exe
6564	firefox.exe
6564	firefox.exe
6564	firefox.exe
6564	firefox.exe
6564	firefox.exe
6564	firefox.exe
7788	chrome.exe
7788	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6720	firefox.exe
6564	firefox.exe
6016	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 6108	2204	PowerShell.exe	91
PID 2204 wrote to memory of 3112	2204	PowerShell.exe	92
PID 2204 wrote to memory of 5352	2204	PowerShell.exe	93
PID 2204 wrote to memory of 6100	2204	PowerShell.exe	94
PID 2204 wrote to memory of 5908	2204	PowerShell.exe	95
PID 2204 wrote to memory of 6016	2204	PowerShell.exe	96
PID 2204 wrote to memory of 6016	2204	PowerShell.exe	96
PID 2204 wrote to memory of 6016	2204	PowerShell.exe	96
PID 2204 wrote to memory of 6016	2204	PowerShell.exe	96
PID 2204 wrote to memory of 6016	2204	PowerShell.exe	96
PID 6016 wrote to memory of 1016	6016	aspnet_compiler.exe	100
PID 1016 wrote to memory of 2340	1016	chrome.exe	101
PID 6016 wrote to memory of 1016	6016	aspnet_compiler.exe	100
PID 6016 wrote to memory of 1016	6016	aspnet_compiler.exe	100
PID 1016 wrote to memory of 4800	1016	chrome.exe	102
PID 1016 wrote to memory of 1412	1016	chrome.exe	103
PID 1016 wrote to memory of 2748	1016	chrome.exe	104
PID 6016 wrote to memory of 2340	6016	aspnet_compiler.exe	101
PID 6016 wrote to memory of 2340	6016	aspnet_compiler.exe	101
PID 1016 wrote to memory of 2412	1016	chrome.exe	105
PID 1016 wrote to memory of 4476	1016	chrome.exe	106
PID 1016 wrote to memory of 4816	1016	chrome.exe	107
PID 1016 wrote to memory of 5900	1016	chrome.exe	108
PID 1016 wrote to memory of 1292	1016	chrome.exe	109
PID 6016 wrote to memory of 4800	6016	aspnet_compiler.exe	102
PID 6016 wrote to memory of 4800	6016	aspnet_compiler.exe	102
PID 6016 wrote to memory of 1016	6016	aspnet_compiler.exe	100
PID 6016 wrote to memory of 1016	6016	aspnet_compiler.exe	100
PID 1016 wrote to memory of 5672	1016	chrome.exe	110
PID 6016 wrote to memory of 4476	6016	aspnet_compiler.exe	106
PID 6016 wrote to memory of 4476	6016	aspnet_compiler.exe	106
PID 6016 wrote to memory of 1292	6016	aspnet_compiler.exe	109
PID 6016 wrote to memory of 2340	6016	aspnet_compiler.exe	101
PID 6016 wrote to memory of 2340	6016	aspnet_compiler.exe	101
PID 6016 wrote to memory of 5900	6016	aspnet_compiler.exe	108
PID 6016 wrote to memory of 5900	6016	aspnet_compiler.exe	108
PID 6016 wrote to memory of 4816	6016	aspnet_compiler.exe	107
PID 6016 wrote to memory of 4816	6016	aspnet_compiler.exe	107
PID 6016 wrote to memory of 1412	6016	aspnet_compiler.exe	103
PID 6016 wrote to memory of 1412	6016	aspnet_compiler.exe	103
PID 6016 wrote to memory of 2748	6016	aspnet_compiler.exe	104
PID 6016 wrote to memory of 2748	6016	aspnet_compiler.exe	104
PID 1016 wrote to memory of 5816	1016	chrome.exe	111
PID 1016 wrote to memory of 6620	1016	chrome.exe	112
PID 6016 wrote to memory of 4800	6016	aspnet_compiler.exe	102
PID 1016 wrote to memory of 3224	1016	chrome.exe	113
PID 6016 wrote to memory of 4800	6016	aspnet_compiler.exe	102
PID 6016 wrote to memory of 1016	6016	aspnet_compiler.exe	100
PID 6016 wrote to memory of 1016	6016	aspnet_compiler.exe	100
PID 6016 wrote to memory of 5672	6016	aspnet_compiler.exe	110
PID 6016 wrote to memory of 5672	6016	aspnet_compiler.exe	110
PID 6016 wrote to memory of 4476	6016	aspnet_compiler.exe	106
PID 6016 wrote to memory of 4476	6016	aspnet_compiler.exe	106
PID 6016 wrote to memory of 6620	6016	aspnet_compiler.exe	112
PID 6016 wrote to memory of 6620	6016	aspnet_compiler.exe	112
PID 6016 wrote to memory of 1292	6016	aspnet_compiler.exe	109
PID 6016 wrote to memory of 1292	6016	aspnet_compiler.exe	109
PID 6016 wrote to memory of 2340	6016	aspnet_compiler.exe	101
PID 6016 wrote to memory of 2340	6016	aspnet_compiler.exe	101
PID 6016 wrote to memory of 5900	6016	aspnet_compiler.exe	108
PID 6016 wrote to memory of 5900	6016	aspnet_compiler.exe	108
PID 6016 wrote to memory of 4816	6016	aspnet_compiler.exe	107
PID 6016 wrote to memory of 4816	6016	aspnet_compiler.exe	107
PID 6016 wrote to memory of 1412	6016	aspnet_compiler.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3730367222-316663987-825798519-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3730367222-316663987-825798519-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\G54NBV10.ps1
1⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:6108
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3112
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5352
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:6100
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5908
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:6016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yrhzwuim.w2n"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1016
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\yrhzwuim.w2n /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\yrhzwuim.w2n\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\yrhzwuim.w2n --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff99ae0c728,0x7ff99ae0c734,0x7ff99ae0c740
      4⤵
      PID:2340
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yrhzwuim.w2n" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1720,i,584945463993059801,7468756275089649027,262144 --field-trial-handle=1876,i,6487443501823656051,1147661571385606828,262144 --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:2
      4⤵
      PID:4800
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yrhzwuim.w2n" --force-high-res-timeticks=disabled --metrics-shmem-handle=2144,i,6007541098696224919,15679537300952887915,524288 --field-trial-handle=1876,i,6487443501823656051,1147661571385606828,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:11
      4⤵
      System Time Discovery
      PID:1412
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yrhzwuim.w2n" --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,5297234474714977373,15831203679662174511,524288 --field-trial-handle=1876,i,6487443501823656051,1147661571385606828,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:13
      4⤵
      PID:2748
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yrhzwuim.w2n" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,11034835345258772414,4961185548527143902,2097152 --field-trial-handle=1876,i,6487443501823656051,1147661571385606828,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:1
      4⤵
      PID:2412
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yrhzwuim.w2n" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,13976437782989714168,9635215670194851572,2097152 --field-trial-handle=1876,i,6487443501823656051,1147661571385606828,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:1
      4⤵
      PID:4476
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yrhzwuim.w2n" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3492,i,10411309593921430409,13429058560019182146,2097152 --field-trial-handle=1876,i,6487443501823656051,1147661571385606828,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
      4⤵
      PID:4816
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yrhzwuim.w2n" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3532,i,4545814811534566774,11197329228717800275,2097152 --field-trial-handle=1876,i,6487443501823656051,1147661571385606828,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:9
      4⤵
      PID:5900
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yrhzwuim.w2n" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4044,i,8138302299070324944,1617016712406584779,2097152 --field-trial-handle=1876,i,6487443501823656051,1147661571385606828,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:9
      4⤵
      PID:1292
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yrhzwuim.w2n" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4520,i,15952123699393766111,5244814656549198800,2097152 --field-trial-handle=1876,i,6487443501823656051,1147661571385606828,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
      4⤵
      PID:5672
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yrhzwuim.w2n" --force-high-res-timeticks=disabled --metrics-shmem-handle=4532,i,3198522207616127783,10725264815011295300,524288 --field-trial-handle=1876,i,6487443501823656051,1147661571385606828,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:14
      4⤵
      PID:5816
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yrhzwuim.w2n" --force-high-res-timeticks=disabled --metrics-shmem-handle=4668,i,721744471087694367,7471726921241407458,524288 --field-trial-handle=1876,i,6487443501823656051,1147661571385606828,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:14
      4⤵
      PID:6620
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yrhzwuim.w2n" --force-high-res-timeticks=disabled --metrics-shmem-handle=4620,i,16078700116808294048,18322807624204172917,524288 --field-trial-handle=1876,i,6487443501823656051,1147661571385606828,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:14
      4⤵
      PID:3224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dqqoycjm.ii4"
    3⤵
    PID:6140
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\dqqoycjm.ii4
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:6720
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {a7666122-7062-4b05-9e1a-7f8c63c65d90} -parentPid 6720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6720" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:4464
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2316 -prefsLen 27133 -prefMapHandle 2320 -prefMapSize 270279 -ipcHandle 2312 -initialChannelId {3d4ebe21-4139-4002-95bb-07fb3c9ac613} -parentPid 6720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:5520
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6c74f393-8b11-4f9e-bf67-130a83873da3.dmp"
        5⤵
        
        PID:2316
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2172 -prefsLen 27133 -prefMapHandle 2716 -prefMapSize 270279 -ipcHandle 2752 -initialChannelId {2397b0fa-9dd3-47ec-afaa-66eaabbabb8e} -parentPid 6720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6720" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:2076
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6c08b22a-6aa5-49ec-aff8-58ec0771a5a3.dmp"
        5⤵
        
        PID:1784
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2752 -prefsLen 27133 -prefMapHandle 2964 -prefMapSize 270279 -ipcHandle 2976 -initialChannelId {649ecb44-ba9d-4372-b8d9-7e417906c0c8} -parentPid 6720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6720" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:1888
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3796 -prefsLen 27323 -prefMapHandle 3800 -prefMapSize 270279 -jsInitHandle 3804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3812 -initialChannelId {0f2b60f8-6b0e-4933-82f1-a0e3a8b81363} -parentPid 6720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:6404
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\71e48b91-5f43-4256-abb8-153233a56049.dmp"
        5⤵
        
        PID:6820
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2976 -prefsLen 27323 -prefMapHandle 3520 -prefMapSize 270279 -ipcHandle 3144 -initialChannelId {413ce6c8-c1e4-4a88-b9d5-3d59a87447c1} -parentPid 6720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6720" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:3780
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e80ee6e4-d7a8-4fde-a56c-22193ed14a64.dmp"
        5⤵
        
        PID:2248
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3084 -prefsLen 27323 -prefMapHandle 3100 -prefMapSize 270279 -ipcHandle 3164 -initialChannelId {d782f927-3e2a-4947-aaa5-8f0a8dc62da5} -parentPid 6720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6720" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 rdd
        5⤵
        
        PID:2476
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3212 -prefsLen 34822 -prefMapHandle 3216 -prefMapSize 270279 -jsInitHandle 3572 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4716 -initialChannelId {4a4fb6e6-69ea-465e-9826-e81d08687057} -parentPid 6720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:2948
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2548 -prefsLen 35010 -prefMapHandle 5220 -prefMapSize 270279 -ipcHandle 3312 -initialChannelId {afef9b89-0a38-4fe2-8b08-ce0a5dc8b9ed} -parentPid 6720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        5⤵
        Checks processor information in registry
        
        PID:4936
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5304 -prefsLen 32900 -prefMapHandle 5308 -prefMapSize 270279 -jsInitHandle 5312 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5320 -initialChannelId {56bb5af5-2322-48f4-9961-31a2ee91054f} -parentPid 6720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:3780
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5532 -prefsLen 32952 -prefMapHandle 5536 -prefMapSize 270279 -jsInitHandle 5540 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5468 -initialChannelId {05143aca-c3e9-446d-a9a3-4e8a4c37c29b} -parentPid 6720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:5996
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5712 -prefsLen 32952 -prefMapHandle 5716 -prefMapSize 270279 -jsInitHandle 5720 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5536 -initialChannelId {23a810de-fd18-4fc9-b713-a8a2c8392662} -parentPid 6720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:6644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x224,0x324,0x7ff99a7ec188,0x7ff99a7ec194,0x7ff99a7ec1a0
      4⤵
      PID:6844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1988,i,8088857658790424632,1393488161532495952,262144 --field-trial-handle=2652,i,5278668793142986422,4003787579340414124,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:2
      4⤵
      PID:2568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,8464603307574183096,10023681398359754506,524288 --field-trial-handle=2652,i,5278668793142986422,4003787579340414124,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:11
      4⤵
      System Time Discovery
      PID:1444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,3089855935014560027,17268551304470228425,524288 --field-trial-handle=2652,i,5278668793142986422,4003787579340414124,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:13
      4⤵
      PID:2480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3256,i,3490809777891841475,8477703610317246213,2097152 --field-trial-handle=2652,i,5278668793142986422,4003787579340414124,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:1
      4⤵
      PID:1852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3264,i,11513921097429361399,2087454246795575786,2097152 --field-trial-handle=2652,i,5278668793142986422,4003787579340414124,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:1
      4⤵
      PID:4548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,3873083403224471528,1916682181482940984,524288 --field-trial-handle=2652,i,5278668793142986422,4003787579340414124,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14
      4⤵
      PID:5636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,10273314857465165043,9966859450063272884,524288 --field-trial-handle=2652,i,5278668793142986422,4003787579340414124,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:14
      4⤵
      PID:1160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,12112125387911346493,1036383180506603416,524288 --field-trial-handle=2652,i,5278668793142986422,4003787579340414124,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:14
      4⤵
      PID:3804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3792,i,18333553743096761947,2383692207912885031,2097152 --field-trial-handle=2652,i,5278668793142986422,4003787579340414124,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:1
      4⤵
      PID:6320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3844,i,10382017332236806250,6976100737001046398,2097152 --field-trial-handle=2652,i,5278668793142986422,4003787579340414124,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:9
      4⤵
      PID:3328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3876,i,463840490460560524,17614840525804407257,2097152 --field-trial-handle=2652,i,5278668793142986422,4003787579340414124,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:1
      4⤵
      PID:5976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3900,i,15896287452112961912,3396632245269496778,2097152 --field-trial-handle=2652,i,5278668793142986422,4003787579340414124,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:9
      4⤵
      PID:980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3916,i,2031102404147932789,3660427970738790257,2097152 --field-trial-handle=2652,i,5278668793142986422,4003787579340414124,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:1
      4⤵
      PID:6784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3944,i,7086562475878383625,16301966190458994555,2097152 --field-trial-handle=2652,i,5278668793142986422,4003787579340414124,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:9
      4⤵
      PID:2664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3940,i,17514802238969722436,14548993852748260720,2097152 --field-trial-handle=2652,i,5278668793142986422,4003787579340414124,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:1
      4⤵
      PID:6924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3956,i,5781690589221707517,3445605172260837137,2097152 --field-trial-handle=2652,i,5278668793142986422,4003787579340414124,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:9
      4⤵
      PID:2824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3992,i,17057947967538762517,2905642603776448842,2097152 --field-trial-handle=2652,i,5278668793142986422,4003787579340414124,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:1
      4⤵
      PID:5916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4012,i,13655564111304509262,17769729875830546349,2097152 --field-trial-handle=2652,i,5278668793142986422,4003787579340414124,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:9
      4⤵
      PID:6640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4108,i,13190705884776589501,3274016398433438289,524288 --field-trial-handle=2652,i,5278668793142986422,4003787579340414124,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:14
      4⤵
      PID:4468
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1156
        5⤵
        
        PID:6988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,7661244263035105519,14017989454219200934,524288 --field-trial-handle=2652,i,5278668793142986422,4003787579340414124,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
      4⤵
      PID:1120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,6871761327264335612,763724152460322788,524288 --field-trial-handle=2652,i,5278668793142986422,4003787579340414124,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
      4⤵
      PID:2116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,4374098615037967584,8151035825628722120,524288 --field-trial-handle=2652,i,5278668793142986422,4003787579340414124,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14
      4⤵
      PID:1636
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=624
        5⤵
        
        PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4748,i,17659448618062530857,12103322590754631525,524288 --field-trial-handle=2652,i,5278668793142986422,4003787579340414124,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14
      4⤵
      PID:2596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4752,i,12191938240248088242,13687981950010241902,524288 --field-trial-handle=2652,i,5278668793142986422,4003787579340414124,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
      4⤵
      PID:6052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,9796992889668929377,18092057848556143687,524288 --field-trial-handle=2652,i,5278668793142986422,4003787579340414124,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:14
      4⤵
      PID:1116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,9796992889668929377,18092057848556143687,524288 --field-trial-handle=2652,i,5278668793142986422,4003787579340414124,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:14
      4⤵
      PID:1852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:3124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x26c,0x7ff99a7ec188,0x7ff99a7ec194,0x7ff99a7ec1a0
      4⤵
      PID:2464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1816,i,4949702688970844402,705485466051937556,262144 --field-trial-handle=2480,i,3913275729824812585,492618513944363096,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:2
      4⤵
      PID:5520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2044,i,17442172270084690243,2395439878392949684,524288 --field-trial-handle=2480,i,3913275729824812585,492618513944363096,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:11
      4⤵
      System Time Discovery
      PID:1120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2652,i,16677087553492886224,14967701654928593080,524288 --field-trial-handle=2480,i,3913275729824812585,492618513944363096,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:13
      4⤵
      PID:2476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,5503708983014483857,13977655741651729426,2097152 --field-trial-handle=2480,i,3913275729824812585,492618513944363096,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
      4⤵
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,1573598145764933319,665404565601339738,2097152 --field-trial-handle=2480,i,3913275729824812585,492618513944363096,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:2232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,15909501177121960320,2823768755169543420,524288 --field-trial-handle=2480,i,3913275729824812585,492618513944363096,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:14
      4⤵
      PID:2412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3972,i,1147444163658942953,18332002951682405785,524288 --field-trial-handle=2480,i,3913275729824812585,492618513944363096,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:14
      4⤵
      PID:452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3976,i,5701742868583371993,13561965811469317572,524288 --field-trial-handle=2480,i,3913275729824812585,492618513944363096,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:14
      4⤵
      PID:6752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4060,i,6875704243019749478,8327451336108633447,2097152 --field-trial-handle=2480,i,3913275729824812585,492618513944363096,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
      4⤵
      PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4080,i,12868973166809746689,2456524428587681350,2097152 --field-trial-handle=2480,i,3913275729824812585,492618513944363096,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:9
      4⤵
      PID:7164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4124,i,13441626572054461443,10179876226945308960,2097152 --field-trial-handle=2480,i,3913275729824812585,492618513944363096,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
      4⤵
      PID:612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4176,i,3102694913047451453,15898839202825399684,2097152 --field-trial-handle=2480,i,3913275729824812585,492618513944363096,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:9
      4⤵
      PID:3548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4192,i,717616385647269887,13172161580850498155,2097152 --field-trial-handle=2480,i,3913275729824812585,492618513944363096,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:1
      4⤵
      PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4204,i,9375612388500937660,10518502208542303841,2097152 --field-trial-handle=2480,i,3913275729824812585,492618513944363096,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:9
      4⤵
      PID:6348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4252,i,2297213401438217648,13754104312016415052,2097152 --field-trial-handle=2480,i,3913275729824812585,492618513944363096,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
      4⤵
      PID:5456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4276,i,12584565015690143803,4758472270193975430,2097152 --field-trial-handle=2480,i,3913275729824812585,492618513944363096,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:9
      4⤵
      PID:704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4316,i,15018197568545199466,14464079784309958938,2097152 --field-trial-handle=2480,i,3913275729824812585,492618513944363096,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
      4⤵
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4328,i,16882116407467078750,4498860272941214998,2097152 --field-trial-handle=2480,i,3913275729824812585,492618513944363096,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:9
      4⤵
      PID:6836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,13858281900223501638,14137671802570591860,524288 --field-trial-handle=2480,i,3913275729824812585,492618513944363096,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
      4⤵
      PID:4116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1416
        5⤵
        
        PID:6404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,11646821683621793074,12469712359668186335,524288 --field-trial-handle=2480,i,3913275729824812585,492618513944363096,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
      4⤵
      PID:6420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=632
        5⤵
        
        PID:4740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,10248186654656230559,478184755891741564,524288 --field-trial-handle=2480,i,3913275729824812585,492618513944363096,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
      4⤵
      PID:1020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,4124635737880316153,10689752483848276320,524288 --field-trial-handle=2480,i,3913275729824812585,492618513944363096,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
      4⤵
      PID:5412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,13571760026466258595,4553259676784517483,524288 --field-trial-handle=2480,i,3913275729824812585,492618513944363096,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
      4⤵
      PID:1392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,3639131984073922058,3621455476028289011,524288 --field-trial-handle=2480,i,3913275729824812585,492618513944363096,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:14
      4⤵
      PID:3416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4bmwme4u.gpq"
    3⤵
    PID:3208
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\4bmwme4u.gpq
      4⤵
      Checks processor information in registry
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:6564
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270331 -ipcHandle 2028 -initialChannelId {4d9d36c5-d042-49b0-8a08-f3c3a15c2345} -parentPid 6564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6564" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:5896
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2328 -prefsLen 27133 -prefMapHandle 2300 -prefMapSize 270331 -ipcHandle 2320 -initialChannelId {2a0caf7e-9e39-4796-8d54-fc991a41d9c8} -parentPid 6564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:2676
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\073f60a1-a87a-40a7-ade2-12874f040f83.dmp"
        5⤵
        
        PID:6132
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2188 -prefsLen 27133 -prefMapHandle 2912 -prefMapSize 270331 -ipcHandle 2920 -initialChannelId {f1f3e18f-66fe-410a-be9a-02c953659f21} -parentPid 6564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6564" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:936
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\35d748dd-857f-4f79-9bb7-d513f20b9b8b.dmp"
        5⤵
        
        PID:5852
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2956 -prefsLen 27133 -prefMapHandle 3032 -prefMapSize 270331 -ipcHandle 2952 -initialChannelId {8e881bf1-ba77-484d-87cf-5ff3ebf40319} -parentPid 6564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6564" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:3364
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b7e7fed9-1529-4656-9e7a-4bd3e4d0dc20.dmp"
        5⤵
        
        PID:6204
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3412 -prefsLen 27198 -prefMapHandle 2952 -prefMapSize 270331 -ipcHandle 3404 -initialChannelId {a5afd22c-e518-45fe-b258-d4f9322fc891} -parentPid 6564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6564" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:2788
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3568 -prefsLen 27323 -prefMapHandle 3572 -prefMapSize 270331 -jsInitHandle 3576 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3772 -initialChannelId {deff9baa-bb34-44dc-b7b7-c944fa39faea} -parentPid 6564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:1520
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b9eee0b8-0351-44dd-9b6a-98a8c34f1da1.dmp"
        5⤵
        
        PID:6696
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3404 -prefsLen 27323 -prefMapHandle 4084 -prefMapSize 270331 -ipcHandle 3956 -initialChannelId {bd73981a-45dd-4eb2-813c-f11829d47d16} -parentPid 6564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6564" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:5376
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\88cf75c1-50de-4bca-9081-36074dcc22d6.dmp"
        5⤵
        
        PID:3956
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3124 -prefsLen 27323 -prefMapHandle 3024 -prefMapSize 270331 -ipcHandle 4184 -initialChannelId {fbfd95c9-2faa-4815-aae7-59d53b79da69} -parentPid 6564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6564" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:5680
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3016 -prefsLen 34876 -prefMapHandle 3020 -prefMapSize 270331 -jsInitHandle 3324 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1624 -initialChannelId {05c0a06a-84cd-4934-b078-ebb0c300c3a7} -parentPid 6564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:6804
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5096 -prefsLen 34876 -prefMapHandle 5092 -prefMapSize 270331 -ipcHandle 5072 -initialChannelId {bd540434-cb91-4261-80ff-9ca521557ea6} -parentPid 6564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:7404
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5248 -prefsLen 32766 -prefMapHandle 5252 -prefMapSize 270331 -jsInitHandle 5256 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5264 -initialChannelId {b82550c2-8b48-42c8-b29e-7ae56f727af8} -parentPid 6564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:7412
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5284 -prefsLen 32766 -prefMapHandle 5288 -prefMapSize 270331 -jsInitHandle 5292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5300 -initialChannelId {2736eb4e-8ed5-407a-bbbc-863854ae9008} -parentPid 6564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:7420
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5648 -prefsLen 32818 -prefMapHandle 5652 -prefMapSize 270331 -jsInitHandle 5656 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5664 -initialChannelId {a3ed45f1-9d73-4045-b0f0-9c879245f609} -parentPid 6564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:7428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2opknyw.uwn"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:7788
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\l2opknyw.uwn /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\l2opknyw.uwn\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\l2opknyw.uwn --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff99a89c728,0x7ff99a89c734,0x7ff99a89c740
      4⤵
      PID:7800
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2opknyw.uwn" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1860,i,15063335856447158292,6076606489987854673,262144 --field-trial-handle=2632,i,9128373752744634495,13461573768165414782,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:2
      4⤵
      PID:8112
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2opknyw.uwn" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2076,i,6504131682510615390,2188305929519736520,524288 --field-trial-handle=2632,i,9128373752744634495,13461573768165414782,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:11
      4⤵
      System Time Discovery
      PID:8120
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2opknyw.uwn" --force-high-res-timeticks=disabled --metrics-shmem-handle=2268,i,13016948851482033157,4990279724128537751,524288 --field-trial-handle=2632,i,9128373752744634495,13461573768165414782,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:13
      4⤵
      PID:8128
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2opknyw.uwn" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,12989328854175082793,15202960103297301129,2097152 --field-trial-handle=2632,i,9128373752744634495,13461573768165414782,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
      4⤵
      PID:5836
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2opknyw.uwn" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,9512946615739377854,10329123211414916076,2097152 --field-trial-handle=2632,i,9128373752744634495,13461573768165414782,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
      4⤵
      PID:5364
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2opknyw.uwn" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3428,i,8601662488093950822,9895902477816678184,2097152 --field-trial-handle=2632,i,9128373752744634495,13461573768165414782,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:1
      4⤵
      PID:3428
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2opknyw.uwn" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3444,i,7413693401647420170,14769563474620239826,2097152 --field-trial-handle=2632,i,9128373752744634495,13461573768165414782,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:9
      4⤵
      PID:480
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2opknyw.uwn" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3996,i,13057372739416831678,3727153288847202520,2097152 --field-trial-handle=2632,i,9128373752744634495,13461573768165414782,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:9
      4⤵
      PID:4160
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2opknyw.uwn" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4492,i,7432692213061706792,12766527735007802200,2097152 --field-trial-handle=2632,i,9128373752744634495,13461573768165414782,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:1
      4⤵
      PID:7084
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2opknyw.uwn" --force-high-res-timeticks=disabled --metrics-shmem-handle=4620,i,17429327532648727404,759657523423147298,524288 --field-trial-handle=2632,i,9128373752744634495,13461573768165414782,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:14
      4⤵
      PID:1196
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2opknyw.uwn" --force-high-res-timeticks=disabled --metrics-shmem-handle=4624,i,18417843248926241034,6250106434838153986,524288 --field-trial-handle=2632,i,9128373752744634495,13461573768165414782,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:14
      4⤵
      PID:6744
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2opknyw.uwn" --force-high-res-timeticks=disabled --metrics-shmem-handle=4700,i,14770851246678526265,11616560978682791781,524288 --field-trial-handle=2632,i,9128373752744634495,13461573768165414782,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:14
      4⤵
      PID:2712

C:\Users\Admin\AppData\Roaming\aspnet_compiler.exe
C:\Users\Admin\AppData\Roaming\aspnet_compiler.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\activity-stream.contile.json
Size 4KB
SHA256 1d8a3545846785bf32a8cebbe90b43192fa1e55da31495ab8967f4f3c205d6d1
MD5 2b2637ce548f37599fad6f0f06e11ce2
SHA1 2250bd369c1e8383505045b9b8beb3d0e4be6049
SHA512 439ab16fbfc4eb1665f2605ff5ebf9e8d76bf5c2887be502af63eaf3bcc247825f229a13869746d5d2fa18cdda78082ecb44cf66aea04f262196a664b8b22525
SSDEEP 48:YdbAP5eDX13bpDhMQl8DLv0Ptj4io2QuXeYCM5eDXh3DhG0jd1BuhvhUpAJQFpdu:TqKe8DZuuxA2djUvGpFB4S4TNsChkY
TLSH
T13CA12BA79925D89B0322F7F13C5F33887157F10E99E9DA4EBBCA8C01A9E530640E9244
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\activity-stream.discovery_stream.json
Size 74KB
SHA256 7a04fdb2c67aa2a197b7a22b610d043045b44cfbe044b13a3409e40b1db3c164
MD5 ddd4fa42df1cfdfa2cedbd01b80a4154
SHA1 06e77d2530335dd6f8f78d940110adf4879ace3f
SHA512 744ac38c04d3740cec2ad93670c4ba7df8f15fccfaac6feef3f401a41e7d0f0eba6989743dca3d7987e2dd9607e36b79a3ae346de4f8e69a8f15c2e0c05450b1
SSDEEP 1536:xzDjpAw08g31VOsxvm3/PQ0Jf6CIYQ9nbtCdnk6u1:xNW8g31VOsxY1JfxIYQ9bte4
TLSH
T1127308A396E8B1FB0BA137CB2C0F796BA2D50155E34A05C9FCEDCA1C818C645123F5AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03100235E7AEBB25C597DD91664A8F544DDFC529

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
Size 13KB
SHA256 04eea3f2ed20c194c3a73a6e078afdac6fdaff29f5bb643c57a6577c8c18c933
MD5 13481f73710dfb77689b59f31d1e77a6
SHA1 67bc1ca6878fb34d00e23e03421370cd3192c316
SHA512 5f74a5c9a9f4970fadb304c45a14252929422996af199a4235f8ed2c1158ce3c72c3a91097bffcdf05cb7a2570a153e0f5829703cc9ba0572b50582a851d2aa1
SSDEEP 384:HPC9iO024Yyo6J+Sl1xDnZBPsac4j0lpDII+a/yvT/yvQG:v9ZYyo0+Sl7zZlsac4ID8Loyjyp
TLSH
T149528DBE9F0238AE1927D1A5D5FE9244CD04E6BFDEE2906619143C04CA447B9F4E68CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 1d35f38549efb2bc619f1d3b29e8edbd46ab0c36b88893b372cd1fec1dbe869b
MD5 5db6b843cb4a999d228d1b5ccf15bdff
SHA1 377084f4e1d5e95932d97b709fb0def06160d02b
SHA512 03e5193f73dcc0b9dffebaa01cebc2a0c0f1f9efb458c39eab3491bd5443fc21786790a98f41b9b9f007f7f98e0e7a155d88793a5312bfdb631bf0032ff9f7ed
SSDEEP 3072:j3lq7k6uT2B0x2OV/WYnEbBJOpdwNzQKeO:pU+2ywaj+BNNTb
TLSH
T15FA3AFFACBA28D3D55FF941C5B82C93EFD272404B3A73009C923675462C6F786679648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi\Crashpad\settings.dat
Size 280B
SHA256 fde06140ea3b324c871a45393e8c09e26954c4b6385229ff5225e2de0f155618
MD5 0a81064b06ddf638c1b419697881ff26
SHA1 861eba059b90018226d92d0d34ee5a02bd0a43a1
SHA512 00f8e3257c88607e7d3a0937476d24db260105bf5cf5ed2d2c2b4064c34b9962484a8562d7a154b3f5658b29b04f26a24278416abfe564b54c5ad966c667220a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi\Crashpad\settings.dat
Size 280B
SHA256 637fd09318a7abeb2145a235ab94cddd7f160f1ceddddf54a6909935ea942a9f
MD5 beefe94aa9884deb1e3200b396f8c0c3
SHA1 34418aecd0d162a9b5041404455e05284bd942d7
SHA512 f46e46020fb58a3b0bb07b12557fe3ed815e88d45abed9690e46652cfb524de0dcbd0f38021dc715ab5420fa51043c3844e6d2c910f73a4f0e9ba4bd991eb635
TLSH
T1E1D02230F33EBB88C002E23300E8BFB0280A8320080020C0C02800088AE32A830822A2
MD5 SHA1 SHA512 TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi\Default\Cache\Cache_Data\f_000001
Size 32KB
SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
MD5 cba69340542e691fa9e4b30334a07507
SHA1 4af443e83868d3a18fc9ad853e58eaf39bb065f7
SHA512 4f8d78c0ae8e04e27dfbcef602d3d46cdefd8f01085cc549edd35805d775065c4f78b75da617adf5f8f699a9edf7fa69db7c267917e5f9cb967e59563f905227
SSDEEP 768:wOsAPzChBrMSp8DxHnpmf3ILP1KpbjtXPgYVkutZ:lsArKDqtO8KZtXPgYXtZ
TLSH
T17AE202DF0C15679A01C371AE6A7C6024EBB3E07B3035CA1B1E764CD250B6660E5DB8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi\Default\Cache\Cache_Data\f_000002
Size 96KB
SHA256 11de5a5aa3d08f69e1db14ac9c5347b7d09b8ec8fa89a4dd48a53ac13bfc3af2
MD5 601873d8a87f7b6dc6d2be569d361b63
SHA1 90ddce036c5ac461fc0e2ad6d2549625f35fcad8
SHA512 8d0aa2ed004fd07ff6c8cf0b2f96bf2addadcc481e811d3070d206a2862ebd154f857021dc0186eff184667914b6e23239b3886e18521bbe109e9c70df09ea1e
SSDEEP 3072:TY9ViJr6dK5Zi9YhM9Dic9o4EKgg3Wn41QA2kCISlb5:EeV6dmIx9lSg3c4FCIgl
TLSH
T18DA3020ABF4FE1AE46B742548AB607CE7A906241D0369997871107CEB1F78FE5C183D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi\Default\Cache\Cache_Data\f_000003
Size 67KB
SHA256 143b0031161178b25674ef7cee2e295e1e993bbedefbccee6c2861ba5054c8ff
MD5 9d44edb3bed3f0f8ff98f4b68e9fffeb
SHA1 ee4ae0dfeaf007ad5b84b7f2253213239a3d31dd
SHA512 bbc32f82f66b0e9be59a03ec647fecbb17c22b464a217f888c6763f6de50e80c6fe83081886ebf497cb96fa3a00cf8f8568067adf5d61fd66ad668f8877940e3
SSDEEP 1536:EZmVI0eY3E1Yv/u3u141SAiGgYbdOPN5MoQjw6neDMi:EgVb930YnyqVEQPXMfU6neDMi
TLSH
T172631250C2B67F275EF172E7B94F4F78077E0889DD661C26D71D28AA3FA64CE09A0480
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi\Default\Cache\Cache_Data\f_000004
Size 401KB
SHA256 8c8d0ad93919389c8b1f48ebabcb267fbf0a62ca97352ee8f2ded1d3d25a37a0
MD5 7572662417d9329bd1cf1ce787885439
SHA1 e77c60d935d216186bbba4b253e1b0c40689f2a0
SHA512 84e36d75361c2ba38599b2892db44c4f458b626d3321723cadb00015c0f6c2e8170cc318cce97aad11600c2e3605e8f1076c7593ca23362c9d4365ca606f8d23
SSDEEP 6144:bXFVrEsfmV2moeYshnj+eTL+7fUopbHxButqPl18JyDvn4pntoRIP4oGf:bLrlfmV2moetS7fJbLutG8sDeoR7oC
TLSH
T1FB9423F2F8E1BDFAC5EE76C22D7A625A15E48A1C6789CE54FC888A77D58037103F2510
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi\Default\Cache\Cache_Data\f_000008
Size 27KB
SHA256 4055c08923c81d63735c1691baa778c332bf680b8c4eb057d7b87e2c00c5578d
MD5 aa6a30350189be311d6f87b7d145d85b
SHA1 79d0105a90db8fe73876d31dc4f54bb9a194002a
SHA512 3563cdd2399d4ffe7f76a2b252800e2b767f7fc776fe1faf1bd385cc41ff9305c7a5367a2d28d6bcb46b9202461c23b86ad6f1f3cec2cf51ffbd181000651037
SSDEEP 768:Y+8X/NT0ZezFy6uLGsyvi7ssXAS39YGiE1TJnhC:Y/ZexL0o5X2k1Tds
TLSH
T1ACD2F104AD3D7AA06468E3D332713166FDA696A10B7702D2C615E625B3983F42BCBCE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi\Default\Cache\Cache_Data\f_000009
Size 77KB
SHA256 fdec99566f71a8c7f37b00317b28dddea3d70c99ece6dbb8edfd04e480216332
MD5 d98d14434d8a1d6b74783e9c1713c899
SHA1 60710fd84cc0d00beece6f43f2622461388ccbd6
SHA512 5abf2a62c98f49be64ea34e4f36942a2b5a3b7ee3fcbd022e1c915ef8dd4e08e4b0e236667a6485999f75f0ecffe2004a385f7a1a8688853666c6aa62e46028b
SSDEEP 1536:GEw2xq9Q5h+WIdrP7QMC1QLia6gP9QRRN3vR30lTfGvN+X9upQI:GE951Ar7fGa59W5OqvHJ
TLSH
T1A37302EE4E3C6219120BA937F94B821CD59E90F81928BB54E3DC0AE6F6C0D2775C754D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi\Default\Cache\Cache_Data\f_00000a
Size 19KB
SHA256 b6ddc4f98771066e55d1066bab6f49633958b3974ff3045e38618e821705ff53
MD5 f57967bb202c5db7ae1e689f5df31184
SHA1 7a2493212d252ad8e81f161245c75eaf58b5bf61
SHA512 a2ff91d024c60f408b74ae9ea7926926970be086e6ad4bd58efa41c9f66c66242f996d2819fde2327a6a3e6a924831dba447aa8bfb397226eedb68e0dbe49026
SSDEEP 384:nwyCeV3IURi+Ac6Jiu4a9EGPAIHxvpupwDmhp7MEDhF10Pm42:jxPna97AmViwDm0uW2
TLSH
T11D92E0B3D30F2F71553399E8A27DE506B85B1C9D03A6BE0D65B37C03418DEAA128D1E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi\Default\Cache\Cache_Data\f_00000d
Size 59KB
SHA256 627e592e56dd33adbd5f87658e98e48b6ec540702a0d7a4072a21531ce42d5d1
MD5 00d22d792543f7492960495d9284376d
SHA1 7015742a46c15dbbb62b4058762ea6d90a3f4557
SHA512 11d2a7d4dc1e0857bd5a2b1966e57a57aed992a5fa295c41671b2779c85e8ce4bd70d1fe3b80fa2bd6acb7a6efb61d6515485e24f163346d2704ad18e0fe30ac
SSDEEP 1536:sk5esDm+DrKYPDuoL2yWSbCAVbk1d7dTi:sk5rmZYrj/WS+AVYd7d+
TLSH
T108530276AB5BA4106E2390503B04EBB35194CEBF1C3965095EAC3BCC54D6751ED0B0EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi\Default\Cache\Cache_Data\f_00000f
Size 66KB
SHA256 05fc189cbde39151f30a2c8d4a23a987e83f0c29e6057356f9a38e6ea69b1fb3
MD5 ab7e962302f889e0bfe5630f17a831c0
SHA1 9747824c013c103a9a034d940b3b916bea27322c
SHA512 fadf238661d076f4876bb1984c00c60b18139aaa669bb5d654817a0325931e354641444a1b6d1e6ed6afa626df0dd62c43162e3b17fa5d66c8b67d28d1a631b3
SSDEEP 1536:0YKvILKjrKEHd8oiF4y2j74PdAbqZ93o3D2NFrLhwT+rhzcf:1KX5HG4y2jadAbqPeDsLiKIf
TLSH
T12F6302A73F98AD351DA13CE879BDE9606084A4524FA861224AC0F1FB5350D02F37B57B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi\Default\Cache\Cache_Data\f_000018
Size 17KB
SHA256 4bfc4853a6475f185a93fca2aa104c11381432e656eed90a936fc7acc4c679e9
MD5 e3738dd4e3d582708af7e3b0df9b7253
SHA1 1c106ba61ae13b57c4179ba3aa08eeed338dcedf
SHA512 52f2ae74a78405d0776d0d1933738072b58d42354d31f917d4eef2a1d0ca92d65e3e6982f7978f2ea13754b21dad3162be87f1672606aee78fdf6a717bf847c6
SSDEEP 384:qrkbDUrkJkuv0aNVM46relWpLYRYeqDUM0CmViwAwQoENn:YkCtuYreEpgYxDvs9Qr
TLSH
T18E82D0365465E5EC050DF269817803396C0C527F68F8B91FFA4C50DBC2EBBE6D4A3568
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001c

Path C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi\Default\Cache\Cache_Data\f_00001c
Size 16KB
SHA256 b17b23990851346a40d733da642788136fcc9913a5e690865be124637f16bf66
MD5 e97f51ffddb5102e601f568bebbe6656
SHA1 80b1ed86320c70b9a17f9d5981a132b9a4a6afeb
SHA512 0561e3a1f680d2cf8fa0d19282359588fbdb3a508831810aa5059d6b7b072c840b06323d4ce4c66464ab016fdca47bea6eedbd765acf8c6a503ff2edf91d5fb8
SSDEEP 384:PUsJMhkvuJpDKSNflVDtakrzt2ro/zvllLMZ3u:8bz7Y0ztmez3LWe
TLSH
T12872D0A96EF500237B2B8CEE15D083948E847AF36D6B7DF642883067849C6A17D1858F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi\Default\Cache\Cache_Data\f_00001d
Size 36KB
SHA256 d9546128594ed4fa1d60162a2a4df67e174d2dcea48a9022e3b2e3e0b8d023ef
MD5 ca340521f0fa6e68c9edf319ac8614db
SHA1 555ab0016400c52225f778738d2f6e59e334d38a
SHA512 4c4f4eef2a5370f9ce0bbaf286759535ef50c27879b0bc7c41dff93773c058bb65e35b65184a08019c7b9589ead9490c3f79b6f2c156c00cddc1911de3aa7d19
SSDEEP 768:QcARQx5dqqE0R6b8xYm5NCfWrbxVpD1ZoowKYQjMiclfpORteCxhBBFewjUWhO:/kmfVE26QFtrbfpD1jKQjMpCtdBj7jM
TLSH
T10303E1E3B945AF499FD3DD06CC684232D3952766A2C53E443E6621D2737FCDA388B412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002e

Path C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi\Default\Cache\Cache_Data\f_00002e
Size 16KB
SHA256 6fb27be59aba920a35ab6fc4fb3c1e81972fbc534cb2ffcd1b315ae0f41398c9
MD5 79ed78036c513b5d9555dddbaaeeca3b
SHA1 082fe871f9d7907fb1db7146375c16ed84469523
SHA512 1038659580668259b5820d22e5096c06e89fbdcc75501a9d5c5a4f2bad60387621ab717301c9622a97713bf9a481785cb29d1b26e31caaca60ffa2d6ce846329
SSDEEP 384:m44/bmgTnvF333x0yovp8L0WO4Rr7gJfpJwMud4hZUk2As:x2mgTnv9B0J80WO+0fp2MxhZwAs
TLSH
T10B72D18B04C244FFF7D4BAA1230336B58398556BBB9486DFC414C2DADB6D5115CDD623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000030

Path C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi\Default\Cache\Cache_Data\f_000030
Size 42KB
SHA256 9977b65ca6933cfddc99c1cdc5e6e70451acfa523fc78bd4c790d485dfef30a8
MD5 b300a0aebb7489a97eb50ab43910aabc
SHA1 06dc5f16a0cece8de375f9d672e88ca0e9dcf9f1
SHA512 28c009d1e82721653e23125e2706ac835f0eec73e6d19e997fe9d3f6ed7ab282113e6a5ccfc898a1341ff10de6da92152745454a152d19b8cf6b0b7e68a14474
SSDEEP 768:t26/0YWS6Z/VOTq/go71newlIenD1D8VhzMqxwR5SJJx2JZ8HZVI8tTPyRnZih:t2LYWfwWIo71neUDS/t2SlyGZ28tanZO
TLSH
T1AE13F199AEF0ED0AEF86E6371931FD982CADCF45CC79A75815457E1A041F2E884AC418
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003c

Path C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi\Default\Cache\Cache_Data\f_00003c
Size 16KB
SHA256 62434eff6f95af6ab23fd7dc60aab9abf13bd628250a5d948f78eaa62dfa92c3
MD5 e9841e6d05454301d01cb427bdcfbe4d
SHA1 f9055446b3a614e5ce42ba932841e89db8c8b555
SHA512 b2bf5e75b847f667216534422d0fcd9e01488f10aa4d6d5a3a8df071e034d7933f172a1fa9e24d4e966be540805325742c1913b80c1f615b3cf762bda7a6c9fb
SSDEEP 384:L1DZxMvUod53Tf9kvlycxZsG2rEjYymvIw3hD73fTyra2h6/GunU5:LFBqdTyvlyjGAEjYyKT2P9u2
TLSH
T10A72E17BCA1C6FF1B7D546813B43DB96A2022616A1480C9C453E27FEAD218681F67C7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b27527a7-7ee9-4316-b3e3-fd98081bac97.tmp

Path C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi\Default\DualEngine\b27527a7-7ee9-4316-b3e3-fd98081bac97.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 a8a95d8c4833386e5368ef51f2569f2b1c0d4c544fe89d0dd46aed874bd69c4c
MD5 c1bf729d11e89d0eea60b123f4750b8c
SHA1 c51e8a63be05e74aa9f59e5f2cc538d7d9df6307
SHA512 a72682d5f62d2c0ea1142c484b96d0393efebe080b56639d72f9344c6667e5b073c6ba30cc927584b1bc581b58f6966fe34682a235da5d3cad3964ceb4bd445d
TLSH
T1FCD02BE769A51820DC6F83E21872549444213CA4CE06AD5E113E724734B02167556D72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 1c0df110e39c1428f0f27492371a455c73ff26f185af525f8900991233f37366
MD5 a7f363234eaad5f7be352dd462c79216
SHA1 aca9461adbe5a07f01397a294aac166845f1a0d3
SHA512 af1f3de5978de3d4e9d2247ef2452f47ba9db0d6602d999ad94b04e0931c8f16b173b8b67f090d86f8293ce518121ba1649970288cf83258ca4b94ded7777856
TLSH
T1C3E068B36FE73C24ED3AC2D31832555400103CA4C902AE6E102B778334B02192556C63
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58c53f.TMP

Path C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe58c53f.TMP
Size 153B
SHA256 6474edbf0b3486e8f1fb20fca7153a4f3bf6cb033529339976d6cb1f59847940
MD5 796c08556f5fce337f17cf1f34e69576
SHA1 6ee470e8de1bb73d82bc08e7c6c22766794388a8
SHA512 a5b9438f1cdc6054a80f42682a5d9404d5b9292d8e6f2a299544373d075dc79c9107c87bde46732a202d48e6e6bc4ad1f03f6f5d056dbc3b0034cbe51cd54082
TLSH
T175C02BF75CB51800DE0692D2027128E8C2323CCC8F44BCBA402E72C330701237052C62
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi\Local State
Size 3KB
SHA256 3f4eec94f42e5baa308c0dc8f03b30b3b82180118362320a7cf5dd4f9819c51d
MD5 56e07eb3562f6570a7fc828b15fe5491
SHA1 53e444200b0c5ca7263e2c646797a7a0d7223169
SHA512 0fcbb556b11fe3bf42d0df67af5d380ba45072a8b01feb58ff85176cf3098a663aee8eb24271370fa011f250ff0014692f581d74602488014ce3719596c8b836
TLSH
T1DC81A471A428EC2755E5AA08B5CA36A39F7871B3ED45AF44E6C9530804DF7482B0BC3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi\Local State
Size 4KB
SHA256 cfb095a76aa786425e78d5ae3ba6112a9247c3fc2a4597d08dd9ea8258babc22
MD5 85b8edde9c19c708b966ae771070e624
SHA1 e05636d6c2cb029b46be266d14878c09a4b28931
SHA512 61e7273c2ba17fa25bcad489dc7b63f9883c6d7f78a11ed8bbc4929a4574ccec23187728218f502999fe559ff90d73224460b8d5c837a61d8006d1ccec944265
SSDEEP 96:XqGNkLQsFfxkTGX6u58Frh/cInURoDotovT+pD/B4bvk5cm+0eUnfvtxq4a:6GN3cSooDUwUJEm+qf8
TLSH
T17EA1A5716438EC2759E1A909B4CA3653AFA43173E885BF89D6DC170C04DF788274AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58b968.TMP

Path C:\Users\Admin\AppData\Local\Temp\dyilszwe.fqi\Local State~RFe58b968.TMP
Size 1KB
SHA256 2e863788701c9f67e1e004d47d2a47b2f129495c091850b8be884baf045906a0
MD5 6117200bee1e1448dcac0c4fcdca6fcd
SHA1 a50f7ba9e69b43f680e17877b33ad83be30a83f6
SHA512 5c1b098f319f3d4c834d4c41a85b18788bbbd52666b5f4619fcabccd84924e4011d2098eb5c5a298d666f216d0ca5336ef8181d5b15ecbdb4bcbb0d6646d2d53
TLSH
T1F131B570B86C6D37A8904A0AB2CEBA672F34B2B0D1515A8851DD030816DF6CC430BC3B
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\l2opknyw.uwn\Default\GPUCache\data_1
Size 8KB
SHA256 35bb2f189c643dcf52ecf037603d104035ecdc490bf059b7736e58ef7d821a09
MD5 259e7ed5fb3c6c90533b963da5b2fc1b
SHA1 df90eabda434ca50828abb039b4f80b7f051ec77
SHA512 9d401053ac21a73863b461b0361df1a17850f42fd5fc7a77763a124aa33f2e9493fad018c78cdff63ca10f6710e53255ce891ad6ec56ec77d770c4630f274933
SSDEEP 3:MsEllllkXl:/M/6
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq\Crashpad\settings.dat
Size 280B
SHA256 11d99ac774bc7cf66e05671434b7d448130cf3834009d813c0d7a35526c1dd89
MD5 139f86c1538f33d3c9adfab96b7bc67e
SHA1 e09cbcf5fa74dd08fc90ba8a21519a4fe4f71b9b
SHA512 ad0aeffe45757d50da823a08774be28a9435ad2ac66ab9eabc6ac168ac1f7015312f8585c43a7d3e936318c31f002c24fe93893cb16f9c2c567b40b068cc951d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq\Crashpad\settings.dat
Size 280B
SHA256 6f66a6eae720ca057f0e5387ef8cdb0b8d80899e0b7cfabc5667620c766a556d
MD5 c6e105c714eafc18fa6dbb76b054343b
SHA1 27b3dc7334407accf4db75d90aecbc7178194dd3
SHA512 948617125b67351bf532158cc1128e9e11a5ad11e44a552c3c4dd43ef1ddb7959032bdf6b87bb5850d1e557ec43543dafcfe58d4bf0df39faaa47b57a20d259c
TLSH
T1B4D02470D330D4C4F505303F57F507740350C50000D51500400700000CC375C40DF540
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 6a2ca6b45f00ca4381d7f8df1c0e3dcf2ab39c0f3adfca954ca5513217508b3b
MD5 a8b243ceae6b3edf245aaf7a45089a28
SHA1 dc0a262b761e12ebf1cfbc54f4ab6a3f4062822f
SHA512 a0dab049a0298cc0e3b44d3f760b8554b13174bb8061bbe57ab0af921dcc658ea25bfe068d5930ccf818250ab1396e43d5b7c53747fea4aee55bbe44eaa503f2
TLSH
T1EAE0617B1DE31810BC7F87DB243140A000077C54C941FE8F506D739310F2251685AC21
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 8f810a3075e7b070a549bab03cd488cb77570965de4f8818d29979ba8e1b8348
MD5 e27154dd42c005e6820471a201423ed5
SHA1 1fb75983aee138c4735870b736ad2027b0092d0f
SHA512 0b1aa67bc7d228b1e6d7e7452fcf9cc2b3f2b6bffcb1604deec91139565e3df9339d322146cb40103019827c370e8f1ed08a85d7056a8dde91f845195ed1893e
TLSH
T16DD0C2BA09A519609CBF96E32431909104037CA49A80AD9F401DB28324B12627C16C61
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58a94b.TMP

Path C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe58a94b.TMP
Size 153B
SHA256 db052a47d791d694ff43b54fa2a907aeb50e603e3ad52cfba77870aecc5aa90f
MD5 cb0dbd8df6d9a575edbf2f57829a9ca4
SHA1 3946e54f420acb6636f50e8de1b4bac14d6438c7
SHA512 c1ef38ad425cd848ae8b92bfe48e4acbc957b7eb128aff29634f24e1f6ab4f5b364ef7ba094904f8cac5ece6230ea71fb177c092cd8733e366040d5200405fb3
TLSH
T1BEC08CFB08A80840DDBA62C3203154D641277CC88A80AE9F802DB1C33030123B827C21
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq\Default\Sync Data\Logs\sync_diagnostic.log
Size 668B
SHA256 3b0c90f181d4c790a9bd029984208cf47dba3a7e5a2cd37b4378924cec600f14
MD5 c2b0a4da98cdaf16b9db7d5a29361291
SHA1 b55baa9d737f381a8aba0ce74b21faf9cc025a23
SHA512 07816ee032334021c60937871436811886718cf5846565d1a6a62a95ae6f34779ebeca63adf1d967f961eaf5e70595ef8130ee35b92fe593d97817dd7c6bb8b4
TLSH
T11701A120B67F1347247D7704827C899B824170533516ED3EB7E960D97917E090BFC589
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq\Local State
Size 4KB
SHA256 7e3748475bbaa0e42ca104a5bd9154402e62b20b695b33ca9d7fd0ddcff48adb
MD5 5ebff7e1b0e26f0fe115d522326223fb
SHA1 0a6bc79ff8e715cf3a0ed9c5da268177f66a2668
SHA512 c33f191cd384da7a6a359648563e382d01906c160edd51abdceaea9ed3737ecf98198d2aab2bd4406d3b418f311a6c3b1492aaed040dbf31b1622db5bd8ccd9f
SSDEEP 96:iqGNkHsFfxq3Ao1zsDdBI8PyvFMswQWaC0eUnjCQXq4a:ZGNAcauDIGOXPCq+Qo
TLSH
T1B081B8719C30BDB3CBF15F46B58A36135F74616BE6652E40D9D8171808DBA8C230AC33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq\Local State
Size 5KB
SHA256 e0dc8c00bc43845320f5836f5e34d66cb03ec8a78b8fc2751a964a7b7b408711
MD5 992b8fb0d7952969f7ea5a45216aff1a
SHA1 396fff4c56a89bbf6d231b3c0f626cf58cf03cca
SHA512 5ed66a4e3e56f4ac269046b3d29819bfb984cd76956ab4ff3a43501311aa978936163d6640a9db0feaff55c666aedd49bf70f486f263aa0b111f125735b0bb21
SSDEEP 96:iqGNk4QsFfxq3Ao58Frh/cInURoDotove7DeBI8PyvFMswQWaC0eUnjCQXq4a:ZGN8cXooDUwCeIGOXPCq+Qo
TLSH
T1E6B194719834AC778EF19F46B58636136FA4612BE1A53F94DAEC0A1C08DBA8C1346C33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe589d54.TMP

Path C:\Users\Admin\AppData\Local\Temp\xer0omrz.ukq\Local State~RFe589d54.TMP
Size 1KB
SHA256 beb3c1d2218ef5aea75b50b0de74c0c1f92a1435890968009d02b91680112a0a
MD5 03ae51837ce92cceafb098541706f2eb
SHA1 d9e2ae77694f610e39c130ed278940eb1c46848e
SHA512 db6945b3a9dbe9ec2168b97bf128d6fa14b4ad27c11c33ff2a25b26a238b4900ea4b648c3cd70f6a60d58108497503ef2ecece57f34ca2386cf423c018e8cd48
TLSH
T1233196709C306DB3AC61534772CA76672E3052B2D3A52E4452EC0A1808E7ACC660FC3B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\yrhzwuim.w2n\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\yrhzwuim.w2n\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\yrhzwuim.w2n\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\yrhzwuim.w2n\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\yrhzwuim.w2n\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\yrhzwuim.w2n\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\yrhzwuim.w2n\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZMO7WY2ZW7Y1NVUSNILK.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZMO7WY2ZW7Y1NVUSNILK.temp
Size 4KB
SHA256 58134b50ecef927570bf8b1b92f86f83bdd6527582cb4aa07149ba3701b6096d
MD5 c598283da7273c75a27c8d4701b6f12e
SHA1 83ddec95ebf5ef3f6d5e67d3ddc1fc4d099a81e8
SHA512 d2a96738ca099dd6bf4d77717bdfd6fb7223cc177d158ff3726404729fda9319d4cb5e5a972a12bec2ee306597202beeeb74e5d2573767a62a976ab1e60b6790
SSDEEP 48:e18IdOMWSOsN04VJ9zCNY88jkdLXuHSBpk88IdOMWSOsN04VJ9zvY88jngdLXuHw:e6/s5Jo58ouyBmx/s5Jv58jIuQ
TLSH
T17C9111106FEA1A56F3F7EA73A53777146B77B9499E198A0D004445080C627048AEDFF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 60ecba3a0c13090f186ba0eaeae43ad81928057161e47fdf550dd4ae0ca6a3ef
MD5 0255dac274dd70c668c1124eeef2de28
SHA1 96271a94f824ac9b1388b106ed206d67701f1703
SHA512 52bfe79f915ae34684c01a5022c076d4f3ab89f4fbfa65d1998b809abec8c914402a3eaf3e589370f9c22038684c85b0a74c0f3e269336b0ef511bab8cb059ef
SSDEEP 48:e18IdOMWSOsN04VJ9zCNY4CdLXuHSBpI88IdOMWSOsN04VJ9zvY4RgdLXuH/2V:e6/s5Jo1quyBWx/s5Jv1RIuQ
TLSH
T11F9121009FEA0A56F3F7E973A57737146B77B9499A198A0D004446080C727048AEDFF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c08b22a-6aa5-49ec-aff8-58ec0771a5a3.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6c08b22a-6aa5-49ec-aff8-58ec0771a5a3.dmp
Size 76KB
SHA256 166b1f8ba83be844f2e3b6d494dada4dd4c018ba7d92351b779308dee73ba1bc
MD5 80035cae6c8ce303bb2c11244febd1b0
SHA1 f30b70d6517947838766d26517d160543d939ca3
SHA512 b5491f2f2814e37b3fd0ea7ed09b2ab7af2141c0209ae86c8e0d426c221e08d9147ae1e44a256b4a3ab7eea3ccdfe47a6091ff73d6958bb7cbe1bfc0822e86b9
SSDEEP 384:oLkayhjYsvyukfMiPZwIX5/9+emUdg5c3OyyGYttr2F+1/84XBcJxqosmXmamdo:omIJ/8UdLqr2F+15XB0smXmamdo
TLSH
T12873FC23A7A20675D86907786BE7674877F6EC1B0B93831B421CC16EDC67388ACB0F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c08b22a-6aa5-49ec-aff8-58ec0771a5a3.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6c08b22a-6aa5-49ec-aff8-58ec0771a5a3.extra
Size 10KB
SHA256 15f3a0af62f68921d4d09be206688ca5ae673376404ddb545b4ae6753ccc624c
MD5 5d0a28862f3d508839e9e85d34da63f4
SHA1 c41cfff0a1c8966bf91880f214c6c9f8da2fff99
SHA512 4129e35bf4bdb2c746a2f2630b5959351d8c87fd7a95b7943f4af01778ac3f0a5adf84c0194cb3879c19943c7405888ad8cf42dc8188ef02815f9784ddc1bc25
SSDEEP 96:SEWCwTPGY6pw6mJFFd8H0Rh7CTvBb1d0LjMLlIrLlhTLlaXv7aaOKtILfcBCqwv5:SacVLFSG7WvZ8nLpxsPywl6Xfo8
TLSH
T1D7227253879724B79D4298C4BC30AE7C45EC6FAA61F958A802CC4D47FA464F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c08b22a-6aa5-49ec-aff8-58ec0771a5a3.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6c08b22a-6aa5-49ec-aff8-58ec0771a5a3.extra
Size 10KB
SHA256 f8785f1cc02cb73d6c1cfdcc4637f20a90e12bf4ff6db54e3d3304a3e450b7ed
MD5 49528857826a67339f42a38543301436
SHA1 e02b516306e1d5ff0ed605bf7767e1d14481dd87
SHA512 29d1067e64c210b3ea9c7b0c19fbe6fa18c4bb9dafb1d43804972aed9238e9c8d8ef88de6042882d4f61366f2174ffefaad8e9fe5a6dbeb3c423cd398804a8eb
SSDEEP 192:SaJcFgwiR4pDDnTYaVdVxzPJWBHV4T/fKNUalSXfo0bLltTZl:hJcFgwiGD/1xWBHV4TxaOA0fT
TLSH
T1E322F831481CE837E7D6AC8EFB392E3AD66D7B1E00E6786C41CCCA49C1A5478A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c74f393-8b11-4f9e-bf67-130a83873da3.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6c74f393-8b11-4f9e-bf67-130a83873da3.dmp
Size 73KB
SHA256 df2b3f1bc4145da780b7dbfd11ecff5a74e4cdbaa497a087a71864e4ecf5514e
MD5 941b6ca5f377099b8fdd26e5ad5a3f53
SHA1 bc43a906ac70e8ec95688eefe18f53904dd2ced3
SHA512 2bae1c2cbdca2bbb74859660fa3468f2736f1439dea7bf92e92246530b125b4fb6aad5fb7f4092a58c63e2e94a679e60984310ac82e8a4e80a28ff835bf54262
SSDEEP 384:kZ01k8xfGv7DT9yy8ubMScv+kDf4Yy9SSTsmXmamdo:kZA8Jyy8ujch3STsmXmamdo
TLSH
T1D373ED22ABD00675D5690B395BE76748B7F6EC950B538F1B42D4816EEC63F886C30F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c74f393-8b11-4f9e-bf67-130a83873da3.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6c74f393-8b11-4f9e-bf67-130a83873da3.extra
Size 1KB
SHA256 3688a52f4ba83d3847b555a0079a6cdfe50beca786613188aa7665af2c299547
MD5 e5d93b576709828ef55082d256e88d4f
SHA1 4d9352dae258349979019722093cbe18e667db35
SHA512 aa4bdea068d047e6306e35ccbe0bab0b3a3c02ad37acb3c038ed962c874c13fa3e2ff816c0213aaaa8d8de54990fe3fa91c0b6d799d3efd1fea41331934bb6d3
TLSH
T1993152B782EC2D228957899CB23B2302C94973230493690C25CD4B0C868E0DD926A9D3
MD5 SHA1 SHA512 TLSH

Submit Download

6c74f393-8b11-4f9e-bf67-130a83873da3.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6c74f393-8b11-4f9e-bf67-130a83873da3.extra
Size 3KB
SHA256 7ebefa2b0ba541bfcc3af4758d33b4e5840eef1dbeaea31cc9b5605df01b0c6b
MD5 3cc13d6a877b3ef399c11345a15c3c9b
SHA1 956a4b32913a546e2cc21a75bd8631eecb869dac
SHA512 738fc09561a894f029f03be34b76138eeccf09d84323ebbff56c157fb16061aef528a2e7e53f82749a496b93cce0cdd93e63fd89fe1aeb5a35071090b59da741
TLSH
T119810232405CE9375AEE5CCEB3376E1D889FB31998722A9C91CEC71C41B98B0639A143
MD5 SHA1 SHA512 TLSH

Submit Download

71e48b91-5f43-4256-abb8-153233a56049.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\71e48b91-5f43-4256-abb8-153233a56049.dmp
Size 74KB
SHA256 61546acc0e7216778f0869a3462c8c683c396dac48275e34233eb20ce437d9fc
MD5 a8133e1b80c34234fd53eb4ccb7d1510
SHA1 316fa9092034d870a043c21d34776daa0ffc0d88
SHA512 e85e7d3e23177d4fe409123ad224745ead7e240f7df2ed09c6e2ec974c271c8cc4d8778d151e4d9f84f92ed7ddfec77505afa5a077a8dc7559c92b5b347d5d28
SSDEEP 384:C9Z04T5W5aLb1977ebP57pa5a2h03MxFSsmXmamdo:cZsQbjmBlih03MxFSsmXmamdo
TLSH
T1A573EA22A7900AB5D4664B3A5FE7B7B877F6EC160B53835F4214816EDC63788AC31F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71e48b91-5f43-4256-abb8-153233a56049.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\71e48b91-5f43-4256-abb8-153233a56049.extra
Size 10KB
SHA256 8b62713eeafeec1f64dae86fb492f8eaa01359e2abd3a2d94020701415010f68
MD5 d481d869bf94a3ee8eed940cc22ed6cf
SHA1 9cbe1606cfd7d9314384629ca3bcd38bf748bff5
SHA512 0f25211644ca84cdb165c39bdfc8d970c34c3835a0186dea7f7876d45ad3ddf53db4e9aaf09923052889e243d2dd2c46850828daebfea1cb4fe43fa82273a8b1
SSDEEP 96:SEWCXTPGY6pw6mJFFd8H0Rh7CsevBb1d0LjMLlIrLlhTLlaXv7agOKtILfcBCqwf:SajVLFSG7uvZ8nLTxsPywlqpwfoR
TLSH
T1BF227253879724B7AD4198C4BC30AE7C45EC6FAA61F958A802CC4D47FA464F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71e48b91-5f43-4256-abb8-153233a56049.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\71e48b91-5f43-4256-abb8-153233a56049.extra
Size 10KB
SHA256 474bcf3494fc6f72f428b70752b5fc2eeaf4be056143a1dc6a87678c380deb2c
MD5 37073d1f67b0cfbacdb1315456da385b
SHA1 a2b820249554a0ba455fa1734cb1efec632d2320
SHA512 dad06483f4a5f63c7b0c26de3bace471844e078950707dc67eb8a1634198db344d61473dab0b4c271366ffc396bd94f5290392f6427940b2d79cfd8de7d9029f
SSDEEP 192:SaMcFgwiR4pDDnTYapdVxzPJWBHv4T/fKNUalypwfodbLltTZl:hMcFgwiGDz1xWBHv4Txao6AdfT
TLSH
T11722F832481CE837E7D6AC8EFB392E3AD26D7B1E00E6786C41CCCA49C1A54786779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e80ee6e4-d7a8-4fde-a56c-22193ed14a64.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e80ee6e4-d7a8-4fde-a56c-22193ed14a64.dmp
Size 78KB
SHA256 88cf186a3f1a2ce1e460edbdce835d3da3b8cd286c8d96ac070bdab820e5726d
MD5 5851c468f356742a30516acbfeccaef0
SHA1 c49f962a76d52a819335843485401119411d7fb3
SHA512 b8902b9b8345ba0e7be0c5b80ee08ffb3314f9662bb68da99c34f41da0bbb159e9ae1d560ca7824e7052cbf124c5807fe0702d280a42cd2d6aeec36fb816fd20
SSDEEP 384:gkHSnNuSKnmDrPndHSxaKKdJFy2o74OUE6rJp9XBi9yPTBsmXmamdo:ajnLndHsaKKdJFhFPTBsmXmamdo
TLSH
T1A273DB22A790066AD5791B355BEB771A7BF7ECA00BD3831B4210917EDC6B398AC31F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e80ee6e4-d7a8-4fde-a56c-22193ed14a64.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e80ee6e4-d7a8-4fde-a56c-22193ed14a64.extra
Size 10KB
SHA256 22f77c8f2c0233dab76834370a7e13f2b7a0a4c2f472be814697bbc7a1a66b56
MD5 f8936323aa1548fd427b655cbc16f8bd
SHA1 998d12b09bc112217beacebcf13a31ee1a6d59d4
SHA512 1ea9586c068bb6cfd05e8e3b65035a6ccfae464d1065067cfc45e072f8f0d6f41eb5590ffe5e7c16696ff1af2aedd6936f53e442add8660385a809f090b6f9b3
SSDEEP 96:SEWCvJXTPGY6pw6mJFFd8H0Rh7CsevBb1d0LjMLlIrLlhTLlaXv7aBOKtILfcBCn:SavJjVLFSG7uvZ8nL+xsPywlq9Ifo7
TLSH
T1A7227253878724B7AD5194C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e80ee6e4-d7a8-4fde-a56c-22193ed14a64.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e80ee6e4-d7a8-4fde-a56c-22193ed14a64.extra
Size 10KB
SHA256 93c9584e4c4a7e32595206243da6b08353e2f3c6c98de19241837b7b544d8379
MD5 876d5f09975b322a8ad700653cd9ff9c
SHA1 58e857e992b23664e3737560a7e6477c9d7e4c86
SHA512 1292814bc4fa0c3ce6f4b9e22bbc78e9a3a75d180ab57e5a5e4c3bc55c130f032b580094a72f74291acf000081bbe69a1493f0f74f4df52815a21b62da8c84a1
SSDEEP 192:SavJMcFgwiR4pDDnTYapdVxzPJWBH24T/fKNUaly9Ifo3bLltTZl:hvycFgwiGDz1xWBH24TxaoaA3fT
TLSH
T119320931481CE837E7E6AC8EFB392E36D66D7B1E10E6786C40CCCA49C1A5474A779413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 3f97aea47eb34f0a90b9c5fcd824ac06a978aaac1956ae1f4545e3dba1c1a663
MD5 d670c5fb03d94e03aa699522d96e317b
SHA1 7d3d19f27c48bfee52291e652f530b1bae6940a1
SHA512 be16df87279d127312247630996f352ea6e0c565fd4dc9680304c5bab609814e07a62d1f291ddf1e8b1e083bc601a63afaaf0672d9d439908c12d866daf3fe74
TLSH
T13B51B858F229863FE4498239CC965F452F34745698AF3F2A35AC604D1E572CD378D07D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 9d8dba7524085ae71730b63eb14fcc215151d98dac5992f1940475420914bfaf
MD5 9f4f00b8f3f3584d89bbc23ab40b8b39
SHA1 42e5c64cfd502d30d25fa8de803e55d9fa22c5c0
SHA512 9e5b8e7705d5037b043d610284af90a90142de0a4e306a630020df43bca9352f877ef4049e5ee59f71db6bae368ff28c529e76799954d99f17e14ea105f986ec
SSDEEP 768:O0gFDl8Gcm+ut0vGeRY3Cy5bbFb1bmbcs1/:iFDF0vGeSq
TLSH
T12BD20044EB2A953FD41912BBDDA507002F79B88A990D2F673A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 4a65d7e370b299ac23d20d902990a52236c4fed3022bff51e357f7fe8d5fe85e
MD5 ea8cfbdad92f5e74e173f9cdb2af0330
SHA1 3b50304a2a653b185b392333be79f0ea1f8a9b96
SHA512 16dd906ef4f85a47b2985691d8ba09ba0e7eaaaed9989b289f1f06968278064b1748d53eebfdf4f0b304053185df000aa31cf1ee30e65d8078e709bab34c525b
SSDEEP 192:k0D71d66JoztdzgCl6mc0dkOv5zbo8b+Syj6Xd:t5d66Joz/zgC1jhbo8b+Syj4
TLSH
T136E10C64EA288A3BC409423BCDB51B414E36389BA84E7F19369D640D2C5B2DE7B8D17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 eddc369a7a0f79d2600fceb346077ba37d862f52e3fc3a0c4fd448ffdd192cef
MD5 39cc81a410dcf0b33e43419a78e901e2
SHA1 185c2b63eb358e1d7e376aea2eedf3ae9596787d
SHA512 b72ed5446ccad39edaa06f9ca019a471e154ecce1066c986fd3c28c345eb753dc6d38814b23be8aa9e729d92391524a27ef37ac48e74749da9c9d0da98fb089c
SSDEEP 192:aOv5zbo8b+Syj6XM0D7u1d66JoztdzgCl6mc0dz:Zbo8b+SyjYkd66Joz/zgC1jd
TLSH
T1EFE10C64EA288A3BC409423BCDB51B414E36389BA84E7F19369C640D2C5B2DE7B8D17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 ced24cff44bb72a76b85efb37a2d2dc618fb6712a47bd6bd74c77a067c851371
MD5 cd4c6fa3c24a9183238fb7e6d82ad36f
SHA1 e1154cbff1fdbe0d7dbb5b9673f7ddb0b17da553
SHA512 77919184d3ca682c3c8e60e224f726609c8f228fa9e82cfc45a319e5cdd3d7f0a1ebc59825ddf4c8d735ea6f6d1b4b880e0c5f8840a52b7947960d9d0c8380c1
SSDEEP 192:LOv5zbotb+Syj6XM0D91d66JoztdzgCl6mc0dz:Ubotb+SyjYbd66Joz/zgC1jd
TLSH
T1B7E10D64EA38863BC409423BCDB61B414F36385BA84E7F19369D640D2C5B2DE7B8D17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 93b189f7d08905e864dd061b4db8ee48abac32a470c4af82701bc169449021a5
MD5 8ac9526168783307e6fe5d22fad49df1
SHA1 6db58fa05112322a1239239aa6d1ccad72c21dac
SHA512 0afecf1342109d11b51d85eebd935b04e2b8530a89c60979c2282cdf296ef025d4deb2c7a5a75dd1719dc84b1861bdafa1781f5b977caf6ccecbf3a7c04adfc1
SSDEEP 192:J0D91d66JoztdzgCl6mc0dMOv5zbo7wZ+Syj6Xd:ubd66Joz/zgC1jNbo0Z+Syj4
TLSH
T152E10D64EA29863FC409427BDDB61B414F36389B984E3F19369C640D2C5B2DD3B8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 deb1259a2da8897383e4de8ccc0fbe869596b5b8bca7b6640c5746cd839bc728
MD5 947bc2dc835f35a575629fd615705493
SHA1 b9a95bd27e5fcc044c6b2d753f69ad2c2818829a
SHA512 1005ae9d984ffae061441a22577570121fcf16a1a94cdeb88418e5a69fc2882bfd27513cbe5448676c0fdfde5c260717119523380927c4f17fac6c2b784fe500
SSDEEP 192:IOv5zbo7uZ+Syj6XL09El1d66JoztdzgCl6mc0dz:zboyZ+SyjFEjd66Joz/zgC1jd
TLSH
T137E11C64EA28863FC409427BDDA61B410F36389B984E3F19369C740C2C5B2DE378E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\events\events
Size 1KB
SHA256 5553060c6698b716975664f63b98dfad56b9248fbe3b69626915cb535014ac9b
MD5 b5b169839ed4502a08e54b71e053eed7
SHA1 52fdf487639f40ebddf0e9b756e987419dae0070
SHA512 de5732f05b6a57d7552f897daa9f575b7523f1e80f4496d7e0326fcb0be7decd350fa504f6f281f38fabc36f0791470ad85f09272ab1a08a36514b222286295d
TLSH
T183116AAC3DF84D2A9D8FE29CB482028D53568E47469B1C430D12EF8CCE90AD9726E43D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\events\events
Size 1KB
SHA256 7377bfce6075752557f40c0812fd6497909549f8cd8816a5a87e49bd20acfc4d
MD5 ae725378daee5ef1a44bf3a81af998d0
SHA1 1727827abec21ad221e2728f23d75e5f76bba189
SHA512 de7569db9ec1ec02f6c614705ce1103f2d95674424364c6d705912bbfe1815a639b9b72f7a51a1327cd29b05883db9202b3d39cd1f1a3846a115f2f929e37b4c
TLSH
T19C11276C3DF94D7AA9CBE29CB441028E93514A47169B1D434D12EF8CCF91AD9726E43C
MD5 SHA1 SHA512 TLSH

Submit Download

0017b309-4f05-4404-8d8f-903b3c3b3977

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\pending_pings\0017b309-4f05-4404-8d8f-903b3c3b3977
Size 235B
SHA256 6dc17310a0ea44d8bed197473dbf0ebf5720afe03182cd58ad116d35a4f49772
MD5 57c808f66b340137e76c882389ac64d2
SHA1 ed15ea8df44f7ddb7f8bd9e0004b2ecd4c569cc3
SHA512 152596edb624c1ed3460ee72beee3801dddf072d24d0d16836b050245ca92c1a66bf2a7a2f0afecb0424ca4ce4b5f1c175029a5c99e2d2d556cf3e591b25b4e2
TLSH
T1CDD0978028D82B9C0C040F03B0B03AD630544C332068BC20C9E14538CFBCACA1292C07
MD5 SHA1 SHA512 TLSH

Submit Download

04fd233a-0173-4f91-a9ab-1849f6eb33ce

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\pending_pings\04fd233a-0173-4f91-a9ab-1849f6eb33ce
Size 2KB
SHA256 c48dd9aa6c6950531fada0cf75a893521171a70756179b104f8fdc43280e6878
MD5 c9a43eaa8d6a41ede21843ebd4e26e18
SHA1 748e114722c578b153a9e91eba9ecf13080a7790
SHA512 5abbe39206fcb51d7e67204fb94b9aa27320cfeeb0cc7fcce20cc469b4c84b81fa6596ece890e6b6422975cc2e5f8ff59ad9ae0f02f7e6fef292d395c8e965c3
TLSH
T19641845C3A788C7A8C9BF24D9591338E57649A8300C22C476E51EE8CCD8679E336A42F
MD5 SHA1 SHA512 TLSH

Submit Download

09054861-7091-472f-beec-a811fbd88147

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\pending_pings\09054861-7091-472f-beec-a811fbd88147
Size 3KB
SHA256 8684d417834f6ed0f5ceccfa0dc6a31a5f652879fc065310c7b5cfffe17d9ba7
MD5 cebf3bd8bb63d2934cc7b48416617b44
SHA1 287e9038434785fd96eed6020c2c9c5a2a1e13b8
SHA512 88263ba58f71c59cb59d823505018803a2e14cf3963ffdcd5f8dde682bad80b4953323a59c9e420953056d827f4a70ce67aafa0cb91ce528128d90edc04e8855
TLSH
T1536154314458BA738FECA445E33B6F95CBFA339F58430A98156A8D2886F4064578F26F
MD5 SHA1 SHA512 TLSH

Submit Download

21388a6c-b891-4bbd-9416-63695dff44a4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\pending_pings\21388a6c-b891-4bbd-9416-63695dff44a4
Size 3KB
SHA256 ef027631ba11bdc17eb28f52d1190be72338ffd4ffb026a5231439426f6542fe
MD5 da0099098d2472da7711cfeeca2291e8
SHA1 eb30014b5f3626cda3c0f4e88f5307f0b29784d9
SHA512 4d121a41b72d4dbc92a9e2b25a13f226929caecbc9462e91c932617e1d910f9076651a5dca5b6e2401c4d1325fc3fdc393bd3350b4b668eb7a3e1bacf25fe612
TLSH
T1146154314458BA738FECA141A33B6FA5CEEE33CF58460A9911AE891882E542403DF21B
MD5 SHA1 SHA512 TLSH

Submit Download

26e700e6-36ec-4a6c-99d2-641f3a2f3f52

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\pending_pings\26e700e6-36ec-4a6c-99d2-641f3a2f3f52
Size 16KB
SHA256 75e438e682f25176d80945f7e58f35f462141f584984fa2437ebfb2ce70c9ce5
MD5 ff5df958c935396cfc2ac661259b181a
SHA1 257c5474b374ff9ecd6bb358a0490458251224ca
SHA512 41e32844e8fbb8d76eff77911315489d191e2bfee38e36fa1cabc92d8ee1a08e2fc5c87f85bec6d569551c2c7bb72c4581d60ec365321fd6a21c45a7793ac32b
SSDEEP 192:z04zBO24v1z4ejj3oNN/pZEJrLpcWIQlVor+EMZAP/zxdYA5Mp8guNHRzxisiaS2:hl4pH3oNHZeNZp8lNHRlisiaSndgX
TLSH
T1B172DA56686049BA8651E3A8D4F87FC3E5F528CF4C019FCA9BE4BD086DDE06E1127C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

27f0d8ea-8dcd-45b5-93d3-75e5ed511c10

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\pending_pings\27f0d8ea-8dcd-45b5-93d3-75e5ed511c10
Size 3KB
SHA256 d148975ff4e3181099b3c72e88bb6981649881640be74e3f80c6f6c6b8c1fca3
MD5 5e939e0fa7a6e9dd7f2e8aa3061ebcd6
SHA1 6150777893cfb0d264913aa8848118826009d4e9
SHA512 425f1cb9e40737a9f9150483d50644ae3b2a8a4a9d4df760bf0b64503299eeab1f1f02e2218d50e9424781bb6631929179520c5a326c30b4abdf4768b55b0dbe
TLSH
T1266162318468BA338FFCA445A37B6E958EDE33CF58520A9915AE891486F4474038F36B
MD5 SHA1 SHA512 TLSH

Submit Download

2c6509d3-3738-4099-9aa0-852bfd39effa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\pending_pings\2c6509d3-3738-4099-9aa0-852bfd39effa
Size 871B
SHA256 832da5cdbe16d8e1cb511816a24de03a733c682d6aab183377929a9dab32677b
MD5 a65b552479ff05efd184db41e9173a19
SHA1 39128f4cb5bb5db9b45cec752c92c0426133a744
SHA512 5f158eb321c3ef39a8a8a48ed98fe75c113c33047250a2b26d68100ff99fbbc56c29eb0726548e6c066ad39d831cba4567a3d26d0b93329cbaf3145303496967
TLSH
T1B6110040C635BAB2CC38D30B8B5537178BF4701380CA45042EE16E084C7E60D63A960B
MD5 SHA1 SHA512 TLSH

Submit Download

30efb6fb-aa5a-473a-a39b-e5468b8dcf03

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\pending_pings\30efb6fb-aa5a-473a-a39b-e5468b8dcf03
Size 3KB
SHA256 1ad64669b288ffec5c47069f1da17730348d492d5def9af8848b8c20b22d81f7
MD5 b9560daaf9e41a89df321afd0b1fbc9d
SHA1 cf4b05330f3cf603ca4b8a32bc96c26be74feb75
SHA512 440db9819a67b1f2a0818c6d18ced3c4db1e64a3aead8df6eab5e1ba17aa241ef6d1acd71a6dbf42212a9a2cfa47dbc596c0fd3d2ff5eb9cf74e4c87338172be
TLSH
T1446152214458BA73CFECA041A33B6F94CEDE33CF58471A9925AA8D1486E9074639F25B
MD5 SHA1 SHA512 TLSH

Submit Download

38886168-db6e-4a39-94a8-d2501cffc600

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\pending_pings\38886168-db6e-4a39-94a8-d2501cffc600
Size 235B
SHA256 e23626cfac91ca29372dcbb45bfd29dcb2d33781e6fa9a2c2d1a467d0546dc98
MD5 0037faa60831c7a8d7e9ae7f85a21e22
SHA1 bc3c083ecff33f07330c6fa1faa48d990ab9116e
SHA512 20e78ca14d465d030d80b67cdfde41ff5549bf28078efa217e0426ad2fc752f5da260a6842c6c444c66c10178756df3f906a56181bb78bb26ade4812915f7f40
TLSH
T175D097C864D8376C08010F13B0A52ACA30A88C3724649830CEA00A74AAF8DC64251917
MD5 SHA1 SHA512 TLSH

Submit Download

5b983fb8-051e-4172-b135-09305cb244bf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\pending_pings\5b983fb8-051e-4172-b135-09305cb244bf
Size 883B
SHA256 06d0a27975ac55d1009c47c527b5e69db6c8988a5443210f572dd359f83eea42
MD5 9e7751f5fb23adcec1d90a2866a7e3fb
SHA1 0018cea73457e06fbf940da40a02d441115c9e7a
SHA512 09f4b3feb24f8197630ddcf3e7e10a216a37bc892af8d1526fb95d990755704b6921183650cb3302ec10151ad9457f05d76ae6c68a8def923ea6032e8db42edd
TLSH
T18D110044C634BD72CC78C34BCAA03B5A8BE4741380CA45183EA0AE188C7E61E936A60B
MD5 SHA1 SHA512 TLSH

Submit Download

5f5bd3ae-c6ed-454d-ad34-9d80c33dc94d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\pending_pings\5f5bd3ae-c6ed-454d-ad34-9d80c33dc94d
Size 896B
SHA256 b1c9eaaa2b2cd442aafa4f4ada8299b58b102171b1d8d1380dcbda2dc0055818
MD5 3fba1dbb8b2e1a8cdb14dc7a9bf4b8a7
SHA1 4a58da5219fcf8fd6244698505a0b507a47eeeeb
SHA512 1624c6a49b6d8563e8b1e0ec02fa1f425da2b294bf867ed9b43d152ddf2b484b4b357d02ec64d876b7ed2030a16b8149f1f39594ef178e72fc5335195ea68875
TLSH
T14D110450CA75BA72CC78D34B9B943B474FE4742380CA1C047ED16A184CAE20E9377607
MD5 SHA1 SHA512 TLSH

Submit Download

8a0cf8f2-763d-499b-8267-564f7560f52f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\pending_pings\8a0cf8f2-763d-499b-8267-564f7560f52f
Size 235B
SHA256 ac829bcfd13067ab4b2b1d44d2a7c305ad910828ea48a594af81f2bd64933672
MD5 8217e05e93c22ba1f7db79b7ce48c342
SHA1 93220736dfcfd21d543fee4559be2c2282d71782
SHA512 13b0f778e78824ba00f4bc9962bf7666ac6928a6e9acc1f367032a672b510f02fb9ee37bb1fbc105cbc2e81b2720c98dfbd9b4290c4c0a692fbc191313f77ef1
TLSH
T108D097801898235D18280F2FF0F0ADD630848C3754E25C20C5628A7C8ABDDC84171806
MD5 SHA1 SHA512 TLSH

Submit Download

94307af1-9134-48fe-b26c-c6e55a353b75

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\pending_pings\94307af1-9134-48fe-b26c-c6e55a353b75
Size 3KB
SHA256 a93309446ca3ac1b93da95764dfd683045e2bd4a3c0b481f6cc27bacf3360837
MD5 dd1a3e540dbda4cb78cfc5d5691f84ae
SHA1 450139a55bb4d885e80d93bcd3faeb184b507530
SHA512 a2ca07169aa58d0f2d80e40ea81f45bb0b20e1eb0256b0956e5dd8bc02616ee0bed4ba3fad425f1fd5a01d46dea68946acda51840a444e150eeed2c098777b18
TLSH
T17B6163315428B9738EFCA041A33B6E948DDE33CF58130A9912AE8D1486F4024138F36F
MD5 SHA1 SHA512 TLSH

Submit Download

97f94294-57d0-45bb-860e-0358172fab3a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\pending_pings\97f94294-57d0-45bb-860e-0358172fab3a
Size 3KB
SHA256 c616cd39f8232e301b6919ce03ae12fd00176ef35b707362cd2909e8fddfcde1
MD5 72433d92a8119d118ca6e082c85e7aa3
SHA1 b21d3c350dcd4d6abfd398d33d1176fc4af2a5b8
SHA512 7da21ca577d6d531d3329c74db975a61810cb2737f51e8edc7f557bb46783b9c79e554f18b750aa3bcd025f12fc637f7d5bdc0e3952ebe300762030cac1e8ed3
TLSH
T1636173214558BA73CFFCA441A37B2E94CECE33CF98470A9D656E9D5482F8064438F25B
MD5 SHA1 SHA512 TLSH

Submit Download

9aebd9b6-7736-4a4a-873b-29606f5bd621

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\pending_pings\9aebd9b6-7736-4a4a-873b-29606f5bd621
Size 3KB
SHA256 3285bd582b7d74d682a8378626216aed5473d6df185f01161f1f4bfaf2d2e573
MD5 10221f46643b5e866d638fefd0a8dbfc
SHA1 ff94da2505bc60d660ad13ea2c13333db3104920
SHA512 8c0fdf3e562d9309144322eb45b1f0666737be104e72892ee14803748ee09eed070dde9c2b09c53189fe1d3d7862e4205946bd3699771291e7e196d71bd4a94a
TLSH
T1DD6133715458B973CEFCA145A37B6A958DDA33CF58120A9925AE891482F8024538B25B
MD5 SHA1 SHA512 TLSH

Submit Download

9d24fae4-1706-47dc-aa13-c6b1853e9feb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\pending_pings\9d24fae4-1706-47dc-aa13-c6b1853e9feb
Size 3KB
SHA256 f38dc3c4d8f2486b0631bce6c2050c615a8c2d2e4ea2bd393df1e2abb2010dd8
MD5 d02c287f991a340403e253b28fc3532c
SHA1 4acbe28fabfeb644fee4536592fd2703ec07f717
SHA512 e577efcb3bd3610e64c209733eeae0f7587f8016626158fcc084c4d1cf04f31f45126505c9483b96f4ef7f35eadc01937193df9c3a92b6f58d045672b6c21ad7
TLSH
T12C6152315458BA73DFFCA185A37B6F94C9DE33CF58420A99229E8D1886E8424178F25B
MD5 SHA1 SHA512 TLSH

Submit Download

a7f195ed-026c-4f06-8d5b-41e741dcd70d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\pending_pings\a7f195ed-026c-4f06-8d5b-41e741dcd70d
Size 3KB
SHA256 bb84efae40d5c117b5a12b7752b001b99a2877cbf533c2e6a63bd868d07bf497
MD5 14d7d0e375c132cad46cdb8a26ab3d6d
SHA1 3c87db8d10310c700d964e54c526da0aa91a42dc
SHA512 6783be8d45262f63db54f1d331ed52067d5e5bc026ba4fd8740e81884be79ec65aaf3f7ab22f093ef8b19410486deb553e2513595b30daad595b06d451b9c20c
TLSH
T1766154315518BA738FFCA041A37B6E958EDE33CF58530A9D25AE8D1482E846403CF36B
MD5 SHA1 SHA512 TLSH

Submit Download

af06a374-b4b4-48a9-ad11-a752121c4459

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\pending_pings\af06a374-b4b4-48a9-ad11-a752121c4459
Size 235B
SHA256 b3cef35de4a477508169bf7ef7ba45d2866de01029b56e1ea0db67f0b9267fbb
MD5 c499f387ab0d2b8cb48297758e456ab8
SHA1 bfe592ce42f0c03971c82e40e8c9203fee4d852e
SHA512 4bbc80ef9db40fbe5df8c394f4e5f9e50eb3d13aabef0427f8475f7f66c33659dd36ad21ec1cfb6764e82cf0db821e6207ed20e4fbed2d5553df279e96ac66c7
TLSH
T17AD0978868887BBD4C140F03B0A069D230488C3710A09810EA606239AABD9C642A289B
MD5 SHA1 SHA512 TLSH

Submit Download

b772d15a-ea22-4708-b2eb-0d9518c890a6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\pending_pings\b772d15a-ea22-4708-b2eb-0d9518c890a6
Size 2KB
SHA256 ec212e12ca0f600834d62affea92019992a7efdb3e4fb1f67dca9fe970f33272
MD5 30012efff2f0ff73e9dcfce580d0d6e9
SHA1 aa6b1867faa31112231f8476610286419c48f96e
SHA512 18db420981f611052f768dd95013ac2ddb613156438394103ad47d34dbe9615de5015b36942e232c374fe313ae62124d007c4c9c11eaa2bae27bb5d461093bef
TLSH
T16441362829B84D778CDAF55DD543234E93A08A4310891C832D51EF0CCE9669E736F43B
MD5 SHA1 SHA512 TLSH

Submit Download

ec6fcb15-83a4-4394-8f66-0a439596633f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\datareporting\glean\pending_pings\ec6fcb15-83a4-4394-8f66-0a439596633f
Size 896B
SHA256 2dcbbb5692d320595420044ea89a365120e7ba519b57243a546ed0b2e307a20f
MD5 3624b62b55c0fa5cc530238a7ae8d58f
SHA1 035cdb06f2b28e00db19de86b49b182d6074d7b6
SHA512 4e2db4933e98d6148182dbe513ae9dca65860b3f7c1071c1bd0d1e4f1996fa52cc074746bce17ed2db89036ce30fc8c3f33b05047813e4ae77906caf88e6f7d7
TLSH
T1E6110444C674BAB3CC38D24B9AA077578BE47013C0CA49147E905A184CAF61E576620B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\prefs-1.js
Size 6KB
SHA256 114653f27caf87acee61c6206fba160d8da0b7c5b4487fefa76b0f215c4d6037
MD5 35016f52e2f0ec64ce07da9bbbe75505
SHA1 a8dfe3ae423a928744a5e05d22750ffed8cadeb8
SHA512 dc06fa48753f76d3d603846c332df831a7fdaf8a7f0a7e6e532bb2a5f40f2d43676f780a55e146719227e65f88855204ab4d43ad03c62afd80bcae53dc32ffba
SSDEEP 96:xH1UTU9QqGqbfEuxP41zSlSSlAdv9jqnbH+Eu6MqnBw88u8L4cnh+1o6:bFRbfEuxP4MSS3stqnBw88jY
TLSH
T1C0E12E7895088F7F74B677ACAC6888315AB2013BB7BF28C750B54485050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\prefs-1.js
Size 6KB
SHA256 7fba789f479ad05f61c353f5fd613f3f2de11fdefef21e4a7cfc9a383f97c046
MD5 08531c2f5ccb9599c0849c2bdcddff32
SHA1 11529423ff6c544e915e6f6dae19b334acdcce7d
SHA512 2ca8e9ee05b5dcc74540c1805f4def11d87b1cfc7a4a1b1acda7c01f61958b29533d4d186629210280d4eb2ac916287e164e7921ebc0be5134d19320996181be
SSDEEP 96:xH1UTU9QqGqbfEuxP41zSRSSlAdv9jSnbH+Eu6MqnBw88u8L4cnh+1o6:bFRbfEuxP4cSSTstqnBw88jY
TLSH
T197E12E7894088F7F74B677ACAC6888315AB2013B77BF68C710B54485050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\prefs.js
Size 6KB
SHA256 2147f5957fd1000eba46a5d9f3c8bdd2d0a1b57c992e84d5d8c6544b28fd9b62
MD5 c2969c405361c03c322c5d9f7c0823be
SHA1 1160d219138fb8569a70beb7ede3a16915b8355b
SHA512 0c3a8c58b74905a481e1b886bd2cf959725b827c9679d4301f4b8c035e2e0ee13376411284b24ae0ad35f86d1d2f9be393f5c471ff2af7f1fe39f3bab8601050
SSDEEP 96:xH1UTU9QqGqbfEmE1zSvtSSlAdv9jlnbH+Eu6MqnBw88u8L4cnh+v6:bFRbfEmE2tSS8stqnBw88jt
TLSH
T111E12E7895088B7F74B677ACAC6888715AB2013B77BF28D750B544C5050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vz0tbtf6.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

aspnet_compiler.exe

Path C:\Users\Admin\AppData\Roaming\aspnet_compiler.exe
Size 48KB
SHA256 923c541ce782bf45a3d338487e6f411cd11ab0b98eb9775a2d2065dff39a4f37
MD5 7835ac3587533a4c407164a221390881
SHA1 4494150264b431068cc9d7ced0949f92545277c6
SHA512 b1ecf29f743fe039a8c61f0fd77559a81a100cd060337cee9cc43a0cadd6df0ba7ed7386906d3b1d1ea6d2538bf649af8bcab79ab564a41bac624c0454eeb6c7
SSDEEP 768:pFcAS6TP8ZeM8cKkf85d/50V6Iq85dqf7PzZDeN4EWF//dj9z94:pmAPkfOd/508GODeN4EWZz94
TLSH
T11B23D728A7E81316F6BB47B099F5D083AA76B5436E75C74D388A434D0B237C08953F7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1016-62-0x0000021B1BD60000-0x0000021B1BD70000-memory.dmp

Download

memory/2204-10-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-15-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-3-0x000002127BCB0000-0x000002127BCD2000-memory.dmp

Download

memory/2204-38-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-37-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-4-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-36-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-35-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-34-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-33-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-32-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-31-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-30-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-29-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-0-0x00007FF9A2CBF000-0x00007FF9A2CC0000-memory.dmp

Download

memory/2204-27-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-26-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-25-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-5-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-22-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-6-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-7-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-20-0x00000212635B0000-0x00000212635B8000-memory.dmp

Download

memory/2204-19-0x00000212635A0000-0x00000212635AE000-memory.dmp

Download

memory/2204-18-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-17-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-16-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-40-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-14-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-13-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-8-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-9-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-11-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/2204-12-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp

Download

memory/3124-1721-0x000001E84E7F0000-0x000001E84E800000-memory.dmp

Download

memory/6016-23-0x0000000074C92000-0x0000000074C93000-memory.dmp

Download

memory/6016-28-0x0000000006010000-0x0000000006076000-memory.dmp

Download

memory/6016-47-0x00000000062B0000-0x0000000006326000-memory.dmp

Download

memory/6016-48-0x0000000006330000-0x0000000006380000-memory.dmp

Download

memory/6016-3303-0x0000000006AF0000-0x0000000006AFA000-memory.dmp

Download

memory/6016-41-0x0000000006180000-0x0000000006232000-memory.dmp

Download

memory/6016-21-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/6016-3302-0x0000000007D30000-0x0000000007DC2000-memory.dmp

Download

memory/6016-3297-0x0000000007030000-0x000000000738B000-memory.dmp

Download

memory/6016-3296-0x00000000067D0000-0x00000000067F2000-memory.dmp

Download

memory/6016-24-0x0000000005860000-0x0000000005E1A000-memory.dmp

Download

memory/6016-691-0x0000000074C80000-0x000000007543C000-memory.dmp

Download

memory/6016-386-0x0000000074C92000-0x0000000074C93000-memory.dmp

Download

memory/6016-51-0x0000000005E20000-0x0000000005E3E000-memory.dmp

Download

memory/6016-46-0x0000000006400000-0x00000000065C2000-memory.dmp

Download

memory/6016-39-0x0000000074C80000-0x000000007543C000-memory.dmp

Download

memory/6196-44-0x0000000000C10000-0x0000000000C20000-memory.dmp

Download

memory/6196-45-0x0000000074C80000-0x000000007543C000-memory.dmp

Download

memory/6196-50-0x0000000074C80000-0x000000007543C000-memory.dmp

Download

memory/6196-49-0x0000000005A20000-0x0000000005F4C000-memory.dmp

Download