phantom_stealer | 5d27ce36bffa352aee8c1a46006a5e4b69f03f0fe9e85932d48f4c58dc008bb4

Analysis

max time kernel
148s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 05:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Letter dated 24.07.2026 (262244)-company.js
Size 1.6MB
Sample260724-gac5hashnb
SHA256 5d27ce36bffa352aee8c1a46006a5e4b69f03f0fe9e85932d48f4c58dc008bb4
MD5 ba1a4ef2ede227f66b34489a6ee5d00b
SHA1 304172e14498467b22feb1d550c1f16356b178e0
SHA512 ff0c5a8ec98fd7065ca498957ebb6a7055053614e161dd154052dba37f563fd7b81e3675416a1e6fe654b3e0164768f14cf1e8d03e4da64c4c378e7443f55d26
SSDEEP 384:U888888888888888888888888888888888888888888888888888888888888889:WH
TLSH
T1E3758DFAF13F4703AD751600AE6E5C0476C8A57A4F1FDA1BECD0A0DC65A341AEA98D34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution phantom_stealer persistence stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.ckvsb.com.my
Port
587
Username
[email protected]
Password
Spring99#

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
mail.ckvsb.com.my
Port
587
Username
[email protected]
Password
Spring99#
Email to
[email protected]

Mutex

T2AQM82LAVT6X6MR1OU2

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 1 IoCs

resource	yara_rule
behavioral2/memory/3440-18-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6488	6388	powershell.exe	90

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	6488	powershell.exe
3	6488	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
270	icanhazip.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 6488 set thread context of 3440	6488	powershell.exe	93

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6488	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4744	chrome.exe
5692	chrome.exe
4660	msedge.exe
3120	msedge.exe

Checks processor information in registry 2 TTPs 34 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{C158062A-6697-4D24-8FE4-95CAD26068D8}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6488	powershell.exe
6488	powershell.exe
3440	MSBuild.exe
3440	MSBuild.exe
3440	MSBuild.exe
3440	MSBuild.exe
3440	MSBuild.exe
1564	chrome.exe
1564	chrome.exe
3440	MSBuild.exe
3440	MSBuild.exe
3440	MSBuild.exe
3440	MSBuild.exe
3440	MSBuild.exe
3440	MSBuild.exe
3440	MSBuild.exe
3440	MSBuild.exe
1364	firefox.exe
1364	firefox.exe
1364	firefox.exe
1364	firefox.exe
1364	firefox.exe
1364	firefox.exe
1364	firefox.exe
1364	firefox.exe
1364	firefox.exe
1364	firefox.exe
1364	firefox.exe
1364	firefox.exe
1364	firefox.exe
1364	firefox.exe
1364	firefox.exe
1364	firefox.exe
1364	firefox.exe
1364	firefox.exe
1364	firefox.exe
1364	firefox.exe
1364	firefox.exe
1364	firefox.exe
1364	firefox.exe
1364	firefox.exe
3440	MSBuild.exe
3440	MSBuild.exe
3440	MSBuild.exe
3440	MSBuild.exe
3440	MSBuild.exe
3440	MSBuild.exe
3440	MSBuild.exe
3440	MSBuild.exe
3440	MSBuild.exe
3440	MSBuild.exe
3440	MSBuild.exe
3440	MSBuild.exe
3440	MSBuild.exe
3440	MSBuild.exe
3440	MSBuild.exe
3440	MSBuild.exe
6884	firefox.exe
6884	firefox.exe
6884	firefox.exe
6884	firefox.exe
6884	firefox.exe
6884	firefox.exe
6884	firefox.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	6488	powershell.exe
Token: SeDebugPrivilege	3440	MSBuild.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
1564	chrome.exe
1564	chrome.exe
1364	firefox.exe
1364	firefox.exe
1364	firefox.exe
1364	firefox.exe
1364	firefox.exe
1364	firefox.exe
1364	firefox.exe
4772	msedge.exe
6268	msedge.exe
6884	firefox.exe
6884	firefox.exe
6884	firefox.exe
6884	firefox.exe
6884	firefox.exe
6884	firefox.exe
6884	firefox.exe
6884	firefox.exe
5404	chrome.exe
5404	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1364	firefox.exe
6884	firefox.exe
3440	MSBuild.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6488 wrote to memory of 3440	6488	powershell.exe	93
PID 6488 wrote to memory of 3440	6488	powershell.exe	93
PID 6488 wrote to memory of 3440	6488	powershell.exe	93
PID 6488 wrote to memory of 3440	6488	powershell.exe	93
PID 6488 wrote to memory of 3440	6488	powershell.exe	93
PID 3440 wrote to memory of 1564	3440	MSBuild.exe	95
PID 1564 wrote to memory of 6784	1564	chrome.exe	96
PID 3440 wrote to memory of 1564	3440	MSBuild.exe	95
PID 3440 wrote to memory of 1564	3440	MSBuild.exe	95
PID 3440 wrote to memory of 6784	3440	MSBuild.exe	96
PID 3440 wrote to memory of 6784	3440	MSBuild.exe	96
PID 1564 wrote to memory of 4320	1564	chrome.exe	97
PID 1564 wrote to memory of 5692	1564	chrome.exe	98
PID 1564 wrote to memory of 3980	1564	chrome.exe	99
PID 1564 wrote to memory of 3436	1564	chrome.exe	100
PID 1564 wrote to memory of 852	1564	chrome.exe	101
PID 3440 wrote to memory of 4320	3440	MSBuild.exe	97
PID 1564 wrote to memory of 1336	1564	chrome.exe	102
PID 1564 wrote to memory of 1108	1564	chrome.exe	103
PID 1564 wrote to memory of 1864	1564	chrome.exe	104
PID 3440 wrote to memory of 4320	3440	MSBuild.exe	97
PID 3440 wrote to memory of 5692	3440	MSBuild.exe	98
PID 3440 wrote to memory of 5692	3440	MSBuild.exe	98
PID 1564 wrote to memory of 460	1564	chrome.exe	105
PID 3440 wrote to memory of 1564	3440	MSBuild.exe	95
PID 3440 wrote to memory of 1564	3440	MSBuild.exe	95
PID 3440 wrote to memory of 852	3440	MSBuild.exe	101
PID 3440 wrote to memory of 852	3440	MSBuild.exe	101
PID 3440 wrote to memory of 3980	3440	MSBuild.exe	99
PID 3440 wrote to memory of 3980	3440	MSBuild.exe	99
PID 3440 wrote to memory of 6784	3440	MSBuild.exe	96
PID 3440 wrote to memory of 6784	3440	MSBuild.exe	96
PID 1564 wrote to memory of 6600	1564	chrome.exe	106
PID 3440 wrote to memory of 1864	3440	MSBuild.exe	104
PID 3440 wrote to memory of 4320	3440	MSBuild.exe	97
PID 3440 wrote to memory of 4320	3440	MSBuild.exe	97
PID 3440 wrote to memory of 5692	3440	MSBuild.exe	98
PID 3440 wrote to memory of 5692	3440	MSBuild.exe	98
PID 3440 wrote to memory of 1564	3440	MSBuild.exe	95
PID 3440 wrote to memory of 1564	3440	MSBuild.exe	95
PID 3440 wrote to memory of 1336	3440	MSBuild.exe	102
PID 3440 wrote to memory of 1336	3440	MSBuild.exe	102
PID 3440 wrote to memory of 1108	3440	MSBuild.exe	103
PID 3440 wrote to memory of 1108	3440	MSBuild.exe	103
PID 3440 wrote to memory of 460	3440	MSBuild.exe	105
PID 3440 wrote to memory of 460	3440	MSBuild.exe	105
PID 3440 wrote to memory of 852	3440	MSBuild.exe	101
PID 3440 wrote to memory of 852	3440	MSBuild.exe	101
PID 3440 wrote to memory of 3980	3440	MSBuild.exe	99
PID 3440 wrote to memory of 3980	3440	MSBuild.exe	99
PID 3440 wrote to memory of 6784	3440	MSBuild.exe	96
PID 3440 wrote to memory of 6784	3440	MSBuild.exe	96
PID 3440 wrote to memory of 1864	3440	MSBuild.exe	104
PID 3440 wrote to memory of 1864	3440	MSBuild.exe	104
PID 3440 wrote to memory of 4320	3440	MSBuild.exe	97
PID 3440 wrote to memory of 4320	3440	MSBuild.exe	97
PID 3440 wrote to memory of 5692	3440	MSBuild.exe	98
PID 3440 wrote to memory of 5692	3440	MSBuild.exe	98
PID 3440 wrote to memory of 1564	3440	MSBuild.exe	95
PID 3440 wrote to memory of 1564	3440	MSBuild.exe	95
PID 3440 wrote to memory of 1336	3440	MSBuild.exe	102
PID 3440 wrote to memory of 1336	3440	MSBuild.exe	102
PID 3440 wrote to memory of 1108	3440	MSBuild.exe	103
PID 3440 wrote to memory of 1108	3440	MSBuild.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Letter dated 24.07.2026 (262244)-company.js"
1⤵
PID:1656

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Invoke-Expression $env:Wasserstein"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6488
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:3440
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bkvfqmbr.1kp"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1564
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\bkvfqmbr.1kp /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\bkvfqmbr.1kp\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\bkvfqmbr.1kp --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffa6621c728,0x7ffa6621c734,0x7ffa6621c740
      4⤵
      PID:6784
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bkvfqmbr.1kp" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1916,i,5767814106214666182,15575491547654087926,262144 --field-trial-handle=2260,i,12971291863208251936,12822426517530967397,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
      4⤵
      PID:4320
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bkvfqmbr.1kp" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2148,i,15743069763834995068,10134748133757261375,524288 --field-trial-handle=2260,i,12971291863208251936,12822426517530967397,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:11
      4⤵
      System Time Discovery
      PID:5692
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bkvfqmbr.1kp" --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,1847180404571164008,1919609205105579391,524288 --field-trial-handle=2260,i,12971291863208251936,12822426517530967397,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:13
      4⤵
      PID:3980
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bkvfqmbr.1kp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,12290164271547470948,6995340212758569478,2097152 --field-trial-handle=2260,i,12971291863208251936,12822426517530967397,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:1
      4⤵
      PID:3436
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bkvfqmbr.1kp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,5974793697304240019,15984398273102622504,2097152 --field-trial-handle=2260,i,12971291863208251936,12822426517530967397,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:1
      4⤵
      PID:852
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bkvfqmbr.1kp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3472,i,16277175635310392912,6788200108566680122,2097152 --field-trial-handle=2260,i,12971291863208251936,12822426517530967397,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:1
      4⤵
      PID:1336
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bkvfqmbr.1kp" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3484,i,13683367827691709650,6502274407246054808,2097152 --field-trial-handle=2260,i,12971291863208251936,12822426517530967397,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:9
      4⤵
      PID:1108
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bkvfqmbr.1kp" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4044,i,2000837154307168447,17927034484438555766,2097152 --field-trial-handle=2260,i,12971291863208251936,12822426517530967397,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:9
      4⤵
      PID:1864
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bkvfqmbr.1kp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4508,i,13488963417365194087,13550063467848328914,2097152 --field-trial-handle=2260,i,12971291863208251936,12822426517530967397,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:1
      4⤵
      PID:460
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bkvfqmbr.1kp" --force-high-res-timeticks=disabled --metrics-shmem-handle=4652,i,14298756079366742009,1939583144008842894,524288 --field-trial-handle=2260,i,12971291863208251936,12822426517530967397,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:14
      4⤵
      PID:6600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vzpt4jvp.bdf"
    3⤵
    PID:3100
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\vzpt4jvp.bdf
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1364
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1936 -prefsLen 27098 -prefMapHandle 1940 -prefMapSize 270279 -ipcHandle 2024 -initialChannelId {423bf517-3064-48d5-986e-547da6bddd93} -parentPid 1364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1364" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:7024
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2312 -prefsLen 27134 -prefMapHandle 2316 -prefMapSize 270279 -ipcHandle 2308 -initialChannelId {ba59f508-8a83-4b50-800b-41b89d9863e0} -parentPid 1364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1364" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:2000
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6251e5c5-13eb-4002-a78a-4cda135fa2e4.dmp"
        5⤵
        
        PID:7040
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1936 -prefsLen 27134 -prefMapHandle 2760 -prefMapSize 270279 -ipcHandle 2796 -initialChannelId {6881544f-df85-4ec9-b0de-8ad8ecf962e7} -parentPid 1364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1364" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:3796
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\cdb9cede-ddd6-456c-8730-20c6964b686d.dmp"
        5⤵
        
        PID:2484
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2920 -prefsLen 27134 -prefMapHandle 2860 -prefMapSize 270279 -ipcHandle 2964 -initialChannelId {8bc47fe1-f8fa-4093-8c79-ead817566854} -parentPid 1364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1364" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:6988
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\43621d99-ee89-4d94-b798-6da952c860df.dmp"
        5⤵
        
        PID:4664
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3064 -prefsLen 27199 -prefMapHandle 3124 -prefMapSize 270279 -ipcHandle 3280 -initialChannelId {b586279f-cd7d-4280-a50f-1e1ea647982e} -parentPid 1364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1364" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:6316
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bd85ac3f-cdf2-4101-b9b0-4c8cb67135f5.dmp"
        5⤵
        
        PID:1960
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2828 -prefsLen 27198 -prefMapHandle 3000 -prefMapSize 270279 -ipcHandle 3112 -initialChannelId {32d96040-37c4-4607-b93a-7d092f8a40bf} -parentPid 1364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1364" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:4908
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3212 -prefsLen 27323 -prefMapHandle 3144 -prefMapSize 270279 -jsInitHandle 3148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3164 -initialChannelId {b2ac72e7-1150-405a-b77a-858547300390} -parentPid 1364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1364" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        5⤵
        Checks processor information in registry
        
        PID:4428
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2d073794-354f-449b-8381-528b0ddb6d3e.dmp"
        5⤵
        
        PID:5696
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3808 -prefsLen 27323 -prefMapHandle 3812 -prefMapSize 270279 -ipcHandle 1616 -initialChannelId {186e331f-4c67-4453-8b49-845c02b6a3d8} -parentPid 1364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1364" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 gpu
        5⤵
        
        PID:2980
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\55e6ad08-3f95-49d2-bc61-de8106d60993.dmp"
        5⤵
        
        PID:5992
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3860 -prefsLen 27323 -prefMapHandle 3844 -prefMapSize 270279 -ipcHandle 3912 -initialChannelId {02e80681-2b5f-4370-9a91-d52f601ad51e} -parentPid 1364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1364" -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 rdd
        5⤵
        
        PID:2216
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4468 -prefsLen 34822 -prefMapHandle 4472 -prefMapSize 270279 -jsInitHandle 4476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4484 -initialChannelId {04cf20bb-1c07-4186-8ae0-d1d8293b4994} -parentPid 1364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1364" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:1724
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4792 -prefsLen 32819 -prefMapHandle 4796 -prefMapSize 270279 -jsInitHandle 4800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4808 -initialChannelId {df22363e-6e9d-4857-ab02-1ce0a5c94365} -parentPid 1364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1364" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:1200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk"
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:4772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x270,0x7ffa600fc188,0x7ffa600fc194,0x7ffa600fc1a0
      4⤵
      PID:1172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1884,i,2293813817761368265,11012069033648793442,262144 --field-trial-handle=2396,i,7567237471507261526,210845607345815980,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:2
      4⤵
      PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,18003065484791923108,9011506172986122352,524288 --field-trial-handle=2396,i,7567237471507261526,210845607345815980,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:11
      4⤵
      System Time Discovery
      PID:4660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,857591007552804672,13066038371892268923,524288 --field-trial-handle=2396,i,7567237471507261526,210845607345815980,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:13
      4⤵
      PID:4200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3204,i,9379973490587869163,15222013934920365051,2097152 --field-trial-handle=2396,i,7567237471507261526,210845607345815980,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1
      4⤵
      PID:2152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3208,i,13564968948472868217,3797281482168825574,2097152 --field-trial-handle=2396,i,7567237471507261526,210845607345815980,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
      4⤵
      PID:2040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3372,i,6867811931607808535,16249885613928730777,524288 --field-trial-handle=2396,i,7567237471507261526,210845607345815980,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14
      4⤵
      PID:6200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,14599943752360820771,5646698805428011025,524288 --field-trial-handle=2396,i,7567237471507261526,210845607345815980,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
      4⤵
      PID:3684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,6586104056180408031,11290485473254947350,524288 --field-trial-handle=2396,i,7567237471507261526,210845607345815980,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:14
      4⤵
      PID:4768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3752,i,13623918028551853755,8969628760821315505,2097152 --field-trial-handle=2396,i,7567237471507261526,210845607345815980,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:1
      4⤵
      PID:4396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3784,i,10861841385419084064,13859684862543543788,2097152 --field-trial-handle=2396,i,7567237471507261526,210845607345815980,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:9
      4⤵
      PID:5516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3828,i,16655358226287926728,363798638044687278,2097152 --field-trial-handle=2396,i,7567237471507261526,210845607345815980,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:1
      4⤵
      PID:2896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3876,i,11243574573064222228,14491023553888869672,2097152 --field-trial-handle=2396,i,7567237471507261526,210845607345815980,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:9
      4⤵
      PID:2880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3888,i,10800019994886186285,15564826893330232832,2097152 --field-trial-handle=2396,i,7567237471507261526,210845607345815980,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:1
      4⤵
      PID:1568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3940,i,4484236702638149093,18432970770895096692,2097152 --field-trial-handle=2396,i,7567237471507261526,210845607345815980,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:9
      4⤵
      PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3964,i,2759353437071753624,12196555849790992195,2097152 --field-trial-handle=2396,i,7567237471507261526,210845607345815980,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:1
      4⤵
      PID:1644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3988,i,15611283151890485213,9896438946434126782,2097152 --field-trial-handle=2396,i,7567237471507261526,210845607345815980,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:9
      4⤵
      PID:1908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4024,i,16462872609073767851,3864384460824519430,2097152 --field-trial-handle=2396,i,7567237471507261526,210845607345815980,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:1
      4⤵
      PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4036,i,13521956636171148938,6921062679336141766,2097152 --field-trial-handle=2396,i,7567237471507261526,210845607345815980,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:9
      4⤵
      PID:4964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4132,i,14449335857140010384,10829822415793823029,524288 --field-trial-handle=2396,i,7567237471507261526,210845607345815980,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
      4⤵
      PID:2292
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1148
        5⤵
        
        PID:4820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,4006576808107146921,18245970933968595662,524288 --field-trial-handle=2396,i,7567237471507261526,210845607345815980,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
      4⤵
      PID:3668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,11527348978157278128,10038293390860780592,524288 --field-trial-handle=2396,i,7567237471507261526,210845607345815980,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
      4⤵
      PID:1292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,16202297663387969351,8670290473898018308,524288 --field-trial-handle=2396,i,7567237471507261526,210845607345815980,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
      4⤵
      PID:3444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=632
        5⤵
        
        PID:3520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,10180658350020324612,17070823282317245563,524288 --field-trial-handle=2396,i,7567237471507261526,210845607345815980,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
      4⤵
      PID:1208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,9912080698373280747,1560270691670210023,524288 --field-trial-handle=2396,i,7567237471507261526,210845607345815980,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14
      4⤵
      PID:6524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,7919433554894653826,7448331714732425055,524288 --field-trial-handle=2396,i,7567237471507261526,210845607345815980,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14
      4⤵
      PID:1656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,7919433554894653826,7448331714732425055,524288 --field-trial-handle=2396,i,7567237471507261526,210845607345815980,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14
      4⤵
      PID:376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b"
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:6268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x26c,0x7ffa600fc188,0x7ffa600fc194,0x7ffa600fc1a0
      4⤵
      PID:2512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=2168,i,16856407230113282334,16106987131216620229,262144 --field-trial-handle=2992,i,6620773895376173762,11380034824386582391,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:2
      4⤵
      PID:3036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,7975865841386178569,5343156496275577390,524288 --field-trial-handle=2992,i,6620773895376173762,11380034824386582391,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:11
      4⤵
      System Time Discovery
      PID:3120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2700,i,5453545753442410679,10262508657281474108,524288 --field-trial-handle=2992,i,6620773895376173762,11380034824386582391,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:13
      4⤵
      PID:988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,16527551317393178055,692387772533858315,2097152 --field-trial-handle=2992,i,6620773895376173762,11380034824386582391,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
      4⤵
      PID:5828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,17594740066104926412,6133777265699107028,2097152 --field-trial-handle=2992,i,6620773895376173762,11380034824386582391,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
      4⤵
      PID:1656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,801255219431763182,13878947242518735406,524288 --field-trial-handle=2992,i,6620773895376173762,11380034824386582391,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:14
      4⤵
      PID:1300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,6276201821238207358,641893557482817801,524288 --field-trial-handle=2992,i,6620773895376173762,11380034824386582391,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:14
      4⤵
      PID:1996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,9783496717357180342,7077952140311552336,524288 --field-trial-handle=2992,i,6620773895376173762,11380034824386582391,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:14
      4⤵
      PID:5720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3740,i,15698891317537358456,4058907083603851278,2097152 --field-trial-handle=2992,i,6620773895376173762,11380034824386582391,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:1
      4⤵
      PID:2940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3744,i,15051890274665858263,6779114785058983415,2097152 --field-trial-handle=2992,i,6620773895376173762,11380034824386582391,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:9
      4⤵
      PID:2172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3788,i,13327960701600483571,3872245817557869712,2097152 --field-trial-handle=2992,i,6620773895376173762,11380034824386582391,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:1
      4⤵
      PID:5452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3820,i,4079772987935828260,7730696741647879628,2097152 --field-trial-handle=2992,i,6620773895376173762,11380034824386582391,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:9
      4⤵
      PID:6820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3860,i,15174635258401881071,15669043095471826329,2097152 --field-trial-handle=2992,i,6620773895376173762,11380034824386582391,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:1
      4⤵
      PID:2996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3884,i,11549356384580588450,12471578273006358112,2097152 --field-trial-handle=2992,i,6620773895376173762,11380034824386582391,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:9
      4⤵
      PID:7140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3908,i,4685559546250877844,14582172745735849314,2097152 --field-trial-handle=2992,i,6620773895376173762,11380034824386582391,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:1
      4⤵
      PID:7096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3980,i,4602007804773399366,15132964299457771741,2097152 --field-trial-handle=2992,i,6620773895376173762,11380034824386582391,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:9
      4⤵
      PID:5332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4020,i,6888209987091400262,8677695534486424407,2097152 --field-trial-handle=2992,i,6620773895376173762,11380034824386582391,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:1
      4⤵
      PID:6504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4068,i,4188790609300314249,5610519828188043054,2097152 --field-trial-handle=2992,i,6620773895376173762,11380034824386582391,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:9
      4⤵
      PID:1060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,3498338514177202947,17306618653418330965,524288 --field-trial-handle=2992,i,6620773895376173762,11380034824386582391,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:14
      4⤵
      PID:6316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1156
        5⤵
        
        PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,2280768370059230961,12435769795622638902,524288 --field-trial-handle=2992,i,6620773895376173762,11380034824386582391,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
      4⤵
      PID:6588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,7895175731098129099,2671666205768143636,524288 --field-trial-handle=2992,i,6620773895376173762,11380034824386582391,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
      4⤵
      PID:6364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=624
        5⤵
        
        PID:4252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,4067179849165456490,15861571202138243163,524288 --field-trial-handle=2992,i,6620773895376173762,11380034824386582391,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:14
      4⤵
      PID:5696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,8668195548920010101,4863653348096481007,524288 --field-trial-handle=2992,i,6620773895376173762,11380034824386582391,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
      4⤵
      PID:7024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,1646105910661040237,7523044533171412302,524288 --field-trial-handle=2992,i,6620773895376173762,11380034824386582391,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
      4⤵
      PID:5160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cqp4t2v4.4hv"
    3⤵
    PID:3252
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cqp4t2v4.4hv
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:6884
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27097 -prefMapHandle 1960 -prefMapSize 270331 -ipcHandle 2032 -initialChannelId {0aa99b0e-970a-4da1-9797-cda5ecd055a8} -parentPid 6884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6884" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:4396
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2292 -prefsLen 27133 -prefMapHandle 2284 -prefMapSize 270331 -ipcHandle 2276 -initialChannelId {485e58d0-19d9-46bf-baad-0c5ea1b9f007} -parentPid 6884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:4456
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6d3854e0-83e7-4882-9c3e-8dae4cfd7be0.dmp"
        5⤵
        
        PID:5152
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2256 -prefsLen 27133 -prefMapHandle 2724 -prefMapSize 270331 -ipcHandle 2720 -initialChannelId {dce4a9be-395a-4187-922c-2431c4e69fc9} -parentPid 6884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6884" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:2672
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\5f943224-7859-4908-9794-3ac92a098b97.dmp"
        5⤵
        
        PID:1724
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2720 -prefsLen 27133 -prefMapHandle 2792 -prefMapSize 270331 -ipcHandle 2960 -initialChannelId {5c08f12a-e340-4f91-88cb-44850d1bd888} -parentPid 6884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6884" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:6400
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d0e0fa77-2efd-4337-8786-f1de61414e71.dmp"
        5⤵
        
        PID:712
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2960 -prefsLen 27198 -prefMapHandle 3568 -prefMapSize 270331 -ipcHandle 3496 -initialChannelId {a11ed9b3-83ce-411a-9911-21a7a483e596} -parentPid 6884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6884" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:5804
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3624 -prefsLen 27274 -prefMapHandle 3628 -prefMapSize 270331 -jsInitHandle 3632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2960 -initialChannelId {7f44f951-ec5b-424a-873b-23503f5bc823} -parentPid 6884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:3428
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\7f859d52-eca9-421b-87dd-1343b7bfeda5.dmp"
        5⤵
        
        PID:4840
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3496 -prefsLen 27274 -prefMapHandle 4048 -prefMapSize 270331 -ipcHandle 4132 -initialChannelId {0d1b0797-74e4-4d83-bd1e-7b359aa9518e} -parentPid 6884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6884" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:6288
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\11909a2f-9db9-46f6-9b24-30a3e8563c1d.dmp"
        5⤵
        
        PID:1048
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4204 -prefsLen 27274 -prefMapHandle 4188 -prefMapSize 270331 -ipcHandle 4176 -initialChannelId {c1d0e97f-3522-4732-8755-e8136a9513f5} -parentPid 6884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6884" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:2988
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2532 -prefsLen 34827 -prefMapHandle 1128 -prefMapSize 270331 -jsInitHandle 912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1116 -initialChannelId {04c41c54-1091-493c-baaa-87f6cbb4dfcc} -parentPid 6884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:5804
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4768 -prefsLen 32766 -prefMapHandle 4772 -prefMapSize 270331 -jsInitHandle 4776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4784 -initialChannelId {9b363c38-0fab-4b58-9f52-f264959f3e3f} -parentPid 6884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:4640
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5176 -prefsLen 34957 -prefMapHandle 5192 -prefMapSize 270331 -ipcHandle 5208 -initialChannelId {ab4747fc-c8ea-4a91-a33a-a572fc486353} -parentPid 6884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
        5⤵
        Checks processor information in registry
        
        PID:6400
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5408 -prefsLen 32899 -prefMapHandle 5412 -prefMapSize 270331 -jsInitHandle 5416 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5192 -initialChannelId {6b0f50ee-7bee-472a-9933-554d9082196d} -parentPid 6884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:948
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5432 -prefsLen 32899 -prefMapHandle 5436 -prefMapSize 270331 -jsInitHandle 5440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5332 -initialChannelId {3a8e5fe2-4896-426b-9ebb-723629b49149} -parentPid 6884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:1456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\px4xszst.u55"
    3⤵
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:5404
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\px4xszst.u55 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\px4xszst.u55\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\px4xszst.u55 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffa60f7c728,0x7ffa60f7c734,0x7ffa60f7c740
      4⤵
      PID:5104
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\px4xszst.u55" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1704,i,776155646213402350,15708387792137908653,262144 --field-trial-handle=2060,i,5861497322975931333,14041112212544709068,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:2
      4⤵
      PID:4724
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\px4xszst.u55" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1868,i,4246082628497340763,3983815402282287844,524288 --field-trial-handle=2060,i,5861497322975931333,14041112212544709068,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:11
      4⤵
      System Time Discovery
      PID:4744
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\px4xszst.u55" --force-high-res-timeticks=disabled --metrics-shmem-handle=2076,i,3366827813248269709,424563796402819184,524288 --field-trial-handle=2060,i,5861497322975931333,14041112212544709068,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:13
      4⤵
      PID:1816
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\px4xszst.u55" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2976,i,13020744151581939697,16258528016619814825,2097152 --field-trial-handle=2060,i,5861497322975931333,14041112212544709068,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:1
      4⤵
      PID:6120
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\px4xszst.u55" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3000,i,4691503567469279563,8538819795332404986,2097152 --field-trial-handle=2060,i,5861497322975931333,14041112212544709068,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:1
      4⤵
      PID:4164
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\px4xszst.u55" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3188,i,2604891887234377974,17574137396994124754,2097152 --field-trial-handle=2060,i,5861497322975931333,14041112212544709068,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:1
      4⤵
      PID:3572
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\px4xszst.u55" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3236,i,2868264106678251073,12463766671808014752,2097152 --field-trial-handle=2060,i,5861497322975931333,14041112212544709068,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:9
      4⤵
      PID:3436
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\px4xszst.u55" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3760,i,1990997320693291390,16984208435735519375,2097152 --field-trial-handle=2060,i,5861497322975931333,14041112212544709068,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:9
      4⤵
      PID:3316
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\px4xszst.u55" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4468,i,3043977888269516278,11847089067290511285,2097152 --field-trial-handle=2060,i,5861497322975931333,14041112212544709068,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:1
      4⤵
      PID:1300
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\px4xszst.u55" --force-high-res-timeticks=disabled --metrics-shmem-handle=4632,i,2121791646826570790,4404569140401102295,524288 --field-trial-handle=2060,i,5861497322975931333,14041112212544709068,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:14
      4⤵
      PID:2508
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\px4xszst.u55" --force-high-res-timeticks=disabled --metrics-shmem-handle=5232,i,16139889799532375932,9739224045210852770,524288 --field-trial-handle=2060,i,5861497322975931333,14041112212544709068,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
      4⤵
      PID:4840
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\px4xszst.u55" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5312,i,17519615398225608268,2625081426190173862,2097152 --field-trial-handle=2060,i,5861497322975931333,14041112212544709068,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
      4⤵
      PID:5956
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\px4xszst.u55" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5356,i,2583258525085245205,1224674338926896699,2097152 --field-trial-handle=2060,i,5861497322975931333,14041112212544709068,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1
      4⤵
      PID:3272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6eagavx.default-release\activity-stream.contile.json
Size 4KB
SHA256 36138e1dded95ed036ccb92d4639cd76e28d1ae8cd8c55a3053d48739fc8ff7c
MD5 09d934e3d11ccd331ca72bcdd7734c0d
SHA1 d42200f58b202ef9c15b9fc05cb95535c9f07c46
SHA512 600514b6c8f75c0a6cc7c3ad1dd5e5550719edc384f58a15cd8f0d3406178989cdc29a165ea827165aa2f6649345a8db7de333d3772d2902077d432d67304af9
SSDEEP 96:TbgW18DIsXKqmVxmzlYbT+mRnFHKYzzc3jnJKgY6DFGl:XfiLXKqmVxmzl1mRnFjzVvwFGl
TLSH
T192A11AA79CA4D5530731F7F23D49379AB18BB05BDED8594AFB958C11848426B40DE284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6eagavx.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 d79cb0bd9eeadcccda0ce4dc290c340231baacee15130ec3ca6c086c9e11dcd7
MD5 fca53f9d3515f773878404a082179f85
SHA1 7bf0a34e1c834e4a434d7c1538d4cbd9630367d6
SHA512 aa67c5571a317982dfdf748aea95a4ee369438f6ffede82ade4ba570331b94c84cbdd23d45aa1d3aaa9bedf62b6a88d327bf21023dc3400939f23259b4f4ab59
SSDEEP 768:xyw97Ne/6emi+wKt1vTRpwHT5G2wsP4wxMkseMeR6lc57PoFYDfTHEoLD:AwRPi+lcT5Gi4wxCK7gafEoH
TLSH
T126731BA397A871BB1BA137CB2C4F799762E20145E78545C9FCEDC52DC1CCA94123E2AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b\Crashpad\settings.dat
Size 280B
SHA256 6d6477e226a951eef7b2008dc3ace2dfba4f61870c61c5712c719d02642b6a5b
MD5 4b7b60b31da35fdcef256dd4a2f584a1
SHA1 c6740d4da7ac3167189e441af74166ac305caf90
SHA512 506404cb6a6da34ef7ecd58fabb8a626206ce3a7bdaaaf467e4d3f53dd18490adf0c0b70045a53c9309a61a8ac3fdd834995cef93d39f730a39f21be732420c4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b\Crashpad\settings.dat
Size 280B
SHA256 c5dfa62d27bae30af92bf1b29914f888a66c880744f55c36207accf085c5e341
MD5 56750a1b5f25b64b2b74c55fe62de4f7
SHA1 a20ec457beb48576975c50fed2a7356532e84d8c
SHA512 88c31f8869d396c6dd0bd4127b1dc2cb1f2daeff93fb35b15b7630f4c94f539d3018a8cf165a8a5a6d33326b7dc9f88a17b8f75be64097d81ddd4bacd27cd57e
TLSH
T1F0D0223CBB3EB02AF2E03CF3003033CC8220FC00000C230082B20800ECA320000CA0C8
MD5 SHA1 SHA512 TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b\Default\Cache\Cache_Data\f_000002
Size 402KB
SHA256 aa6cc85e6422918c8f28615f5a6229fd95551db4866a953e94db3ede85e74157
MD5 1d14a54ebcbc8ab643de128a275df7ac
SHA1 238af131932ae71c9b5904dbf79312969b686d89
SHA512 7c7ebf7520304f1184b033b4d353a4ba4b13f97a9b25e2ec01bf603581e68d961bd62ac512b523203f21d45a3a10aaf570398cb723ed00dde4b27547a1a1bd3f
SSDEEP 6144:+Hixx+mZCMYrU6Em16QfXqI1DRDextUnQngWg/4dHyA6928F6iuHHLlXcJEOXkeA:TpCMbfkz/Hi/eD/2SAq3ELYvXVGF9
TLSH
T1F79423BDB31924CEB2A5E3388E75CF5A050C7E709A980E2FE7EA5445BC5B790704E358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b\Default\Cache\Cache_Data\f_000003
Size 96KB
SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
MD5 76c1b9685c996f14f4cc8b585ddfb467
SHA1 e774b883f6b5736a9f0f0f05cfed247fdd8bdf6d
SHA512 d67c98951d327ea38ba3e761a229436782094e823847d989ddda919aa4de613bc7c5bb057968856414ecf2f2fe82e823bf3a04691d62ad7b67f7b6c142a807d1
SSDEEP 3072:rYsgcoaeqVBTILAbL7ABGMeTDm0ZSfKaXH:raU6qL7ABGMMmEFkH
TLSH
T1F7A3127B369F8CD14907CC51321A335688F4D0ADE2BA066B3D102E6A3B0B75F7A86F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b\Default\Cache\Cache_Data\f_000004
Size 67KB
SHA256 083e4b904aedf73603201d5b3c7baa27df72db55b3146d3845f0be8dfb9a1fce
MD5 7834c4d0d73c0c39adea3e576be1f3e4
SHA1 d960d84cc5e517feefdc6b23d99ae406847e603d
SHA512 fc336a69e9e3a13adef75e294688845ed03efe4779d901f67285bb91639e9cecca6bbb06f4e45261bec3f8577c4bb8ae803ad9cf70aef085de92b4fd591d1bdd
SSDEEP 1536:uxppd9LrL8qqSlSdwavN8Un5m98oODLLDHocIXhLA1Xbodcwz4RnF:KpL9LreS8TpA8p/wklb29z45F
TLSH
T1DD6301195338F172A5C066C64C330D91B53DFFA636DC63DD490709B5888A8A93FB39A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b\Default\Cache\Cache_Data\f_000008
Size 78KB
SHA256 921f5a72a8ce4b972e708262d09512b506cbaef17ff653558fa11f43f09adc4d
MD5 c399c73ecce5d2be400a5b713b1105da
SHA1 3554234873abc1f4a81a8b2247d50e6510c359fb
SHA512 9c92f7c5e9047e72c8396658e974b8928fd814955a0a8faf590e35c975cdb80672b6650507c7369e84164a292849cd567243112d34a2b5386d1d6b5e8c9ea46c
SSDEEP 1536:E9zz8WISj8f9pXZrJosBsbIOKN6DJnCJkM8nEY9gRcOw3XAcx2dBYCrT:s8v9TJuEOKN0Jik/nEfRcDHw3T
TLSH
T1F37312B53A307B97C5EC9200D684E9EC1F802DECA0431605AFF78D91856A29ADDDD6EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b\Default\Cache\Cache_Data\f_000009
Size 27KB
SHA256 4055c08923c81d63735c1691baa778c332bf680b8c4eb057d7b87e2c00c5578d
MD5 aa6a30350189be311d6f87b7d145d85b
SHA1 79d0105a90db8fe73876d31dc4f54bb9a194002a
SHA512 3563cdd2399d4ffe7f76a2b252800e2b767f7fc776fe1faf1bd385cc41ff9305c7a5367a2d28d6bcb46b9202461c23b86ad6f1f3cec2cf51ffbd181000651037
SSDEEP 768:Y+8X/NT0ZezFy6uLGsyvi7ssXAS39YGiE1TJnhC:Y/ZexL0o5X2k1Tds
TLSH
T1ACD2F104AD3D7AA06468E3D332713166FDA696A10B7702D2C615E625B3983F42BCBCE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b\Default\Cache\Cache_Data\f_00000d
Size 19KB
SHA256 1c692f814e1f56974792aa202a077e73bfb3597e1a9b34db3b20eb7b804ab024
MD5 c7d3b1ba1aee16eaeafed6a137f8a356
SHA1 1e91e47e2473a302c98cc312a71d4ef4ececd3a9
SHA512 fb0f6cc4f1eff1a14ca3283ed6ff12a1e09ec6ae48fd1deb957c31564093e2f6dbe8721607067c8970bde9f5a44b86b8683e78500113a8cf2000413d507c1195
SSDEEP 384:FO83zYji5ny7iTOCQ8FbNSlIk6KAPA/1Dnej8+YZTVO42k2x/Y3RJWl26K:VzYmRTBQUclbAY/5E8+YZZOi2x/q6K
TLSH
T15C92F16F757EF9E8ED11E781B5837EDD1CA591B828424E417E0B814FC4889DBBF24121
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b\Default\Cache\Cache_Data\f_000011
Size 60KB
SHA256 09942f492f93e5748a18748a9d5703c1d9fb2371e88bc2a01fa7779650dc40dc
MD5 bdb48354eacf1843569fdf0898e71667
SHA1 c0090b0822e5bf07180d4366700316f8de682397
SHA512 49eef2ef2dbce4b0af131555846b2f3e5180e25f1b4fd2f8cfea9d103811e6b954d1209b70ce85fcbf88eabb48399e6240a1db02544d056ae55a22b10a5f0bd4
SSDEEP 1536:l6QKCA9YwCpxAMmNB56jI+BCDMv7FoRRQOYLG/:l6QcYjaFN+8uCIDFw2K/
TLSH
T104530213EE0C472D26E597594723CF026AFD0456AF0AF40D6F8BDEF0A2686C5A35E834
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b\Default\Cache\Cache_Data\f_000019
Size 17KB
SHA256 52b130fd9a673b234d9cc38a19203fc386350c72c38abb314e8facc2ea80c872
MD5 3b1c5f0bbe606776984ff0a49108b843
SHA1 70f2935165af2c5194932fec2731d287fd7655b9
SHA512 b81ee92c280e97449ba3b25a56e9c7f4f4b2c9f2ee1d05102f9797cf769a2550ada896d0d1c1b078f25990ed6e72c214bf94ae628805e791a1ebb2dde3d78922
SSDEEP 384:KDmW0tzmXXmRDD3JOUxQB36BjIvalhfV54jMACU1POnXuH:KChtaX29tO02KGvchfV4uiOXuH
TLSH
T12E82F1BA3D5AFCCCCD6131E6D11553C27939772CF2A91CE4C8764DAA0A98B793C18474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000024

Path C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b\Default\Cache\Cache_Data\f_000024
Size 16KB
SHA256 dd1b1bc1b12378c3f2d5257e13fce269351f7205c0b1d9a353bb6519020cd4dd
MD5 1828eec30395f0667811a9b55c744f2c
SHA1 62389846e8e32746da94a1cd5874918bc6f61cbc
SHA512 a5baf8d674ec9368cc53cf6074f6734dd5c01a7372bac636df0b064617759485d480b6dbc4036edbfaf5e54da5c44363fd51d76897fad1e959033897b377510c
SSDEEP 384:WBY2ZpX4PZRjQrzKRr39XXU0AoL6RHYnF+CP9JhBI9V6oB:WBV4PZCKV60AoLaYnY294Vv
TLSH
T1E172C0D059E96EF459DA15C4083D61105F23B520ABD3C7829BE24A72EEC27FC16FB490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000026

Path C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b\Default\Cache\Cache_Data\f_000026
Size 36KB
SHA256 adb370626267a938bfddf0a9d94844f28bb5b1933949412cdda0e15c17f19431
MD5 253c55cc1ce29ac6fa95cb4782deb8ad
SHA1 a6f94096c4b8f4c2f55a4e9fbddb34ce6fcbc8a1
SHA512 24a8b1da99deb3b2006f5b344c76abc2e75b10a5ab5f2eef16c5519c5058be1cf19b70856fa02c39e077723b8d1a8022f63e2344a0ca96396c69b17524ec1467
SSDEEP 768:PtqAi3gctc9sS703cBM+6Yk4X9i2B/a1rKKPNY8P07u3yI0vRe:P8gcKWu0sBP669ZJa1GlKyIUe
TLSH
T17403F1D8E28AFD18B4BA2D8C0E6ED6BD942898490D30A2723C474C3516BB6F43FD55A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002d

Path C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b\Default\Cache\Cache_Data\f_00002d
Size 42KB
SHA256 089a89ef090e95a109570e7377d4e0d4e65503b9e87855e236e969cb6e33ceec
MD5 d43166592aadf9aa1aaed550f793994d
SHA1 c85e8a196a5821d917ab47d0e972db808f8d66f4
SHA512 455801f719521f708277e8f5730f51fd9a055b4c2cbecfb6cacf0d0424ebf799c1474041fe723d9e7dc1dd37cd1c7d5b08c2cf65c4434055753c75bd689697be
SSDEEP 768:n3kXcCXi76wVhVXJkK4zrbS8dJxQD3gvuIsbL3S8+TKZqEUAACKaKGbchZ2c9SmL:3YQ76wFxAS8dJiD3i63GTKZqEUyKII8C
TLSH
T1F113E1CABB179666562881E65583032614EC48ADD60F70D7EB6D316D53BC02F6CEBCB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000037

Path C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b\Default\Cache\Cache_Data\f_000037
Size 16KB
SHA256 abf44e4e9928c3c6141c00842746c42192078d699b8e8e65c4f7e630aaab0210
MD5 e6e59b39017f4009a0a3327967431678
SHA1 7c69616071dd68e02e4dd2b6e07281a1b627f706
SHA512 4fd7cdaa93d86fa40ebce2c45f9fca7cfe2293c60c0b2d84ce0cca3cbeebf5fe60aeabaf3568f7d73e1285a088f9e1c0bcd77c2731ee24981e393347e7cffcad
SSDEEP 384:pOibbuO6oghUlywYvxZyNCQvLm0HP5a17dO+:sYbIXJYfvLlHRafO+
TLSH
T1DF72D09752C0858B1C3003AF10ED05C18DAE32265B5B4FC1D08FD6EA96E2EABD52B727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3796dd19-87b7-49af-9ee6-c1640759d7e4.tmp

Path C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b\Default\DualEngine\3796dd19-87b7-49af-9ee6-c1640759d7e4.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 232691c24e2bc7fd02f5136f31995a95be4adf7fe2f1944ea05c976f17521196
MD5 d8634d7caa1ecaea5703fe48f99f15cc
SHA1 a14f1f57b52f07f604311c7f811c6970d656687e
SHA512 38873938dec59b2cb6af49fe35fe7d57a401b5c8899901a414bff54ae5d6e1fdf2fb88f0f19df7150e96767c80e6433c7cf27d0a40061ac9e0739b1bf9ab26ff
TLSH
T19AD02BAA295A0420EC6F8BEA547240D480073C5DDE44FC8A00AD75C710703AA7907D61
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 7a74a9adc33456a205cf3bd2414389bbfd26cf1d924a896378f28d32b9bbda48
MD5 5af47a87471476058727d3ce43fdc58b
SHA1 4dc1bce6350c7c58d491515608e4a87bd4af3aa0
SHA512 d4b1042e837ff1e82e99ed2267980c4d6977b23e90300e99db469547a5c3339be4740acca1ff6eecc22f1f4d5527f047f96bc28634e406ebe0ce5a8f7a61e580
TLSH
T19BE0687A3EE72420F95FCBDA143204E840013C59CA00BC8E546A75D720713AE640BD21
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a2f6e.TMP

Path C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe5a2f6e.TMP
Size 153B
SHA256 97663ea08ace69dd84410496116dd08679c6020484f6a6e577beab3480e1861f
MD5 f2bb79b2a299de964ceee653dfdd76d3
SHA1 899a7755306430d3b598c4c1f7e821a697859ffa
SHA512 4845deb9b72860d1212f6064ccde26c463820c3e490642b7cab4606259b3093663225f6a007e190037c330da36dbdb07e237409d5dbe1e368cb9fa47ecfb794b
TLSH
T1C0C08CBB2D561410ED4A8AED103214D0822A6C888E84FC8A406D70C720702367113C21
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b\Local State
Size 4KB
SHA256 b1c79859568361eab254d153703fb455ac3c12ff5a2310b4e08ad0f566070ea1
MD5 c24796193c2dcd3bae5f5fd40162e805
SHA1 6ee5a54e675b62e209172e6a19bd5a87b0a34ec4
SHA512 c5defc1113e77fa29bb20837a31d23b1ad35483da25a7aa856550e042d3f583ce473e0c48fc2fd37bdf76015623d8f42b57c23700109a400510c965f965160fb
SSDEEP 96:lqGNkpsFfdC3rUS1WS+DJ8BqPTvZPkK0eUnPBFq4a:cGNa4wXSJQMNkKqPo
TLSH
T1F981A6726424EC374AE56989758A27A3AEB870F3DD01BF55E1D9530C04DB35C2B4E837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b\Local State
Size 5KB
SHA256 a2b25a3ba2227a54dffc2a1973ef365ce97dcd974b007a40524c250f0f58273b
MD5 5a5660cbaf5a2352c23887f23763e531
SHA1 d9c3072d318fc9d2fa3051684e68044ecf7bcf80
SHA512 72a9d3ecac0ca77a47b3c2f9703ae6ba9d2e5a59f4d981e5643b41406c01a1d75ed02c17812d6b711bd9f8cb5ce77f9490f102ab7da040c4c4d4e75ea1b62c76
SSDEEP 96:lqGNkeQsFfdC3rUS58Frh/cInURoDotovdr+DJLBqPTvZPkK0eUnPBFq4a:cGN64wsooDUwGJ1MNkKqPo
TLSH
T18AB1C8726434EC370EE5A989B4CA2793BEB870B3E945BF59D1EC5B0C04D7398274A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a1fbe.TMP

Path C:\Users\Admin\AppData\Local\Temp\4jmae5o3.v0b\Local State~RFe5a1fbe.TMP
Size 1KB
SHA256 6cea8ccaa119d86b64963bcdfa5f6fe169646a32f201f87b6687fe28f0590828
MD5 795df72fb7583fb29bca17ffe0a761d5
SHA1 b6b8fea1eb38bcda41bb83bc7c328be61cd5f828
SHA512 3406059be2cd0a39ae690d4ad53d85ecd50738d07da4011ba0765d684f1a38f97192f14cadc49fd94da23e92a7b6b138eae2d8886408cf0057dfb37a46a8a6cc
TLSH
T16D31D67168782C379C9155C7328E6BA32E78A1B7C2017F0881FD5B0C04D76CC234A83B
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\bkvfqmbr.1kp\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\bkvfqmbr.1kp\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\bkvfqmbr.1kp\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\bkvfqmbr.1kp\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\bkvfqmbr.1kp\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\bkvfqmbr.1kp\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\bkvfqmbr.1kp\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk\Crashpad\settings.dat
Size 280B
SHA256 fe667aa733cbabb5fa283599f0d2e989aac6ff65d2dd5295235a325fe2308ee3
MD5 73cf4cb3dc5109bdacc2b694dec2e549
SHA1 4646d0fd3814d9c77f4aa5806469ee74144bb65c
SHA512 f7c7068626dab38c72446040215d34e895089e4f287cb9fbe3bb7d7bcf8317288830a4e0256da9b716bae612861e796ff673c624dcde9580e7ce7bae372e19b0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk\Crashpad\settings.dat
Size 280B
SHA256 68f65dbfd62010a8599b61279afa8c465f33d26d2e59f0f3f940769b6950caed
MD5 d203548962937c38bd81fe3a972c0c19
SHA1 134683dcb9135095ef55ca29bd0fc3291076851d
SHA512 513969cea557f624c4251b56f6771fab6568a8156fcae4247d8a001936b47fae2103d44e46f8bed6b10c6664fd3ffa256936e6c9776faa562b8e51987fc3caf6
TLSH
T136D002B1B35A0411E6242777882997781EDCEC6290FD5668BB78031969510F9741E4E1
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 da363e06044eb29116e9539362c9d86a352d04697644b220b5c163525443fc0f
MD5 1250a7df2cb5b45e9b65c9a690c928c6
SHA1 43f39efc3c8f9d31bc3654e58b0853de7c9a08f7
SHA512 e0a91559b3f281e730bcc8734922588ff66019ee2a181128db9365fb58d90140e44cbe5612739ff08c5c1df814594359dadd55d658903d19c2ccc45dc2e9dfeb
TLSH
T1FED02BE729EA4820AD6FD3D2143155944209BC648A85BC9E106E7E8320B13697457C60
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 4a144428c6c2ea198a2c6e29401750541052a456684650e030f17899d8cc1f94
MD5 29795dde4a9343bcc2a3ce97e0ab0081
SHA1 82de0501b9604e33351f17fba104721ad8d78cee
SHA512 75f890bf8508ac4cbecdd1e96eb1908b4b27bcba3557c0e125e303d31b048dbc957889e05bc92f6f1e60a2864bc54643209b11293679c1c547d89da6eeef7ee6
TLSH
T150E0D8B33DE75820F96FE2E6143554A44248BC58C594BC5F502BBAC36072268689AC22
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a0b0d.TMP

Path C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe5a0b0d.TMP
Size 153B
SHA256 cc4362e48676229cac70b42bad421e5e47235c3f3cfdaf8cf7e26be435b8e1c9
MD5 8a1ed438a016e351a63738874b23cb57
SHA1 a46aeb0ddc5aa44d0c2714ed357f8c73eecc067e
SHA512 4c1c6c2285f9e04ae94bdd7aa3b0d1d4e1fed3e884a21cd0fdc44e6970758627cf8caa216bbb90bd31c65ec8917e7c4397743bed469aa2d9377afb4e67e36313
TLSH
T19CC08CF72E6808009A0AA2C2103528A9431A2C844984ACDD012E7A83203023AB19AC20
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk\Default\Sync Data\Logs\sync_diagnostic.log
Size 2KB
SHA256 350c3408ef51be08a0fe05b4bb85728d737143e7fd2ebf83816d79ec0009b26a
MD5 c0ddc582370cfc0cf0372958c7346fea
SHA1 c20e8a04dee95e7f2ad4d901ed2fe0a86a90ed27
SHA512 a984f7b4e67a6f7a624e77a5da9d8891e864270417815d0220504fcdbf9d6d3c5c802e1d40945d56c3d9de129051bf0f1a4e544e4f0f0e21091b8c237b7dec77
TLSH
T1C041451036BA46702BBEA70490529ABFD2C1F2953524E63B37AC14615F67E378CFC5C9
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk\Local State
Size 5KB
SHA256 0e69bde0c73339a88c96f50f36e868bb0da45d883aba3462342c26aa60c7044d
MD5 bde15c37a6b2f05585b44bc04823344b
SHA1 2b9b2d8f48d99060aad33e13c6f24da720b6b791
SHA512 69e329450b33ff58aca63e182020bd4c41e458ee7cf3beb4cafe6f39b8184d1503f50dc7f82dd23c0955abdf9bec04b08516f87487dbedd0bdb987c8a2adef1f
SSDEEP 96:zqGNkyQsFfdSGggDw58Frh/cInURoDotovga6DyB7P3v0JZe/40eUndKJkq4a:WGNK41XooDUwGSroegqdKT
TLSH
T1B9B1D9726434DC674DE1A945788B27536EB830B3ED51BF89E6E81B0C05DB388270A917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk\Local State
Size 4KB
SHA256 361b7dc894ab6f2557cf8ef793487cd3cb71c2be68d7a0adb3ffcb4f10dfc3a3
MD5 ee3b2f89d21ce10c37b861986d332cb8
SHA1 ede3f2d4f402468160314324ba7f66f2ab663b57
SHA512 e02dcc1d22f39a71c50b1d4e554d91148ae6e3d4e8308c804a3189b27b2feb31a565b5fccf66e1c1ad6a74efb220e5be40324a750a124b38b22bffe8461e23aa
SSDEEP 96:zqGNktsFfdSGggDw11bDRB7P3v0JZe/40eUndKJkq4a:WGNq41atnroegqdKT
TLSH
T152819672A424DC634DE59984788A27939E7830F3DD11AF45E6D8531804DB64C3B0E927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59faa2.TMP

Path C:\Users\Admin\AppData\Local\Temp\irlgub3c.iyk\Local State~RFe59faa2.TMP
Size 1KB
SHA256 1040b252aea4cce307be674c02d36857150d57455a64e6e31d7c67f06c55320e
MD5 cb4ca9f4bc8e1751d9b9e373f95ed972
SHA1 556d37ea55f61b7c79ad5601e4bbdfd6b7a73bec
SHA512 a31e5897cd381f6f01416cb4d8b6cb456c79ca2c1bc42ab3930c44fba07b48976e0621f15ec9eb6a975e8f27eddabc957775f6fb0938cbe48ddd003bf3779af9
TLSH
T1C8318A71BC345CB39CE19686724EAB275D3D20F1D2626E8491FC461C06E7ADC350EA37
MD5 SHA1 SHA512 TLSH

Submit Download

SYH0ACNRJBL96OMXQ7E8.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SYH0ACNRJBL96OMXQ7E8.temp
Size 4KB
SHA256 b7c445551f167f9e4ca0dcc4796b6b314ab2842265c6a1da73f5222c7c042430
MD5 9b9108aca97b8b426b72283cf6cdd0af
SHA1 db279095213229f58f1be752491572491ad90f03
SHA512 3943d001f0e40264f411970fcc06737d6311f9dfd1dcaf2eff2c60d2fa41a985559ebec9d39ed730aab21a36f356dcb233a1ec9a34dccfacce6f7b445e75781c
SSDEEP 48:v14vdOOc+cN/cF4LzJ9zCNYHdLXuHar18pdK84vdOOc+cN/cF4LzJ9zvYMgdLXuG:vq8lJo4u88qX8lJvTIuG
TLSH
T17F91FC015FD61D1AF3F7B9B255B33710AF7BF9588A088A0D0089064D0C31B188AADFA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 7f472c8a72ae9296dfa8a990bdf1c3c6ecded1938f60ef9b568aec529a2f4fcf
MD5 a07f749130ae237a0fa26d6ead025ac0
SHA1 b1c4d9c8f335080cba6004a60fdfdb5daffef06e
SHA512 4b37fcba2c99d51fb6ca574b26a95dd50256706d50d1cb11c2d6a92d76a610d885d2d7a12403e8505ed58473f24b0711ca164f27022de48ed4be9afc78ad19d2
SSDEEP 48:o214vdOOc+cN/cF4LzJ9zCNYoWdLXuHar18pdB284vdOOc+cN/cF4LzJ9zvYoFgt:o2q8lJovOu88h2X8lJvvFIuG
TLSH
T13691DD015FD61D1AF3F7E9B259B37710AF7BF9588A188A0D0089560D1C32B18866DFA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2d073794-354f-449b-8381-528b0ddb6d3e.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2d073794-354f-449b-8381-528b0ddb6d3e.dmp
Size 70KB
SHA256 c536c9c1ec2a21dbe6a411a88d36588a2ba66ddcad2c319a4eee3a036f847436
MD5 80b8daefcb891cceb40e1b6522f1b068
SHA1 a0b94dfec4e7b7c2d83a02464e601740086ba7f8
SHA512 c9a1438e324328e0349dde2830fa84aa3bb950d182fe3635beb7b53beeed4334c25164a0d9754947abebe5bfc902f94416a7e2d245b426213eff1621ac2df0a3
SSDEEP 384:a5m8rxHU/zP62GAh1lUz7+oZOH784lCTqLx2x/GuUgqQ+IHxBC:a5Xxezi2GAh1l07FOH4Tq+hHxU
TLSH
T11263971357885566D1290B7918EBBF02BBF7EC158F63836B4B1841BE1E77384AE30E19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2d073794-354f-449b-8381-528b0ddb6d3e.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2d073794-354f-449b-8381-528b0ddb6d3e.extra
Size 10KB
SHA256 db21db4fa913eb48be0eda21e3dc81c29f3f9c0c1211c454f9afed377d96754d
MD5 2b2aa660cb9f25b15839ebe780896e83
SHA1 2eedfa5c5d653f9de2386c096b6b98cd9f904fb2
SHA512 9a179414caa349a67b5ec298e5eff02a47e3ec93b457e83d3ddb57bf50a55d579889febd5e91e133a473cfd879d09ce01afbd64e392437acf3179da785e97d15
SSDEEP 96:SEWCnVTFDY6pw6mJFFd8H0Rh7CsevBb1d0djMLlIrLlhTLlaXv7arOKtILfcBCqr:San9wLFSG7uvZ85L0xsPywlDzfoW
TLSH
T138227253878724B7AD4194C4BC30AE7C45EC2FAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2d073794-354f-449b-8381-528b0ddb6d3e.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2d073794-354f-449b-8381-528b0ddb6d3e.extra
Size 10KB
SHA256 7edc083868e0ef4a150c66ece3f5713e1ead146449a3289dd0a1e7ac7b5eb0e6
MD5 6d9a9e98549b4144d3a77f9a804197c7
SHA1 ae08a3db3e2f7e3da4b9dc66f6a08f4e11ddd6af
SHA512 7d0b0256b567341a21943940121f46013d39edd87e2754ec5386105cd76583ee5ee6c93c5cb7c480a2b3037764351de81d6ad60d96112cff14b49b3ec0893c03
SSDEEP 192:SanRcFgwiR4pDDnTYapdVxzPjWBHE4T/fKNUal7zfoObLCk9:hnRcFgwiGDz1rWBHE4TxaBAOf
TLSH
T1DF22F721481CDC37E7D7AC8EBA392E36D66D7B1A10E678AC40CCCB59C1A54786779413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

43621d99-ee89-4d94-b798-6da952c860df.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\43621d99-ee89-4d94-b798-6da952c860df.dmp
Size 75KB
SHA256 6e73afad830abbfb641c6a18c7ba838e6067a47d79057e40a6759106028316c4
MD5 3f98fb28d30a09291d7fb54fcd3c3eeb
SHA1 fc83971ac8e003fc0309dd9f540571f03aadc4b5
SHA512 b4ba3acb6ce115f6f36e2e9f226097d9b9481484a5ace8e779ebd22c03b6acee1f5eb5746e1230b0e7270a1031e1f9c90f9c18fc089bc085e2341fb89998b818
SSDEEP 384:MA9AoH8b7bqLXHBnQeT54oaNpi6DGeCl/laJwD4iXnjGAFcsZx2x/GuUgqQ+IHxU:V8baLXHBnQeT23N8+KzGdw+hHxU
TLSH
T128739823A38815A6D5260B7554EBB7213BF7EC188FE3C37B122551BE1C77784AE30A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

43621d99-ee89-4d94-b798-6da952c860df.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\43621d99-ee89-4d94-b798-6da952c860df.extra
Size 10KB
SHA256 bdf61feeaadd21eae94088fc89956007403212b24cbc175d0dd7066b1fc78c36
MD5 b67b19b892252a7b3069c44b7de87d76
SHA1 c917d4ef5b89504412c16193c60d238c4a4ae47b
SHA512 8a2ca862691fdba67431d8172f77df4bedc703294e1ddb38d7d7541bdfa5d9829d4d4ab1c1f3219ab0537a03294f8d4c9db5e590dfc3d35f8ff778b08ab556fd
SSDEEP 96:SEWCtTFDY6pw6mJFFd8H0Rh7CsevBb1d0djMLlIrLlhTLlaXv7afOKtILfcBCqwv:Sa1wLFSG7uvZ85LAxsPywlte4foH
TLSH
T1FF226253878724B79D5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

43621d99-ee89-4d94-b798-6da952c860df.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\43621d99-ee89-4d94-b798-6da952c860df.extra
Size 10KB
SHA256 98d0acbc47842fca8f53ffac996f19705525ef8ffcf28a6887129936ce6d38e0
MD5 7f142c2a20546ca6fe5d7c3bb535698d
SHA1 34a212e5a28faadec6874779db1b1b5236660459
SHA512 748d81eca874468094290be784be9b05a98f14609430bc5cd2c7da7ea3442fa5335ef61fef6e05cc3dc8f8c1d3cb7d058cdd02a83de46593f6304eb7d0d35b15
SSDEEP 192:Sa5cFgwiR4pDDnTYapdVxzPjWBHg4T/fKNUalVe4forbLCk9:h5cFgwiGDz1rWBHg4Txa9Arf
TLSH
T14E22E621481CEC37E7D7AC8EFB392E36966D7B1A10E678AC41CCCB89C1A54786779413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55e6ad08-3f95-49d2-bc61-de8106d60993.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\55e6ad08-3f95-49d2-bc61-de8106d60993.dmp
Size 71KB
SHA256 983d2b5eb08391b6b525d5bf350e2ef83101e2178185f18d06878475433e7156
MD5 67ae556f8e8618cf11163cdb7cc02cf6
SHA1 3c99a3caf4328dc730ec2a9ce531252c168bacb8
SHA512 894714f65ddf8e99200fa48443fcd118c25cd20cc3cf7c4e579bdcaa50383e42e56098df7b6edf3b7c94c66ed2731059d7ce79d987b36854676830445f1c3a62
SSDEEP 384:K5m4VrPuOKIVDksDZyeUR52exe524PJT7JBS8/bHbx2x/GuUgqQ+IHxBC:K57VrP9VDkcZynR4exepTtBS8P+hHxU
TLSH
T11763A963979825A6D5250B7169EBB7123BFFE8141FA3E36F0214817B1C677846E30F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55e6ad08-3f95-49d2-bc61-de8106d60993.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\55e6ad08-3f95-49d2-bc61-de8106d60993.extra
Size 10KB
SHA256 a4fc9019cc82a966ae0bf1db486ccca7d16cb5a8f5893c627fadbf98d4d7c44a
MD5 bd3ff57fa6797c10b80d3b5d7fced74d
SHA1 a6cf47bf6ebccd7e1bb88aedd8952c1f22645a85
SHA512 e105013c4e15f1af38cfe46d3577309071d49e33c884328ea5d5db17a439901a94f1531de59d89275b9f89750b3c6a5c9e4329c42dbdf2a5d4120df664e187cb
SSDEEP 96:SEWC/TTFDY6pw6mJFFd8H0Rh7CsevBb1d0djMLlIrLlhTLlaXv7a9OKtILfcBCq5:Sa/HwLFSG7uvZ85LyxsPywlmhfoj
TLSH
T1AC227153878724B7AD5194C4BC30AE7C45EC6EAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55e6ad08-3f95-49d2-bc61-de8106d60993.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\55e6ad08-3f95-49d2-bc61-de8106d60993.extra
Size 10KB
SHA256 dedb5e20c2d5a1236c4c026a64667bf7c85871598e98fb203ec6ae03ed376519
MD5 3f29b6ba75060857f0d2dd4de96c4747
SHA1 9c956bc52a9ea80fa00a760bac2f278ed8b50fa1
SHA512 6fc3d1aa2825c2c97463c54c7e484fa85c0a80d64c85b68d28609f52b6184f1b2a99376707283a6e0344dfe7b78e1d57e2e564c5d7c38a4bf3f1d12a5776bab1
SSDEEP 192:Sa/LcFgwiR4pDDnTYapdVxzPjWBHK4T/fKNUaluhfovbLCk9:hTcFgwiGDz1rWBHK4Txa0Avf
TLSH
T17E32F721481CEC37E7D7AC8EFA392E36D66D7B1A10E678AC40CCCB59C1A94786779413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6251e5c5-13eb-4002-a78a-4cda135fa2e4.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6251e5c5-13eb-4002-a78a-4cda135fa2e4.dmp
Size 73KB
SHA256 ebf2bd03e89242e5fc7938f2288bc3f44bd8cc9f3d4b4be9af1b6d1ccee5f999
MD5 87267895d704098c29577477e5c97cd6
SHA1 b316d9bc7b62f5439106b897deb18cc14d94acf8
SHA512 a9c17522a374e73b118b0d7ab443c43d6c9ba9544b9e7c5782964d4e4f09220ca32751b3f1222d6f9e4758557d6b608c29f688d4ab77851775f7d91b19b69bd6
SSDEEP 768:L57gi0REIkcHzn6AInD9u63coAV+hHxU:Rgi0RE+zfInD9u63xAKxU
TLSH
T1A773993397881562D9652B7168EBBB053BFBE4184FA7C36B021441BB2C77358AE33E15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6251e5c5-13eb-4002-a78a-4cda135fa2e4.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6251e5c5-13eb-4002-a78a-4cda135fa2e4.extra
Size 1KB
SHA256 475f9310fe6ae0eb6defdeb396d0d9e643c6b2b6967fa2171375e973d9f92ac9
MD5 96786606e9b70b2911e16d58852878a0
SHA1 347ae1a09b7431480818ee89f56fd82ea8424d27
SHA512 25bd1f20ad08a27b4301f3c2af4deb0f6f8d4225ed395d093792ceeb016963217c49cc230b4376b3fc997c3ded89c06da0a82f775f4a5448ab253612e6f576f4
TLSH
T1AE3174B3C2AC3D529E574A9C763B2303C949732304931D4D39CD5A0D858E4DD96669C3
MD5 SHA1 SHA512 TLSH

Submit Download

6251e5c5-13eb-4002-a78a-4cda135fa2e4.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6251e5c5-13eb-4002-a78a-4cda135fa2e4.extra
Size 3KB
SHA256 e01d49dad09103b23e2c230a4c55beb96124dc7fd0a3d8c1093987816a12069d
MD5 0eaebef6b47781ea4f0aa16d10398699
SHA1 51299cae17d0a667e006ae8a4267989d6bd85093
SHA512 2244122e9a3f704176b7eafb7ede21c101ead5369fecc2b443976e25671624170676ec6906b15b277c749df9f4bad47cacc3ef5c2b2c40cb04436939a6b4e1c6
TLSH
T10A812472405CED375AEB5C8EB3376E1D889EB319A8663A8C51CAC75C41B8CF4638B143
MD5 SHA1 SHA512 TLSH

Submit Download

bd85ac3f-cdf2-4101-b9b0-4c8cb67135f5.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bd85ac3f-cdf2-4101-b9b0-4c8cb67135f5.dmp
Size 75KB
SHA256 4542a5a9913e26bef1b1eb55c5ef01aeaecac9d39d0749007a088628a6a96a7f
MD5 22e06247ed8a2c860896b1b92369191d
SHA1 15f2e13b0cb8b56d7dcd34a928efdf94c74e063b
SHA512 8740d11d7c28e6b5ab94b1af554f42b3b03d978ab2f56208dc335d2dd14e45ec7b6c4f827472c6c0697483c8856456fd8d42e9dd47328094fc3a3864ef2a6035
SSDEEP 384:nA6cOAr1Z+4VeUWPHqtuVL4lI46UrJteoPvxvx2x/GuUgqQ+IHxBC:5cOE+4VeUSKt/IgVtNPv5+hHxU
TLSH
T19473C713A789557AD52A8B7128EBB7013BF7E8240F63C76B2610517A1C67F8C6E30F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd85ac3f-cdf2-4101-b9b0-4c8cb67135f5.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bd85ac3f-cdf2-4101-b9b0-4c8cb67135f5.extra
Size 10KB
SHA256 50c2116daa5a0353decb775b9ad983ab3edcdcd0f832c1454f872393650ccd5b
MD5 c03ed907fd4b0b6db7e5d11ee9808b86
SHA1 eee5e27d0472c2ca24281a090e17b31949b8a6b2
SHA512 6fde757d0ea4051465bff49f96629f3ce0c9a6f46cc2eab023c1d8c0b9ea4a5a45e0e5f0e95803d30976d45311c5c9e40996749e9937a20765f6ac80eddc9f2e
SSDEEP 96:SEWChTFDY6pw6mJFFd8H0Rh7CsevBb1d0djMLlIrLlhTLlaXv7auOKtILfcBCqwn:SaRwLFSG7uvZ85LVxsPywlCskfoPY
TLSH
T15D226253875724B7AD4198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd85ac3f-cdf2-4101-b9b0-4c8cb67135f5.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bd85ac3f-cdf2-4101-b9b0-4c8cb67135f5.extra
Size 10KB
SHA256 87efe480ed5927dd5131f3975aaa02e74d426eea5c8002e65c2af7fb314aa80a
MD5 198cb919b454b855d3b943a039d3cb7a
SHA1 d35bb5ba6c16c24252d9a485ac826ff734553b51
SHA512 08d09c338e5c90e2539ef449c5f670362b9375b70ebeac18531f8a2546462b331818b5ec45312f2f419b7c9cfbd018dd7642de6bbd9c80aa912e3a6d2f871ca8
SSDEEP 192:Sa1cFgwiR4pDDnTYapdVxzPjWBHz4T/fKNUalqskfoPobLCk9:h1cFgwiGDz1rWBHz4Txa7kAPof
TLSH
T11B22F621481CEC37E7D7AC8EBA392E3AD26D7B1A10E678AC40CCCB49C1A54786779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cdb9cede-ddd6-456c-8730-20c6964b686d.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\cdb9cede-ddd6-456c-8730-20c6964b686d.dmp
Size 72KB
SHA256 09554783c2ec5186c9210066edc1560e71e8bafd787c8f479248f53b2fd71162
MD5 e404bb3f307b78a92591e544b8bca053
SHA1 2792caad91194e8fbcbaab8f333623963ae07b49
SHA512 1cbd5c315e80dd583a659cffff5f6ee0f84c7f0c608263f551b3133b22b6fc7a2109f4711be7b300aabe3b5c906b84822dbfb801f88f3f5b593721dd179c21b6
SSDEEP 384:C5mziOruT2bJflmj5gohR4HPLF7Za3Z420+4lr62x2x/GuUgqQ+IHxBC:C5UiOrdbJflmj5geSvL183O+Un+hHxU
TLSH
T141738727539A5532D5250B706CEBB7023BF7E8190F63936F020441EA1C773866E7AE79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cdb9cede-ddd6-456c-8730-20c6964b686d.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\cdb9cede-ddd6-456c-8730-20c6964b686d.extra
Size 10KB
SHA256 9ee84c274cefed911a6573f7d44cc83308bc6182b97d2109f4c2519d068f3b87
MD5 4b3b6c9fa056537a282922abe901aaca
SHA1 bff827ea9e00c7a7a4a6aab0246130612555ece0
SHA512 63b240db4bb9f66238c9a983715a3fee1f8c53e19167179ee76e348b41b0cd4933a8aed4a192738d7af04e21a25130426f095e90804e1f5f85a1208dec16708d
SSDEEP 96:SEWCITFDY6pw6mJFFd8H0Rh7CTvBb1d0djMLlIrLlhTLlaXv7a2MOKtILfcBCqwI:Sa0wLFSG7WvZ85LexsPywl8Dfov
TLSH
T181226253878724B79D4194D4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cdb9cede-ddd6-456c-8730-20c6964b686d.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\cdb9cede-ddd6-456c-8730-20c6964b686d.extra
Size 10KB
SHA256 690f25ea96528406ab6a3b505bc84d2220715f2e0d8f07c662de55daa4f73e8c
MD5 3e8407be630b8b426cd7b0c7f8294e7b
SHA1 d24748ebf57af9b1ce136bde5b35fa872f600eae
SHA512 572f4a50dd9908c207947f2c36cbe04a925e44185d252f1b4da815c26f4835122435770bfba9f594461cc90b60108cda1f68262dabfc6c36f4a7740152947ffc
SSDEEP 192:SaycFgwiR4pDDnTYaVdVxzPjWBHI4T/fKNUalEDfoDbLCk9:hycFgwiGD/1rWBHI4TxaAADf
TLSH
T1DD22F831481CEC37E7D7AC8EBA392E36D66D7B1A10E6786C01CCCB49C1A54786779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.bin
Size 4KB
SHA256 a1ce1cb9bb9836299f134bf8e059d61dc39e6e78d92dd267bed94270d7b5eebd
MD5 5444f72f1a89c026eccc14127fedc59f
SHA1 0010375a0392934dd69601e11d0bf117984b039e
SHA512 d2cf678948cffdc3ef8698042d7fccf6b77fa511fe349cf2e647777012a840c78e8d880f59f66b6bde451a5f6e84431791bb4c9c602ee299dafd26a6b4686dcb
SSDEEP 96:mSdF95/7bkW6GrcEmFR4CQFHKNFKFAFrF1/dd66JoztdzgClKtmc0d/UK:mOv5zboubeYm1d66JoztdzgCl6mc0dz
TLSH
T15291E918E62A963FD40A013ACD961B801F707087A86F3F15329D654D2E9B3DE7ACD07E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 4bcb501e04dc634bc22eae4ce3500d66d8dd18c2a7e90d317099e4a9fe84ad17
MD5 0758a9c138909bc3025abf275f77bb9f
SHA1 b51735ec38e1f89a08383052a1489851a1a8d1b8
SHA512 aaf28c6680b9db95eb9881b68948905200acedf70ce957097521cad47311ee6567970d88fb87ebc9c8868c1dc7e44816d9f9cc05e91b07ef54e78e62140fb2a2
SSDEEP 768:bJlLzZpx4Gcm+uFwVROqJD2Cb2b4bTbzU1LzF:bJlLzZvzwV7I
TLSH
T115C20084FB2A953FD42552BBDCA51B001F79B8CA58092F573A4D64682C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 980c606f602625b5f50696d4ece5a9556236785d69548df37512fd6cbf512262
MD5 a33e7f222942355a4d8fd3898d9ca93d
SHA1 7bf94742309b2d5c9655550854f73a8f014ef109
SHA512 c4c30bc9e931d7734e27a87a38f91e2dc038a7c428d933129215ccf31a88ecbbf18506d0b3c397ee2d6b808f779dbf6a5c808381e0dcbc9b9172fccee090d674
TLSH
T1A051E958F229963EE0495139CD825B811F707406A8AF7F2A359C604D1E2B3CE769D0BE
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 1b499f4d85342cdbc591fa885399a834d94ad1145ee49364fb8d7e399672dc1c
MD5 a69c871736b7abc52b687d4d61fcd999
SHA1 135f2e3b98d8e54e917e1b6f75262648fdb0405b
SHA512 10293df0fe4d4d911636c83ccab0c03ea0502d4bea930644b16e94f2704c8e32099a330dd2c110996ed2c049143817fe05551f57358170ace54495236af76dae
SSDEEP 96:xSdF95/7bkW6GrcBFR4CQFHBF8FAFrF1/dd66JoztdzgClKtmc0d/UK:xOv5zbouYYP1d66JoztdzgCl6mc0dz
TLSH
T17A81CA18F22A963FD409413ACD921B805F70705AA4AF3F1631AC604D2E5B3DE7ACD07E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 8c4d82ba40f2b09584eb4e08dc9cf013e84278eafac83b9a198f0ed5afbfdde8
MD5 ae4b013c696b5bb53089b5a27d897070
SHA1 76f787e1192521bfa97f3a1a681183b9e02a14e8
SHA512 d217471409683bac5cc75425a9a612456608a06c21924bf5c2377c052fd8de94a049396b809c759a94c1b9263fbc3a9742b7165e164b59ae232b2b4ffa29ce71
SSDEEP 96:8FR4CQFHBFKFAFrF1/dd66JoztdzgClKtmc0d/UcSdF95/7bkW6Grc:IYd1d66JoztdzgCl6mc0dFOv5zbou
TLSH
T16E81B918F22A963FD409413ACD965B805F70705AA4AF3F1631AC604D2E5B3DE7ACD07E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 ecff71a290fa1b6465c383a6b2ddfa7e873b0ac7d6440d245ba4dce70a0567a4
MD5 0259e3c7e01b2ff1cdaf12f0d5068fdc
SHA1 6a0908718675766c1007f785923a35da1161da83
SHA512 e200055d887054956895e8c46d0b62194ccfb5c94f2b0ecc4a37524bd0996fd82a288790ff37dcc634b8e857681fbd196c6dd660acf8651477247b25257ef584
SSDEEP 96:8FR4CQFHKNFKFAFrF1/dd66JoztdzgClKtmc0d/UdyFSdF95/7bkW6GrcEcGa:IYm1d66JoztdzgCl6mc0dvOv5zboubc
TLSH
T1CBA1B814E629993EC40A413BCD9A0F800F70749B989F2F25319D910D2E4B3DE7ACD17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 eaed7bf6a02ea32423cdc8eec29837ede074ff1093169c07344eecef10b76f1f
MD5 dff472b072d9ce095a5009c2f14c1fe8
SHA1 96ee20c2eaddaef2304944096715d3984b5685db
SHA512 d0746489132d61587f5e4f565944d2244e29ce75fbc8db0ca00fed8e428b6b4a6d2c6a0d9131d3bed6a4f6a1f2da5bc9f1b630e5e48005b5327eaa57e738b128
SSDEEP 192:cOv5zbo7z6c6yjTMzR11/66JoztdzgCl6mc0dz:fboKc6yjm/66Joz/zgC1jd
TLSH
T18CE10C64E628863FC409137BCCA61F410F79388B984E7F29319DA51C2D5B2DE768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 3482d8b99761354eb73d60a0374de968cc566b19dea33abed2fb7aefd68253d9
MD5 aff30f5b95db36b22824ba6064f0ab20
SHA1 1b997addd633bd139b27f8ee4733207017b9f8af
SHA512 802a15da9add2ca2db865068687a751fbaaf4a84dc1b61a42ea593ef09b7864d606239a8b0b4ec4c74e56e85d694139a73535aeab9b684a20afda5f455887017
TLSH
T1A7711D18F22A863FD409413ADC822B805F70741AA4AF3F1A35AC604D1E9B3DE76CD07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 f6cae599d5f0863110009ff6a84e69a1aac0bc72187a641af746d2e48b4b1b3f
MD5 2f91196a037ad71aa3ddde2129b7cc48
SHA1 e5be0727c56ebde266f2d4420065e81a07af5fb0
SHA512 a9c289be990ce4e40b8c7389c6e7fc71108f7114158e588215ce5e64c9c1ade40ef0bd0b01477cc85636aba96e00196107c682f77be51bfe6e9563e528afb9f6
TLSH
T15871FC58F22A863FE449413ACD921B805F707456A8AF3F1A35AC604D1E5B3DE76CD07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 89e94d597fe1e525a7b384db8d1890022d3efd17eeefb707583355c902c63b4d
MD5 427a3eb9ef5f3bfef30aa320417c85fc
SHA1 054c352dd6a70e8679d555611d565fbd9e5ed798
SHA512 3af68cd704471c78db232039f248d4a6af99e55f4d81d9ba08b02c8899c4e5e05f02ce1e99f936cd22c373035fa5fc1863d76f7d6784db77f5890a6630d4dfa5
SSDEEP 192:aOv5zboubc6yjD8YL1d66JoztdzgCl6mc0dZ+o:Zboubc6yjbJd66Joz/zgC1jh
TLSH
T13AE11E24E6288A3FC409533BCCA61F400E76388B984E7F15329DA50C2D5B2DE7A9D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 078d254d2eb6d14f6280c4ab7d9509ec2c0159171cd11ba241f87987bd285ddb
MD5 9d1fc45b3c394098bbdc6e5e2c17a096
SHA1 be7f1a46949f1141b27f8b05f563818cbe3f7191
SHA512 a489cf7139cc43ef04ecb193e74108dfbbe7e3a50055a5ff745c5093c191c143a7b20dccd1a4fc925623b28415ac8628dcc669e9e6c95e2588c6933107a7a5fa
SSDEEP 192:DYL1d66JoztdzgCl6mc0d/Ov5zbo8bc6yjT+o:cJd66Joz/zgC1j+bo8bc6yjN
TLSH
T194E12D64E6288A3FC409423BCCA60F810F75389B984E7F19319DA50C2D5B2DE7A8D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 ca05c2c65e23aededc124eaa2a06234435bb9dbdd39339f3a3648529621b01a7
MD5 9a300dc807c2ff544a727b418ef1e05f
SHA1 848f1dcaf9343f6b76f9ae40dee1be11480b13f6
SHA512 047b55295f138c05db2a08dff13d37a5836eda03055ab3247235025543e39ce3f44838f4c475c097a52de027e37b58ca41c6c78d9d300e4e30596561abf885ec
SSDEEP 192:OOv5zbo8bc6yjT+uYU1d66JoztdzgCl6mc0d:Fbo8bc6yjued66Joz/zgC1j
TLSH
T141E12E64E6288A3FC409423BCCA61F810F75389B984E7F1935DDA50C2D5B2DE768D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 e93bb6798c467347dfef2ef29abbc919fd704068e1372bd490450e1e1b97b74e
MD5 63ecf6cf9927554bb0729a849e064a9d
SHA1 64363c1f4db72a04040f96c68cdc72aae003eeb2
SHA512 aa386c6e2dcc2cd901d8285c361d5d2f95a14578da6f44b798c20d89103c5c8ad0d0b03466c70f1938163290c8760ec692b0b3812d0fa1feb0f6da68daf3f187
SSDEEP 192:rOv5zbo8bc6yjT+uYU1d66JoztdzgCl6mc0dz:0bo8bc6yjued66Joz/zgC1jd
TLSH
T129E12D64E6288A3FC409423BCCA61F810F75389B984E7F1935DDA50C2D5B2DE7A8D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 df7f5000876a41a06dcb5dbf4862cf44c0feabbf22a5aa2edee68118005b9edc
MD5 e22b9777e45f53f9a64da24e9acba673
SHA1 4efeb071e2caa23f52c2b0f7a73d2d4a5c3f03fa
SHA512 4e2bb5786cd9657a6e69ef0e22eb3590b2a912f624e7320262397a085278a7dcf93717401cafddce24e325c6a91b0f3c88aa74a3d2ebdcb3f284ab32fc52e3a3
SSDEEP 192:OOv5zbo8bc6yjT+1qb1d66JoztdzgCl6mc0dz:Fbo8bc6yjVZd66Joz/zgC1jd
TLSH
T193E11E64E6288A3FC409423BCCA61F810F75389B984E7F15359DA50C2D5B2DE7A8D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 31d953552e808774139243ae574b05493fb98e537c56665220974e9849e39919
MD5 943e632510c4706da10e977c5bd019fe
SHA1 8bfb1f94b8a3f505ab3fcf0e61534c685c059cb7
SHA512 2f2b39f9a3b7ee8d1f5d225ee303f3a38e83df540c9f4e3fee591435f18b38a5194cfa38579ec274b9d260662a6e10dd60779ff0221d5897d7ea55c6d2f3cc65
SSDEEP 192:Iqb1d66JoztdzgCl6mc0dAOv5zbo74Zc6yjT+:NZd66Joz/zgC1jJbo8Zc6yj
TLSH
T161E12F64E629963FC409027BCCA61F800F75388B984F7F15359DA50C2D572DE7A8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14be6b4f-2f61-48bd-9cc9-2d465b1b93a2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\14be6b4f-2f61-48bd-9cc9-2d465b1b93a2
Size 896B
SHA256 404f57be9d6c128720b6accf54140c2387bc0659890b00c3792457f0dd38b619
MD5 02f8756e001f6d12d363985faf039e20
SHA1 ba819f9f94cc09ae273cc35832208d9c09166d75
SHA512 a22d5cd96bebe5a5ac21bb8beb637f633c9ed606e0338494298932db468f8adbcc74e36f32968d9285ac3ba4cb1943e1a9c036e5de63b7c14ec0bb91d7287814
TLSH
T1D61104409774B572CC3CA24B86917B438BD47013C0C749143EE18B1C4DBA21FA7AB70B
MD5 SHA1 SHA512 TLSH

Submit Download

2d965664-f823-46d9-aee5-e04d45d0ffdb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\2d965664-f823-46d9-aee5-e04d45d0ffdb
Size 3KB
SHA256 62630a284124c9e60b3af2994a53c51440458adab08e55a2e3d0e940e80aa3f5
MD5 3757c4d90c1f714c13e2e696d2793453
SHA1 9e5120afed2b84c5cf600fbe6a3cf4f7396827f8
SHA512 2add5b33824acd7f4e16f1eff2f704f8efad3367e59381755765053e9821882736efabd66f55ed5cb4dd9e0415ed1df25fdb5ece147311e46a6dfaa14015d56a
TLSH
T1D06165215524BD73CFE8A441A3276E958DDA338F684B0B8D25698E2882F8439038F25B
MD5 SHA1 SHA512 TLSH

Submit Download

39957e90-5737-4c9c-8f30-6842a750049c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\39957e90-5737-4c9c-8f30-6842a750049c
Size 3KB
SHA256 25aa9433430c4e70bcf7bd34349c12a99773347d69ee0d35098278a0a1d692cb
MD5 560fdfb816267faa540056536de3e96e
SHA1 57ac34142bda2242725fe1be6f2617c23e45e4d8
SHA512 c9b1f5d888fe7e27f05e1ee4811157a100fa0a73fc86be5447b9050106a9343edc6908d95f741d9ffe551944631a47ea8d74a05c209566a213a27ee96db2a3d1
TLSH
T1616154215564BD338FE8A045A3376F958DDE338FA84B0B8D11A98A3882F807557CF25B
MD5 SHA1 SHA512 TLSH

Submit Download

437a1c1a-a7ed-4b45-9ab4-c67333da93d9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\437a1c1a-a7ed-4b45-9ab4-c67333da93d9
Size 3KB
SHA256 3545fe3f6c0199a469df61a72809b050f1b1fb96796e8a63800243637262185e
MD5 9ebc971cc762336e16d5bb130479faab
SHA1 1cfb8aa55923ffed3f71d6c785b1c365c509e6b7
SHA512 b2130b9cde35047a989fc2eaf34ea8c610d7f46e2f7ce5ecce0b60b96e9323b3449be72bccc8005501a85d7a2a3a7cb3dd7f4091da107b56cbdf8769f032232e
TLSH
T1016157215528BD738FECA041E3276E958DDE33CF684B0B8D11998E2486F907553CF25B
MD5 SHA1 SHA512 TLSH

Submit Download

53ac242b-1910-49f9-ba22-387ae361b6ad

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\53ac242b-1910-49f9-ba22-387ae361b6ad
Size 235B
SHA256 e64049cc29b1db9af5320b4805208e0b3c12a63f728b61f88225a3b48fa5a900
MD5 290d55f553e058839e207ae5fa0d702c
SHA1 63ef4ec51cae1ef3738d9d3eeedd88c00f891215
SHA512 adcc420e8e935a1e4021493fd954a3a8fbb83e0d1b57f6e5d5b30ad10b6707b4ceee2154f59ee9c5c127ec0672f86e35d1cf98eb06c0eaa6069a3ef7a98730cf
TLSH
T13DD0979018983B6C8C000F03F0E06DC670848C372074E820CDA04838A9FDDC4126181A
MD5 SHA1 SHA512 TLSH

Submit Download

55c9bf3f-3167-45b5-9e69-5880c40ce53e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\55c9bf3f-3167-45b5-9e69-5880c40ce53e
Size 3KB
SHA256 1cbe3e6afa6e25caba3eaa01a18c0aee78a633981b79704ea4ed609190026de6
MD5 5aa82841c305db4b9d95a26484c25b47
SHA1 a958b093eb754e0230e7ccd805e4aad08e6517c9
SHA512 740cbc3caee16e9931f550ff5aca93237b5563f10242e3b8f61538390b4c2fc64994062f7828c818b5468cf6029c1f7c9cd32e82cc94d1b9b891dd60995cd475
TLSH
T1686166214564BD738FECA041A3366E95CDDE338F684B0BCD25998E2886F8479438F35B
MD5 SHA1 SHA512 TLSH

Submit Download

92235431-ca2c-4087-ae91-f6b68aa61c5a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\92235431-ca2c-4087-ae91-f6b68aa61c5a
Size 235B
SHA256 089fa9dd3108094bc785b00ba89170c532f74b9b1c4b7eab005f5c0cd845535b
MD5 5e8684f659219753abed2e117469b728
SHA1 1ec3eede921a5358136984cd80d853f8ac2419e6
SHA512 93d2243967c8570c36d01943dc397d497a6f24390978a017827398bdcdc419df24fe83bba45467c76602736fe66eb7cfcfd940352b1f34498187ca321114aa24
TLSH
T1A6D0978034C8A79C08044F06B0A0A8C630488C332874981099A28134ADFAACC0221866
MD5 SHA1 SHA512 TLSH

Submit Download

9239d1b9-9d51-4af2-a546-62f8871a78b4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\9239d1b9-9d51-4af2-a546-62f8871a78b4
Size 15KB
SHA256 b0aeec7e68d1bd6dd28e61355f734a17ff4404001e44fb08436c253cb8271e0c
MD5 5fb3ded87e99427eaedf788ba9e6b55b
SHA1 a959f5684155d7bfce360d5217fe53ca926133cc
SHA512 ee3c1b26a08e44ab17fb2d114071d748e7df5845b049042dd68bd5e0414e027b04cd86d022a63aae0da3b7842e4ccfc9943be2d981e88c99a961ca2a84dd6d8a
SSDEEP 192:uIJx/SuB7FSBkAiqEx1E0oFlerJkPxc2aPqvKO39fBm/TC3SteRzmys1ueZ:nx6utkdiT09FlRPqsSteRqysAg
TLSH
T14162C95A6420597E8650E768D8EC7FC3E1F518CF8C019FCE9BE4BE0869EB09E5127847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caa97adf-f494-480d-acfc-82ce0caac529

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\caa97adf-f494-480d-acfc-82ce0caac529
Size 3KB
SHA256 91ce5775051aa160977d2795d4a1e525f3eb3a5c3f41090f104ced7c3a4aa978
MD5 e8955f900ee9fbf3c3ec6c3792f2fdfa
SHA1 0e9fbf8b3381540d6af0e7e43e687ec7081cfa87
SHA512 7994c8a1f46dc8e7ca9d5b7560de156dd1fc2d11de4c058f73be9b76f967ba26fc0ae52310458e7f45a2a67f4b27d073b8121d370bdc844209b3b703ebe8b0c6
TLSH
T17B6164215524B9738FECA041A3376E95CDDE339F588B0B8D21998A3886F8079038F35B
MD5 SHA1 SHA512 TLSH

Submit Download

de01847c-88ce-4cd7-8812-5858115b4c43

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\de01847c-88ce-4cd7-8812-5858115b4c43
Size 2KB
SHA256 782d8e5a04ab3fa4efa36d032186883672e756db6d5a1ba7fc325fd2397669e8
MD5 37658b283cd7abc5fe26491473b8c602
SHA1 b8cb64d53dce2dbb5366fbd19ccddc5b1fc8d9fb
SHA512 fac70591a757cd046a92b786411fd2f4057df4be1b9697f1b4444184dc55c59d0c69dab53812c0c6f413ba577345cef605e670fccc68d99eb245e797534999d1
TLSH
T16641235C35789C369C9EE15DC582338E97B09A1344C61C433E92DF0C8EA779E636B52B
MD5 SHA1 SHA512 TLSH

Submit Download

e4838196-41c1-4b39-a059-15ad1c56e8f6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\e4838196-41c1-4b39-a059-15ad1c56e8f6
Size 883B
SHA256 9ad24432e05d0186412146d8d4e80fc1536ad1cc732b62acfa5439823cceb324
MD5 98c979c440b240ada0ff3895a4c6f81e
SHA1 ff93fb7a32d27d4eacc70f095ee9c745e7a538f0
SHA512 48adf7773f41b14ff9ebe4c7e6ce79e07a376c5f5ae9463fc6963461aada7f4d774242dc2965911fe0359a8c22fbd2930d7f0f6323185a6d2c8edb1a1d6759fa
TLSH
T1C61127409A347572CC3CD24F85653B428BE4B423C0C644143DE18F180E7A21FD7AE68B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\prefs-1.js
Size 6KB
SHA256 3128675045bf4b8d9a81f8ef28e1cc7e6214ad69e57f7fd7c0f23e36fcab3f37
MD5 8853fc4ea3a6f0d40a1e8e399a7a2478
SHA1 f014a1ed09e83c09cc418b027a2e5312d0890ed1
SHA512 dfe895745d2b32b3cd5f8d71d2c1ae322ef0c85a97e9ce2cb712cefd83257972ca2fb1b39e043b9860dbb3fcbad33852815e05e9612306eb1064e82624c3bece
SSDEEP 96:xHKEUTUPqGq1fH1c1zSuSSlQdv9jKnRRHnyzMLEBw88u8L4cnx3hezy:kESR1fH1cPSSB9nyzM4Bw88TX
TLSH
T12FE110785108CF7F64B6776CAC688C315AB2413B77BF68D650B65484011CF3845F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\prefs-1.js
Size 6KB
SHA256 fe95ca4fef338901ed9bdf4bcb9e4ffb9a5c31c88a5254838526afbd4a8c3e8b
MD5 e7ab5b51f8b49029a5816fd9acf01ff5
SHA1 9398bab28a418af40f51d536cd100abb63048f3e
SHA512 ba9432962ef5bf6c1fc80156144e21fa2375bdffb3e98ed39ba193cda9558e610d9d1bc321188db6fd7abf1b304cb3272f29e7a9c736eb18b95e7d6c8aa6dfbd
SSDEEP 96:xHKEUTUPqGq1fH261zSzSSlQdv9jenRRHnyzMLEBw88u8L4cnx3h2yzy:kESR1fH26eSS59nyzM4Bw88TS
TLSH
T148E12F7895088F7F64B677ACAC688D316AB2013BB7BF68D650B954C4050CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\prefs.js
Size 6KB
SHA256 016c5cb9f107dad7bc4f952a61b2e268a51583818867104aa0c261ffb88fed0b
MD5 79217574c270ae544601b29310317c24
SHA1 4f8850054e166332918e7474e0ceed298547ef5a
SHA512 468684628d0ec7428e5afe2578241eaee159787e42396ed3c9a94f0047c2930971fdd10b38984343b82945cb2dab095bffd21b148baa61dda5a097a0222e4050
SSDEEP 96:xHKEUTUPqGq1fH1c1zSySSlQdv9jKnRRHnyzMLEBw88u8L4cnx3h2yzy:kESR1fH1cLSSB9nyzM4Bw88TS
TLSH
T16BE120789508CF7F68B677ACAC688C315AB2013BB7BF68D610B55484011CF3845F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1564-37-0x000001A9D0F60000-0x000001A9D0FA0000-memory.dmp

Download

memory/3440-2694-0x00000000074A0000-0x00000000077FB000-memory.dmp

Download

memory/3440-28-0x00000000067A0000-0x00000000067F0000-memory.dmp

Download

memory/3440-21-0x0000000005DF0000-0x00000000063AA000-memory.dmp

Download

memory/3440-26-0x0000000006870000-0x0000000006A32000-memory.dmp

Download

memory/3440-2700-0x0000000008010000-0x000000000801A000-memory.dmp

Download

memory/3440-29-0x0000000006F70000-0x000000000749C000-memory.dmp

Download

memory/3440-25-0x00000000065F0000-0x00000000066A2000-memory.dmp

Download

memory/3440-2693-0x0000000006C30000-0x0000000006C52000-memory.dmp

Download

memory/3440-30-0x00000000063C0000-0x00000000063DE000-memory.dmp

Download

memory/3440-23-0x0000000075020000-0x00000000757DC000-memory.dmp

Download

memory/3440-313-0x0000000075032000-0x0000000075033000-memory.dmp

Download

memory/3440-27-0x0000000006720000-0x0000000006796000-memory.dmp

Download

memory/3440-24-0x0000000006420000-0x0000000006486000-memory.dmp

Download

memory/3440-2699-0x0000000008070000-0x0000000008102000-memory.dmp

Download

memory/3440-18-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/3440-341-0x0000000075020000-0x00000000757DC000-memory.dmp

Download

memory/3440-20-0x0000000075032000-0x0000000075033000-memory.dmp

Download

memory/6268-1354-0x000001E80DF60000-0x000001E80DFA0000-memory.dmp

Download

memory/6488-15-0x00007FFA5F780000-0x00007FFA60124000-memory.dmp

Download

memory/6488-3-0x00007FFA5F780000-0x00007FFA60124000-memory.dmp

Download

memory/6488-4-0x000002C26DE40000-0x000002C26DE62000-memory.dmp

Download

memory/6488-5-0x00007FFA5F780000-0x00007FFA60124000-memory.dmp

Download

memory/6488-6-0x00007FFA5F780000-0x00007FFA60124000-memory.dmp

Download

memory/6488-7-0x00007FFA5F780000-0x00007FFA60124000-memory.dmp

Download

memory/6488-8-0x00007FFA5F780000-0x00007FFA60124000-memory.dmp

Download

memory/6488-9-0x00007FFA5F780000-0x00007FFA60124000-memory.dmp

Download

memory/6488-10-0x00007FFA5F780000-0x00007FFA60124000-memory.dmp

Download

memory/6488-0-0x00007FFA5F90F000-0x00007FFA5F910000-memory.dmp

Download

memory/6488-11-0x00007FFA5F780000-0x00007FFA60124000-memory.dmp

Download

memory/6488-12-0x00007FFA5F780000-0x00007FFA60124000-memory.dmp

Download

memory/6488-13-0x00007FFA5F780000-0x00007FFA60124000-memory.dmp

Download

memory/6488-14-0x00007FFA5F780000-0x00007FFA60124000-memory.dmp

Download

memory/6488-17-0x000002C26E820000-0x000002C26E82A000-memory.dmp

Download

memory/6488-16-0x000002C26E430000-0x000002C26E4C2000-memory.dmp

Download

memory/6488-22-0x00007FFA5F780000-0x00007FFA60124000-memory.dmp

Download