phantom_stealer | b497901579155f4f4644e26fea1d859eb0669ca2f273a55818bda19cf8592c91

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/04/2026, 02:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TransferCopy.vbs
Size 2.6MB
Sample260417-c1hepady2n
SHA256 b497901579155f4f4644e26fea1d859eb0669ca2f273a55818bda19cf8592c91
MD5 71f4aed32dfb178afa53a49da71f56ed
SHA1 5d575a3504b5f0702422fbccf95614ae702c8ca2
SHA512 4f56d91aaf05dfc9fa29405fecc8da99d268294da6de3c20fd229d671d4035a7a1d31b3ad9a21a337130854350bb05a249b4e3650562c6e8b544e12c65297a59
SSDEEP 192:MiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXa:xGiyT
TLSH
T160C5EAF4ACFE9573F24F40A3A781E83ED881245EBA1F9D475FC89B0114526F4924AA4F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution phantom_stealer stormkitty xworm persistence privilege_escalation rat stealer trojan

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.privateemail.com
Port
587
Username
[email protected]
Password
6million200@

Extracted

Family

xworm

Version

209.127.35.204:2662

Mutex

HaaIXbv8vBFKi0HX

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
mail.privateemail.com
Port
587
Username
[email protected]
Password
6million200@
Email to
[email protected]

Mutex

9C937KZRIYO6N5F0BQU3

Attributes

anti_analysis
0
cb_enables_ssl
1
debug
0
keylogger
1
start_delay
0
startup
1

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer
Family: StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2200-17-0x0000000000400000-0x0000000000428000-memory.dmp	family_xworm

Detects PhantomStealer written in C# 1 IoCs

resource	yara_rule
behavioral1/memory/3336-76-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	1944	powershell.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3248	1944	powershell.exe	86

StormKitty payload 1 IoCs

resource	yara_rule
behavioral1/memory/2200-44-0x0000000008480000-0x00000000085A0000-memory.dmp	family_stormkitty

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	2300	powershell.exe
11	3248	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2300	powershell.exe
3248	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2128	aspnet_regbrowsers.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_regbrowsers.exe
Key opened	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_regbrowsers.exe
Key opened	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_regbrowsers.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aspnet_regbrowsers = "C:\\Users\\Admin\\AppData\\Roaming\\aspnet_regbrowsers.exe"	aspnet_regbrowsers.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
214	icanhazip.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2300 set thread context of 2200	2300	powershell.exe	90
PID 3248 set thread context of 3336	3248	powershell.exe	105

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
696	2200	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regbrowsers.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regbrowsers.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regbrowsers.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
6088	cmd.exe
5312	netsh.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4600	chrome.exe
5688	msedge.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	aspnet_regbrowsers.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	aspnet_regbrowsers.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings	aspnet_regbrowsers.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2200	aspnet_regbrowsers.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
2300	powershell.exe
2300	powershell.exe
2300	powershell.exe
2300	powershell.exe
2300	powershell.exe
2300	powershell.exe
2300	powershell.exe
2300	powershell.exe
2300	powershell.exe
2300	powershell.exe
2200	aspnet_regbrowsers.exe
3248	powershell.exe
3248	powershell.exe
3248	powershell.exe
3248	powershell.exe
3248	powershell.exe
3248	powershell.exe
3248	powershell.exe
3248	powershell.exe
3336	aspnet_regbrowsers.exe
3336	aspnet_regbrowsers.exe
4264	chrome.exe
4264	chrome.exe
3336	aspnet_regbrowsers.exe
3336	aspnet_regbrowsers.exe
3336	aspnet_regbrowsers.exe
3336	aspnet_regbrowsers.exe
3336	aspnet_regbrowsers.exe
3336	aspnet_regbrowsers.exe
3336	aspnet_regbrowsers.exe
3336	aspnet_regbrowsers.exe
3336	aspnet_regbrowsers.exe
1096	firefox.exe
1096	firefox.exe
1096	firefox.exe
1096	firefox.exe
1096	firefox.exe
1096	firefox.exe
1096	firefox.exe
1096	firefox.exe
1096	firefox.exe
1096	firefox.exe
1096	firefox.exe
1096	firefox.exe
1096	firefox.exe
1096	firefox.exe
1096	firefox.exe
1096	firefox.exe
1096	firefox.exe
1096	firefox.exe
1096	firefox.exe
1096	firefox.exe
3336	aspnet_regbrowsers.exe
3336	aspnet_regbrowsers.exe
3336	aspnet_regbrowsers.exe
3336	aspnet_regbrowsers.exe
3336	aspnet_regbrowsers.exe
3336	aspnet_regbrowsers.exe
3336	aspnet_regbrowsers.exe
3336	aspnet_regbrowsers.exe
3336	aspnet_regbrowsers.exe
3336	aspnet_regbrowsers.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeDebugPrivilege	2200	aspnet_regbrowsers.exe
Token: SeDebugPrivilege	3248	powershell.exe
Token: SeDebugPrivilege	3336	aspnet_regbrowsers.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
4264	chrome.exe
4264	chrome.exe
1096	firefox.exe
1096	firefox.exe
1096	firefox.exe
1096	firefox.exe
1096	firefox.exe
1096	firefox.exe
1096	firefox.exe
1096	firefox.exe
5364	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2200	aspnet_regbrowsers.exe
1096	firefox.exe
3336	aspnet_regbrowsers.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2136	2300	powershell.exe	89
PID 2300 wrote to memory of 2200	2300	powershell.exe	90
PID 2300 wrote to memory of 2200	2300	powershell.exe	90
PID 2300 wrote to memory of 2200	2300	powershell.exe	90
PID 2300 wrote to memory of 2200	2300	powershell.exe	90
PID 2300 wrote to memory of 2200	2300	powershell.exe	90
PID 2200 wrote to memory of 180	2200	aspnet_regbrowsers.exe	96
PID 3248 wrote to memory of 3336	3248	powershell.exe	105
PID 3248 wrote to memory of 3336	3248	powershell.exe	105
PID 3248 wrote to memory of 3336	3248	powershell.exe	105
PID 3248 wrote to memory of 3336	3248	powershell.exe	105
PID 3248 wrote to memory of 3336	3248	powershell.exe	105
PID 3336 wrote to memory of 4264	3336	aspnet_regbrowsers.exe	109
PID 4264 wrote to memory of 3772	4264	chrome.exe	110
PID 4264 wrote to memory of 4476	4264	chrome.exe	111
PID 4264 wrote to memory of 4600	4264	chrome.exe	112
PID 4264 wrote to memory of 3436	4264	chrome.exe	113
PID 3336 wrote to memory of 3772	3336	aspnet_regbrowsers.exe	110
PID 4264 wrote to memory of 4940	4264	chrome.exe	114
PID 4264 wrote to memory of 4492	4264	chrome.exe	115
PID 3336 wrote to memory of 3772	3336	aspnet_regbrowsers.exe	110
PID 4264 wrote to memory of 3028	4264	chrome.exe	116
PID 4264 wrote to memory of 2924	4264	chrome.exe	117
PID 3336 wrote to memory of 4264	3336	aspnet_regbrowsers.exe	109
PID 4264 wrote to memory of 3180	4264	chrome.exe	118
PID 3336 wrote to memory of 4264	3336	aspnet_regbrowsers.exe	109
PID 4264 wrote to memory of 4904	4264	chrome.exe	119
PID 4264 wrote to memory of 2052	4264	chrome.exe	121
PID 3336 wrote to memory of 3436	3336	aspnet_regbrowsers.exe	113
PID 3336 wrote to memory of 3436	3336	aspnet_regbrowsers.exe	113
PID 3336 wrote to memory of 4600	3336	aspnet_regbrowsers.exe	112
PID 3336 wrote to memory of 4600	3336	aspnet_regbrowsers.exe	112
PID 3336 wrote to memory of 4476	3336	aspnet_regbrowsers.exe	111
PID 3336 wrote to memory of 4476	3336	aspnet_regbrowsers.exe	111
PID 3336 wrote to memory of 4904	3336	aspnet_regbrowsers.exe	119
PID 3336 wrote to memory of 4904	3336	aspnet_regbrowsers.exe	119
PID 3336 wrote to memory of 3772	3336	aspnet_regbrowsers.exe	110
PID 3336 wrote to memory of 3772	3336	aspnet_regbrowsers.exe	110
PID 3336 wrote to memory of 2924	3336	aspnet_regbrowsers.exe	117
PID 3336 wrote to memory of 2924	3336	aspnet_regbrowsers.exe	117
PID 3336 wrote to memory of 4264	3336	aspnet_regbrowsers.exe	109
PID 3336 wrote to memory of 4264	3336	aspnet_regbrowsers.exe	109
PID 3336 wrote to memory of 3436	3336	aspnet_regbrowsers.exe	113
PID 3336 wrote to memory of 3436	3336	aspnet_regbrowsers.exe	113
PID 3336 wrote to memory of 4600	3336	aspnet_regbrowsers.exe	112
PID 3336 wrote to memory of 4600	3336	aspnet_regbrowsers.exe	112
PID 3336 wrote to memory of 4492	3336	aspnet_regbrowsers.exe	115
PID 3336 wrote to memory of 4492	3336	aspnet_regbrowsers.exe	115
PID 3336 wrote to memory of 4476	3336	aspnet_regbrowsers.exe	111
PID 3336 wrote to memory of 4476	3336	aspnet_regbrowsers.exe	111
PID 3336 wrote to memory of 3180	3336	aspnet_regbrowsers.exe	118
PID 3336 wrote to memory of 3180	3336	aspnet_regbrowsers.exe	118
PID 3336 wrote to memory of 3028	3336	aspnet_regbrowsers.exe	116
PID 3336 wrote to memory of 3028	3336	aspnet_regbrowsers.exe	116
PID 3336 wrote to memory of 4904	3336	aspnet_regbrowsers.exe	119
PID 3336 wrote to memory of 4904	3336	aspnet_regbrowsers.exe	119
PID 3336 wrote to memory of 3772	3336	aspnet_regbrowsers.exe	110
PID 3336 wrote to memory of 3772	3336	aspnet_regbrowsers.exe	110
PID 3336 wrote to memory of 2924	3336	aspnet_regbrowsers.exe	117
PID 3336 wrote to memory of 2924	3336	aspnet_regbrowsers.exe	117
PID 3336 wrote to memory of 4264	3336	aspnet_regbrowsers.exe	109
PID 3336 wrote to memory of 4264	3336	aspnet_regbrowsers.exe	109
PID 3336 wrote to memory of 3436	3336	aspnet_regbrowsers.exe	113
PID 3336 wrote to memory of 3436	3336	aspnet_regbrowsers.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_regbrowsers.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_regbrowsers.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\TransferCopy.vbs"
1⤵
PID:4060

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "IEX $env:INTERNAL_DB_CACHE;[Environment]::SetEnvironmentVariable('INTERNAL_DB_CACHE',$null,'User')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
  2⤵
  PID:2136
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\rmfkah.vbs"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 2312
    3⤵
    - Program crash
    PID:696

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:5052

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "IEX $env:INTERNAL_DB_CACHE;[Environment]::SetEnvironmentVariable('INTERNAL_DB_CACHE',$null,'User')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:3336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0l2ix0f.jze"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4264
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\b0l2ix0f.jze /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\b0l2ix0f.jze\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\b0l2ix0f.jze --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffddf34c728,0x7ffddf34c734,0x7ffddf34c740
      4⤵
      PID:3772
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0l2ix0f.jze" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1680,i,12173088020254084090,13850801918778645431,262144 --field-trial-handle=1640,i,13758118093777813230,9802643652269586180,262144 --variations-seed-version --mojo-platform-channel-handle=380 /prefetch:2
      4⤵
      PID:4476
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0l2ix0f.jze" --force-high-res-timeticks=disabled --metrics-shmem-handle=2012,i,2302996434606305626,10408671207292542173,524288 --field-trial-handle=1640,i,13758118093777813230,9802643652269586180,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:3
      4⤵
      System Time Discovery
      PID:4600
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0l2ix0f.jze" --force-high-res-timeticks=disabled --metrics-shmem-handle=2168,i,11698137353581066766,7016779935311517513,524288 --field-trial-handle=1640,i,13758118093777813230,9802643652269586180,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:8
      4⤵
      PID:3436
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0l2ix0f.jze" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2920,i,17461450841165118027,15432070912582609111,2097152 --field-trial-handle=1640,i,13758118093777813230,9802643652269586180,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:1
      4⤵
      PID:4940
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0l2ix0f.jze" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2792,i,2358537827980987652,15933947105428615136,2097152 --field-trial-handle=1640,i,13758118093777813230,9802643652269586180,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:1
      4⤵
      PID:4492
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0l2ix0f.jze" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3380,i,816177772644285786,229402889268246568,2097152 --field-trial-handle=1640,i,13758118093777813230,9802643652269586180,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
      4⤵
      PID:3028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0l2ix0f.jze" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3392,i,12954050701743006820,11041995171697187677,2097152 --field-trial-handle=1640,i,13758118093777813230,9802643652269586180,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:2
      4⤵
      PID:2924
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0l2ix0f.jze" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4104,i,16148960107467288476,2539431687143169104,2097152 --field-trial-handle=1640,i,13758118093777813230,9802643652269586180,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:2
      4⤵
      PID:3180
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0l2ix0f.jze" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4136,i,7409619385816919296,8989144471135586819,2097152 --field-trial-handle=1640,i,13758118093777813230,9802643652269586180,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
      4⤵
      PID:4904
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0l2ix0f.jze" --force-high-res-timeticks=disabled --metrics-shmem-handle=4200,i,16383239772437120122,17792175259911724287,524288 --field-trial-handle=1640,i,13758118093777813230,9802643652269586180,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
      4⤵
      PID:2052
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0l2ix0f.jze" --force-high-res-timeticks=disabled --metrics-shmem-handle=5032,i,11664222692119102700,8607274173241685650,524288 --field-trial-handle=1640,i,13758118093777813230,9802643652269586180,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
      4⤵
      PID:1184
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0l2ix0f.jze" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5132,i,7352604024202550579,10323997786715704132,2097152 --field-trial-handle=1640,i,13758118093777813230,9802643652269586180,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
      4⤵
      PID:1596
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0l2ix0f.jze" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5144,i,7810501764783009588,7754688113215560439,2097152 --field-trial-handle=1640,i,13758118093777813230,9802643652269586180,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:1
      4⤵
      PID:2692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vqqrgyns.hww"
    3⤵
    PID:3032
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\vqqrgyns.hww
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1096
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2080 -initialChannelId {ac35f373-b2ad-47e5-bca5-b038c3f36552} -parentPid 1096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1096" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:4140
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2552 -prefsLen 27135 -prefMapHandle 2556 -prefMapSize 270279 -ipcHandle 2252 -initialChannelId {921b1365-e37f-460e-907e-21df070c7901} -parentPid 1096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:1104
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9134cc4f-4e43-471d-a8b5-45c6d63705b4.dmp"
        5⤵
        
        PID:5080
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2080 -prefsLen 27135 -prefMapHandle 2804 -prefMapSize 270279 -ipcHandle 2824 -initialChannelId {a4d166b8-4a74-4adf-98f6-fc4f9bdccf89} -parentPid 1096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1096" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:636
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3ec5fea2-e479-4d68-8cf1-acf2233837cd.dmp"
        5⤵
        
        PID:384
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2824 -prefsLen 27135 -prefMapHandle 2932 -prefMapSize 270279 -ipcHandle 3012 -initialChannelId {7ec32f6a-da54-4c0c-9a34-379f2ca5ae2b} -parentPid 1096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1096" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:4788
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\11b6b868-6cd1-470b-82de-50f18c53622d.dmp"
        5⤵
        
        PID:2224
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3276 -prefsLen 27200 -prefMapHandle 3068 -prefMapSize 270279 -ipcHandle 2240 -initialChannelId {c4aa8050-129c-49a3-851a-735adb507614} -parentPid 1096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1096" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:2504
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3808 -prefsLen 27325 -prefMapHandle 3812 -prefMapSize 270279 -jsInitHandle 3816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3840 -initialChannelId {e7831f48-c5a5-4b8b-bdca-ce5c8c3c0afb} -parentPid 1096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:1764
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6b2c6d1e-3812-450b-91a8-1531fc615911.dmp"
        5⤵
        
        PID:2908
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2240 -prefsLen 27325 -prefMapHandle 3996 -prefMapSize 270279 -ipcHandle 4008 -initialChannelId {caefc246-7ab5-48f7-b2bc-c2fd4264a457} -parentPid 1096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1096" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:2464
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f8dc86d6-acfb-4f5b-b784-a1d800e94c71.dmp"
        5⤵
        
        PID:3748
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4228 -prefsLen 27325 -prefMapHandle 4232 -prefMapSize 270279 -ipcHandle 3812 -initialChannelId {d4bb3bba-d325-4387-b8a8-941a51a9f568} -parentPid 1096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1096" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:4556
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4540 -prefsLen 34824 -prefMapHandle 4544 -prefMapSize 270279 -jsInitHandle 4548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4556 -initialChannelId {5bc694a7-0ff1-4fe8-ae04-2529ae4f3a98} -parentPid 1096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:2124
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4984 -prefsLen 35012 -prefMapHandle 4988 -prefMapSize 270279 -ipcHandle 4976 -initialChannelId {8ea5310a-1d98-4e44-99df-c9e677be842c} -parentPid 1096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:4892
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5184 -prefsLen 32952 -prefMapHandle 5244 -prefMapSize 270279 -jsInitHandle 5176 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5240 -initialChannelId {6ec1f6f0-71ce-47af-b954-2ff8a81b8052} -parentPid 1096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:4588
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5212 -prefsLen 32952 -prefMapHandle 4896 -prefMapSize 270279 -jsInitHandle 4752 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4688 -initialChannelId {d2451a70-2498-4bff-bfcc-15dad46a5066} -parentPid 1096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:2144
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5532 -prefsLen 32952 -prefMapHandle 5536 -prefMapSize 270279 -jsInitHandle 5540 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5548 -initialChannelId {31cc44ad-18bc-4804-a116-7fc26b813d73} -parentPid 1096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:4160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:5364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ffdd068c188,0x7ffdd068c194,0x7ffdd068c1a0
      4⤵
      PID:5404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1648,i,15356102053729360035,5947282300394717486,262144 --field-trial-handle=2544,i,2860518426967272750,17835982871578769730,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:2
      4⤵
      PID:5676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2016,i,13439154337935990026,2759007338874432647,524288 --field-trial-handle=2544,i,2860518426967272750,17835982871578769730,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:3
      4⤵
      System Time Discovery
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,18270427600467710464,8877203939318558460,524288 --field-trial-handle=2544,i,2860518426967272750,17835982871578769730,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:8
      4⤵
      PID:5696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3372,i,5238980444108194033,4841028902688134860,2097152 --field-trial-handle=2544,i,2860518426967272750,17835982871578769730,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
      4⤵
      PID:4416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3388,i,12707543100374260782,497029658689669896,2097152 --field-trial-handle=2544,i,2860518426967272750,17835982871578769730,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
      4⤵
      PID:5032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,13716303560697319048,7776033638582758016,524288 --field-trial-handle=2544,i,2860518426967272750,17835982871578769730,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:8
      4⤵
      PID:3896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,13769794644216818801,14321418272726936930,524288 --field-trial-handle=2544,i,2860518426967272750,17835982871578769730,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:8
      4⤵
      PID:2916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,13444144686359765942,15403810311931225453,524288 --field-trial-handle=2544,i,2860518426967272750,17835982871578769730,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:8
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3756,i,14227900325317516093,11815464747181094218,2097152 --field-trial-handle=2544,i,2860518426967272750,17835982871578769730,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:1
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3892,i,1993978983573222041,14336908053017075587,2097152 --field-trial-handle=2544,i,2860518426967272750,17835982871578769730,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:2
      4⤵
      PID:3496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3932,i,10536049718165702436,6881464812407599619,2097152 --field-trial-handle=2544,i,2860518426967272750,17835982871578769730,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:1
      4⤵
      PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3952,i,7208096000233757585,5035087934405660128,2097152 --field-trial-handle=2544,i,2860518426967272750,17835982871578769730,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:2
      4⤵
      PID:1292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4004,i,6909175826640432626,16087077665495299422,2097152 --field-trial-handle=2544,i,2860518426967272750,17835982871578769730,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:1
      4⤵
      PID:4680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4076,i,15550703251981808346,7980951745970715140,2097152 --field-trial-handle=2544,i,2860518426967272750,17835982871578769730,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:2
      4⤵
      PID:4456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4100,i,12134199720378377974,3731130517158548350,2097152 --field-trial-handle=2544,i,2860518426967272750,17835982871578769730,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:1
      4⤵
      PID:3348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4144,i,14210357504159944867,13466737356248582608,2097152 --field-trial-handle=2544,i,2860518426967272750,17835982871578769730,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:2
      4⤵
      PID:1648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4168,i,768887516780927458,16769123022117095181,2097152 --field-trial-handle=2544,i,2860518426967272750,17835982871578769730,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
      4⤵
      PID:1148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4196,i,16783408714412507393,10860872686176023413,2097152 --field-trial-handle=2544,i,2860518426967272750,17835982871578769730,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:2
      4⤵
      PID:748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,4172563119772801028,12307196539391184889,524288 --field-trial-handle=2544,i,2860518426967272750,17835982871578769730,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
      4⤵
      PID:1764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,8407396749856706290,4987473457056293675,524288 --field-trial-handle=2544,i,2860518426967272750,17835982871578769730,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,12634959153846297473,14456544836176264802,524288 --field-trial-handle=2544,i,2860518426967272750,17835982871578769730,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
      4⤵
      PID:2132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,11012797144960790679,6467567269492975411,524288 --field-trial-handle=2544,i,2860518426967272750,17835982871578769730,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
      4⤵
      PID:768
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4556
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3240
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:5268
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show networks mode=bssid
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4692
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6088
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:5052
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5312
  - - C:\Windows\SysWOW64\findstr.exe
      findstr All
      4⤵
      System Location Discovery: System Language Discovery
      PID:912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 2200 -ip 2200
1⤵
PID:1268

C:\Users\Admin\AppData\Roaming\aspnet_regbrowsers.exe
C:\Users\Admin\AppData\Roaming\aspnet_regbrowsers.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a
MD5 f41839a3fe2888c8b3050197bc9a0a05
SHA1 0798941aaf7a53a11ea9ed589752890aee069729
SHA512 2acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699
TLSH
T11161EE323275B1D8C9167F071E28198053BF4396EAA4AF0CB298625EDD2601B9F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 dce6797f43f2d6600bc2b6d14fe286e59a803dc095c0ee47ff8d059aa9086891
MD5 0202ffc95c7a85af8a46c65ae8366bc1
SHA1 b5bc169deba5b466dca9f9e47257f4c6a8d439e9
SHA512 3ca9fe207b662154714c12eb5a96ae282ea728ef3a54b0f96356917ba0fe592e65ab9360e1266834c657047ea111ee5454e1c29f58f28490cd966162eb44e9d5
TLSH
T14E41195CBAFA1108B3776E1B9BF6A86D847E7D631F06D15E00110E4F0A33A40C862737
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4ed5110650f52a4e5f127d92e274ed47790d030ad145c4eb6f9cb6b6b69df2a5
MD5 de0d078497ce06efb95535cd8764eb82
SHA1 65b2973ce918eecd34ef016e3808a7859a0999c2
SHA512 7d6f7c8ca4056c9e5df1ad1abc3569de1ee7d562261964b3ef19e6104eb31ac2d36fc5c735804e4fbb0008078b81d42b67f65fe307745d4a7e6166e6216618ef
TLSH
T132217827B39C8961CC96113A009D9C1176B6C3DB819ECF9F6FC4D214E17F584CB71590
MD5 SHA1 SHA512 TLSH

Submit Download

7436d3e8-9b99-4336-976c-8d68d5841d21.tmp

Path C:\Users\Admin\AppData\Local\Temp\7436d3e8-9b99-4336-976c-8d68d5841d21.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_wkrkj0vw.4nb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wkrkj0vw.4nb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\b0l2ix0f.jze\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\b0l2ix0f.jze\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\b0l2ix0f.jze\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\b0l2ix0f.jze\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\b0l2ix0f.jze\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\b0l2ix0f.jze\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\b0l2ix0f.jze\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

rmfkah.vbs

Path C:\Users\Admin\AppData\Local\Temp\rmfkah.vbs
Size 2.6MB
SHA256 43d7d7def4c2f5d87d49c4b8dc1dca907a991be4af3b7794ff8eeda51106ffd4
MD5 c6697542044eb294ca58281e744ea177
SHA1 1db4e719bbf0de7aaecf315e8cc693d6330dafd8
SHA512 27e06be9ff4dc4fff51df096dc5705fa6a619a8eb5e80e0c9215550fb88a8f9792c160ab8de4cbc2bded92cf4e1e932c9eab235b80ceafa40683996f36dcb5d2
SSDEEP 192:7WBsWBsWBsWBsWBsWBsWBsWBsWBsWBsWBsWBsWBsWBsWBsWBsWBsWBsWBsWBsWB9:jq/jr
TLSH
T160C505D77DB9F9411884545CBA901C8BB831FB0AF8AC55F4F66E2E0EE27812442CDD7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv\Crashpad\settings.dat
Size 280B
SHA256 084a5ca8a9041c06d743c648b38c6517b4787abeba412c0e85f7a537bad8f74e
MD5 3a3dd308988beda51671ad4e6c8eda7b
SHA1 a15779fee7d5f6b88cb87e8b00ff465a23b54877
SHA512 9667c798ba7413a2678b16b3ef193ad0aa577d4efc0451d86f230b8128eed0c7c3a349b344f8b6afac27ebd7a5991e7d3eb7350b4b56c6346757c77c9ed62b18
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv\Crashpad\settings.dat
Size 280B
SHA256 d19978adb29b0dc65a04676c5a64e84458e6a8e5fc099d736cc69a0ccff59775
MD5 d1eda09bcfa69cb6a6bdd5256558b66e
SHA1 4a7da01508a2c19203d1c3bda048f8c6932786b1
SHA512 aede7ad87f68c116bba587a455d4eabceb912c319c0bda9dc68c98b0bfb8ad1380d2457bf7a7aeeccc555e949a55c0609e5f77f146c540cf4aa8e2754b9786a5
TLSH
T1CED0222033223A02C200E0320022E300CE00CF00AB88228082A00F0F2BCB0AA3CAF2EC
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 7a72f084ba1c551c061ff4e0b3456a2ef1cfc50e8699aa43bc9237e06969c090
MD5 a8c79cdfca48dc030f1d8f319f210e6c
SHA1 828a0ac6e7a4e3bbe25464a65ab99dd49e69d41c
SHA512 1e166430fca1c0ec287c2e93d4afae19756df4e320409d34aa738e639e2676a33ae0402ca054d2a5b570e65804adb208e814cc0a74a2bcf7e441c032889dbcc4
TLSH
T1AAD02BB729A90820ED6BA3D2683694D100177CA4CA4AFC9E445EF5839471332BA67C61
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 c099bab0d2dc2a6b2224890bb884fe6c1a12842e5f182b4fbd193baf616e082b
MD5 7b854ca61f83f76969e3ce38ae41edbf
SHA1 f9816f0eb3a3f07e0c66df4d94bcc292ab0873b3
SHA512 6b3b1afdcba4d2193ba11e49048962699c54e5f2875d81aa3cf034e6cea043552f211ec2e4daf08b979c87ba1692643a7e0711c513aebec8ce65499954570dc5
TLSH
T10EE068772DE71820EA2BB3D6583294D100167C64C905BC9F541BF5D290B3220696AC61
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58d51e.TMP

Path C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe58d51e.TMP
Size 153B
SHA256 e3b6d3fd1e7fd4da43c41e1e51c0706f19edfc5d2bd995f110b8c9b3c5b8a311
MD5 a0a6a54c5ffc5e72805efd5db51fbe31
SHA1 c8e9eb3658d1ad634d280923ccaef4c9c9f1c837
SHA512 b8232c3f97ecbd610b0e947c277c88f4bbae7e2734fdc681d791337a144edf0647e029cc5c85c4084a0a7637c0ea47ba09ae7240967c67d432d618032c6eedde
TLSH
T129C08CF718A908109A16A2D6413698D142236CC88985EC8D405EF583603023273A3D20
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv\Local State
Size 4KB
SHA256 2815a1481bd29865fc690fdf3c657a229e5aed0c2ec34b67eba5f3d081a000d4
MD5 7155dc115b22fcb083b3c893a5e65f93
SHA1 16e60fa9d98371e1d3d1edeb42f7277a87c508ef
SHA512 cab530e6627b28a753f772e6718def8279332e4e49aa1793cc224b06d5403c0a9808883e01e6655a948dc1c57a6ac1a03f6af8afd31c1993f784abbf88cac7e0
SSDEEP 96:NqGNk8sFfDyCPKD8ef170XHD7BBqPYvV2hbpjK0eUnPLXBq4a:kGNHSyCm4jjMFhbpeqP+
TLSH
T1E681B7726424EC2319E56544B58722A35E7830B3DD56EF95E6D8570804EB74C3B0FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv\Local State
Size 5KB
SHA256 3939bbc3e8563579cf958026b902655091ca2e01de0bde11291deec383011ac3
MD5 4d17a5ba019a3989c38a0423841c5d70
SHA1 d012e6bc58e16b36d72c9271ccf6da47e447acb3
SHA512 5748400be6e76073547ecc4643cb5da6eb9e66158ab944fa940e8ac243d4e2c754f279b2b0598cbfc9e64c83ef6b4c6e1740f925c95d1c380fc9c31716da3a67
SSDEEP 96:NqGNkfQsFfDyCPKD8ef58Frh/cInURoDotov7TUzD7iBqPYvV2hbpjK0eUnPLXB4:kGNjSyCLooDUwUH+MFhbpeqP+
TLSH
T196B1B7726474EC271DE6A904B4C623936EB82173ED85BF99D6DC1B0C04EB788274AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58c937.TMP

Path C:\Users\Admin\AppData\Local\Temp\rq1vrki5.clv\Local State~RFe58c937.TMP
Size 1KB
SHA256 1a024f08e11bdbde04b71a7f29367c6652606f676444a6f97d0f16e6b71f7474
MD5 d93df3a6ac42845b068f580f96331c9c
SHA1 8b6903596bbe3433191dc85982e74584bc5c2791
SHA512 f06db3dbea813fdb899095bed94d2075610c07731af59cc57eb10918e06155068d13ee3e2b1c46d837bde3a31b201f42bb480e175b8d6eb54b5624d5c27bc579
TLSH
T12B3194B1AC602C7378A16240B18BB6632E341535D696AED491DC1B0D09EBB8DA30FC3B
MD5 SHA1 SHA512 TLSH

Submit Download

75595368-1637-4010-8d76-2d1a9b028045.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4264_1005334216\75595368-1637-4010-8d76-2d1a9b028045.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11b6b868-6cd1-470b-82de-50f18c53622d.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\11b6b868-6cd1-470b-82de-50f18c53622d.dmp
Size 66KB
SHA256 90526747b4621e4e435004b44bcaaf921e10a6e2bd5fd43d324ca22276194a5d
MD5 cce3614537c22a793d3ac8d304a37962
SHA1 052be5c4705385706f24d6f4018fff3f7e5907ee
SHA512 3f89ee7d52715ea5ccd6b80b0c620bd22bd08269e29e23012f0999b658a4330232c4457088bdfc6c85cf3b69bcbc98d947a9549c02597c1844a81c5f36e845a5
SSDEEP 768:LwWdoIg67V+8iiMvIm5oQpUEsFLDnUlPuoHPVz:MWTJ+biMvD5bpUvLDnUlPuoHPV
TLSH
T19E63CA66BBA00935F526473A58DBA7683BFFF89047878B5F03005E7A1C67394AC71E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11b6b868-6cd1-470b-82de-50f18c53622d.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\11b6b868-6cd1-470b-82de-50f18c53622d.extra
Size 10KB
SHA256 621d226d9aa379cc2a0def34feb4dfa7e9ccf346700426688c9e18a452f3a7c9
MD5 bbd21fafd3a9d5f2c5efb770a6eaa9ea
SHA1 808b620a9e239a46e47ff0317345a2ecf1525b85
SHA512 fcebd6a021423a204fa6990a06e6300f42355d72f3d15c4bdfc441c1d3308f30bc9668674fcdb6fc41960259fdeaa6abe4b45ba5c72da659f686324a5e246351
SSDEEP 96:S7WCNeTnnY6pw6FFFdW6H0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7a9cBvtILI5qwq:ShYzFLG7uvZ8RL+xsPpwly5foM
TLSH
T18222A453878724B7AD5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11b6b868-6cd1-470b-82de-50f18c53622d.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\11b6b868-6cd1-470b-82de-50f18c53622d.extra
Size 10KB
SHA256 f804279a46a216b6430eece971994b92128bc44a448e2c000cc74c5dfa75a8b6
MD5 38855f544ab8fd91a979eea1a7cdf097
SHA1 a9f104232c781d23b2508f3b5df01d863ec41080
SHA512 db9474280c81337484582234f4a7379774bd06fdc9bf753927cac8cbbd7caa529c9837c42117a36c2fc9e0a32fb7d82781ad9a28d5a695a282699b6395c457db
SSDEEP 192:ShEcFaiR4pmnTYapdVxzPjWBHx4TofKNdala5fokbLxA4dk:eEcFaiFz1LWBHx4T3aQAkly
TLSH
T10232F931081CE837E7D6AC8DFB392E36D66D7B1E50E6789C40CCCA49C1A58B8A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ec5fea2-e479-4d68-8cf1-acf2233837cd.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3ec5fea2-e479-4d68-8cf1-acf2233837cd.dmp
Size 63KB
SHA256 accd7407c67aee9e3321a000c9db7f5b4d3a48e626d2ed0a2420e16a7ab30431
MD5 b8d3f21d875d5492fd11cfad0cb2c01c
SHA1 d17cdb29e9f4ca1745d3cdcaa2cbd1ca526744f2
SHA512 4e8ea9485ae5ccd600e4429c46faaf824db68c1b65702c9320a42be156fe066887c2e21b1cd7fc8c9cc9a7916a4e26fdfe284c229552c6930229c06c56c0980b
SSDEEP 384:+xX4oIzSHBHYHXUyksboUnraLzHRIBsXAKmWwDcpT1lWVJNOsFtGyvUf:+GoIzD0skSgz6KAKmWwop2ssFtz
TLSH
T1A7536316F7A01466F52A2E36ABDBA3513BF7E8341783875F03409E7A1C63354AC73A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ec5fea2-e479-4d68-8cf1-acf2233837cd.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3ec5fea2-e479-4d68-8cf1-acf2233837cd.extra
Size 10KB
SHA256 dcc738010ef8c66f7623abc7aca3172b5d4f9f80bcd379793d75866b15f5feea
MD5 35dac5cf8929f64caf00b10e548f1a0d
SHA1 ab4a646862d90a5ed4f8cf7b02bd142d2b315511
SHA512 4fdb78a7753766619335225b565b04b464ae3eddf3e600da57d75ee45e8102b162d58b0356c5704b8fcb4d4bb5054ccd2b94ab5e7767d38e999967bc2e27e865
SSDEEP 96:S7WCNwTnnY6pw6FFFdW6H0Rh7CTvBb1d0FjMLlIrLlhTLlaXv7aZcBvtILI5qwvJ:ShqzFLG7WvZ8RLSxsPpwltRfow
TLSH
T1DE228453878724B79D5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA4A8F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ec5fea2-e479-4d68-8cf1-acf2233837cd.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3ec5fea2-e479-4d68-8cf1-acf2233837cd.extra
Size 10KB
SHA256 d21e99b672e076c8637f413f735e69e784d415056eca3b1c0120d88c82367c23
MD5 6359ea11ec4e030065715ff6e2e273ea
SHA1 45e1615de9b2722f49b4a1010643d99c70bb70df
SHA512 71eef9e1002e312c1d63612d0976bad21d761c64b2f9938c297c483739dffdc1856e2456c1cb40c9b78dd2b753cab2184b2ab8c0e08a10081f20e7d14f132e04
SSDEEP 192:Sh+cFaiR4pmnTYaVdVxzPjWBH14TofKNdalFRfowbLxA4dk:e+cFaiF/1LWBH14T3aVAwly
TLSH
T15B22F931081CE837E7D66C8DBB392E36D66D7B1A50E6789C40CCCA49C1A58B8A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b2c6d1e-3812-450b-91a8-1531fc615911.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6b2c6d1e-3812-450b-91a8-1531fc615911.dmp
Size 64KB
SHA256 41f6ab8f03d213f87288e07a24929335b00923c5ea69c161f8b6401768161faa
MD5 e4d0fe6ae1636d614749e2f5805e84ac
SHA1 4af56f335866076d375bcf2e49c0cd8626af5a01
SHA512 f638acdb56e2825f7aaa032d2eb1a69d6c30bd6fcb7e61d03afb2bc8d53d46a115c0b295e61780a157d2d7d31ea29f15ceaa870126f2f701f002b6f8fe90dd78
SSDEEP 384:9Er5oIMahTIM+gHlHqHfUiSWIOdIvM+tkDr8GOxF924WmLzp7aw/wUnzihoJqGyQ:9EVoIMahTItLbdIvtdxj24WmxaSniz
TLSH
T17353BAABB7A01975F9256F3654EBA7103BF3E4301783835F13219A7A2E633685C71E24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b2c6d1e-3812-450b-91a8-1531fc615911.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6b2c6d1e-3812-450b-91a8-1531fc615911.extra
Size 10KB
SHA256 7e4256e8e4336750751973658781743bd787fd76451a880738ed7802e62b7dc9
MD5 4b926325077f94b12006fe92a9b084de
SHA1 64c7014309de75b34abd6996d0ce41221ed15ed1
SHA512 88f25c17056a6164b9ffd40de35f93a3f429ba7c0ddafa4969e9afdbb7ddb470aff5fbeb48b5fc6716037204f84d47040628e9658d553819ccd4ebf457bed379
SSDEEP 96:S7WCNGTnnY6pw6FFFdW6H0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7aNcBvtILI5qwa:ShIzFLG7uvZ8RLuxsPpwltFfoP
TLSH
T19D227353878724B7AD5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b2c6d1e-3812-450b-91a8-1531fc615911.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6b2c6d1e-3812-450b-91a8-1531fc615911.extra
Size 10KB
SHA256 05d5c6deed7348ba84a34ab543de1ae0549c241a83005434741b97ce2c456691
MD5 23016c8f68e4cb1a12121d32cf2cff23
SHA1 eea683f29b7cb516a804ee7cf5ddda2d28af8367
SHA512 a18fc20c167565050def4538e06b060f6073ba7b9788f850e748abf64408b17df176cf670274f667ab0cb1dbeb137a6d46ae89423815500df3145784eea3a541
SSDEEP 192:Sh0cFaiR4pmnTYapdVxzPjWBH34TofKNdalVFfojbLxA4dk:e0cFaiFz1LWBH34T3atAjly
TLSH
T15E32F931081CE837E7D66C8DFB392E36D26D7B1A50E678AC40CCCA89C1A54B8A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9134cc4f-4e43-471d-a8b5-45c6d63705b4.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9134cc4f-4e43-471d-a8b5-45c6d63705b4.dmp
Size 65KB
SHA256 3a571bfde8b5db00c98f6346e7c9cc3ece3a786c5408aa36efd2aef4edef903e
MD5 330fa4ccc3edc9581d82211da1b38257
SHA1 84615e762a0bbdd9e4e3ff47b832256bc8701cb3
SHA512 a1ac028559236e41ea32ec1b5c3d450e2c86b8a284ba0a7404a441133987fbd3f129da0688e24aa99eaadfa949911442d6a6a29f4a85a21bb6ccc9f67e57cc18
SSDEEP 384:zMKoIuOBUdj764WTT1NHxqLikUQblOHLMLKR1ivGyvUf:zdoIuOBOmrTT1NHxEikUQoHL+KR14z
TLSH
T13D636016B7A40976F426873E69EBA7303FF7EC188793835F12509A7A1C633447D70A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9134cc4f-4e43-471d-a8b5-45c6d63705b4.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9134cc4f-4e43-471d-a8b5-45c6d63705b4.extra
Size 1KB
SHA256 7339c7e9a07fb2145f00d3eb449f2b73c7df038cc3cbd6e28550c7c476b7dc94
MD5 c09ba14702022b7be3a1ca7e66460db5
SHA1 877ff992c9703aae8220cdd3df16d83818de416d
SHA512 1a791d0a0d04750a0b02db06cb4f28dad85d4cba839cad57ac328cfaab7a43bf503b17b2419cbe5b250dad62ff227f717dbbdde789071e79b3fbec699f032679
TLSH
T1063172F381AC2D2299574A9CB63B1303CA9AB33708D35D4D35CD0A0C859E8DC9267AC3
MD5 SHA1 SHA512 TLSH

Submit Download

9134cc4f-4e43-471d-a8b5-45c6d63705b4.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9134cc4f-4e43-471d-a8b5-45c6d63705b4.extra
Size 3KB
SHA256 7fb44ffa5b4343ec40abf906385e44315978c0de31537cd793bd22f190eeb1f3
MD5 75e803ff848b354157d870dce6b942fa
SHA1 f620a8d914046cc4424023929e57d70a71d6ddfb
SHA512 cdac55a03b57b6ca299ccea1410ce047e91fa0de6c284eeba5a645296db7ec0fddb054c83841b84c19a8fd6b2a8d20561452b710905eff9a2b2123b2aa90ef9e
TLSH
T1CA814231004CE8375AEE5D8EB33B6D1D899EB359D8622A8C50DAC35C01B8CF46387143
MD5 SHA1 SHA512 TLSH

Submit Download

f8dc86d6-acfb-4f5b-b784-a1d800e94c71.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f8dc86d6-acfb-4f5b-b784-a1d800e94c71.dmp
Size 64KB
SHA256 dc0c83572820f35da0d3de614cab97cac23bda84c6876caec6f45bb2b94213b1
MD5 b3f6d593025ffb7e470d4c43f92d30cb
SHA1 b25ee4622e6f4efd50cfb33a4f24ab8c41710367
SHA512 9bc571cd05516c272d032f039ae22aa0cc0d624aac94951862b0bf68088b814deb9051cd5a10787b33127f4574d13a22648b9d050ff0fae3fc09e15000b89918
SSDEEP 768:7doI+YpShxnTdGN5GhJnLdJUIqZvMs3z:7+xn5wEhRLdJpqN
TLSH
T1D653ED11B7A00575F62A07F655DBAB903BF3E85097838F8F03229E7A1C673546D32EA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8dc86d6-acfb-4f5b-b784-a1d800e94c71.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f8dc86d6-acfb-4f5b-b784-a1d800e94c71.extra
Size 10KB
SHA256 507550fb9dd14678525f668d32a71964ea78995f778ca229307e9e8e6be3546b
MD5 8879ffc3d7f57a5bf393f4fbc3d515ba
SHA1 9007ac0127b124060e0c47c378a841b9180ed89b
SHA512 2a750c4b81230fd2371ac711b85d7ebce49d425e81fde273611975e81c621e6c70e4c1267c3945b3b9f33b34af1e0b41a2d567eebc568ba99bcd7c1386a2cd14
SSDEEP 96:S7WCClxTnnY6pw6FFFdW6H0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7aAcBvtILI5qU:ShClBzFLG7uvZ8RLTxsPpwlDOfoj
TLSH
T141227353874724B7AD5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8dc86d6-acfb-4f5b-b784-a1d800e94c71.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f8dc86d6-acfb-4f5b-b784-a1d800e94c71.extra
Size 10KB
SHA256 ba952a55426ec7f9a0afce91752628d48444c8c6e356f3c56796408bff5744dd
MD5 cfa56c97b2de187901f6b2c4e70e41e1
SHA1 a488794601a82fd9f8f7d2537098ed673c134c65
SHA512 e9d0ef65425bd1fd0754bb8ef9f5430d1d0a046259c0bf0142b766d80d7e87ef75ab2a602b82adc66fdda394cee014143424b263688c4005d5fc7b8b96061938
SSDEEP 192:ShClrcFaiR4pmnTYapdVxzPjWBHO4TofKNdal7OfovbLxA4dk:eC5cFaiFz1LWBHO4T3aMAvly
TLSH
T18632F931081CE837E7D66C8DFB392E36D26D3B1E50E6789C40CCCA89C1A54B8A779517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\semwmfoz.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\semwmfoz.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 5d610aae7d32b892e89c0d3a500c04340bcb017036c824525efc12ca819df309
MD5 205775457bd0e549438d08b0df6ed0b8
SHA1 170ba28776bd46d03e8686dbebe0ef54efe90a02
SHA512 01a43a0003c586d528e0cebe630b52bf08969c49d8e23f916d66ce289518ed9484af483499b9f633facc3adc1aba9030ce4cc51633cec4c5457b11c463e39806
SSDEEP 768:Zs0kE77f85g5GcmhuR4PRYHLfHRbpbfb5b2:L7f8Y4P9
TLSH
T122D21184EB1E953FD41512BBDCA50B042F79B88A59092FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\semwmfoz.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 52decb949afac473b5ba2b219f6594e79962af6ba149b293f5a1886e5e0c5a0f
MD5 8842d83b02900cf3ce4439dfc4763334
SHA1 8f4c790b477af2221882d1a3a3357dbf5f56de08
SHA512 1fd7ea8b54bd36dbd9ef96eaa64b5b5ddbdc26ba4da5f7e97321073a0d36c400922e6b683f1430cb7f394ec424c2ac56d14b75e2bfc6e0b254e9b50e511b9648
SSDEEP 768:IP0qE77f85g5GcmhuR4PRYHLfHRbpbfb5b2:L7f8Y4P9
TLSH
T168D21284EB1E953FD41512BBDCA50B042F79B88A59092FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\semwmfoz.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 62029b486e9b345ffbeb3cd820ca3f2f12b74f45aff62d8c409e0be184d5ecef
MD5 41ba2490771fab83441d3cf40ccc90d5
SHA1 e76e662cce636998d5ca30c7c09da8a942ba89f3
SHA512 b5b3e44b75d86bb14df443788766eb761f3bba1d0b170c35834a854a2769889cf630dd20913ce38952be87fbdaded4083d367331a21d492b3f2a1d9e9463a5e6
SSDEEP 768:s7f85g5GcmhuR4PRYHLfHRbpbfb5b2zP01E/:s7f8Y4P9v
TLSH
T138D21244EB1E953FD41512BBDCA50B042F79B88A59092FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\semwmfoz.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 3be74ae1eeaca8ddc4f14e94b99dbe73c71aeb4f7ab11ed96be2de6a3c003f27
MD5 42f37bd056be26b6787c02034521e62e
SHA1 ad98873712689fdffbbcffdce5344ceba18371ac
SHA512 3ff88581b501fa29c85860c6acca8f9f75a71fde9eaae31e4532e2cbcaaf756f3ae157179060630ca08b2a6ba77f2c0fbd666d586d2372a7f47ec1e4773fea42
SSDEEP 768:IPk7f85g5GcmhuR4PRYHLfHRbpbfb5b2ZyE/:b7f8Y4P9h
TLSH
T15FD21244EB1E953FD41512BBDCA50B042F79B88A59092FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\semwmfoz.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 903ff0af00b713d36c3de39d287191ecd6d5b1ea5d43b986de557018941af870
MD5 1d455886b8298907e2f73c920bde9cf9
SHA1 0ec57110aa62876798e7b83c23910d419110379b
SHA512 95a539029a8d02a9b6f7ecb8c2f85febd597ec7c907ae6ca7d2509d90709999aa9022761ed9264c88ee0a777e28be5af2381ad1370ac235377715801000faa45
SSDEEP 768:Zsk7f85g5GcmhuR4PRYHLfHRbpbfb5b2ZzE/:x7f8Y4P9o
TLSH
T1D4D21144EB1E953FD41512BBDCA50B042F79B88A59092FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\semwmfoz.default-release\datareporting\glean\events\events
Size 1KB
SHA256 53de76ae207e356dd4e1d9384815623d52f06de8733c8dd49ba11ff767035201
MD5 1fbb8a35ec7e4154e768f63fcf7f27de
SHA1 49e21fcbf3f28368fbeb3c42b1991f27e51a0a23
SHA512 e94522056c41c447562da6ff32f179392a9d6b3459f34cfe087e69c2257316df890ea39b598e63370c0a0871a10ba743bebb7fdaecca49da1a0f229ef0feecbe
TLSH
T1F1219A8C39B94D2AB8DBF29CB441038E57554E5A08871C834F42EF8CDD95AD9326E83C
MD5 SHA1 SHA512 TLSH

Submit Download

386808cb-1cf1-4227-8b4a-f8327dd016b0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\semwmfoz.default-release\datareporting\glean\pending_pings\386808cb-1cf1-4227-8b4a-f8327dd016b0
Size 2KB
SHA256 000d8864a7c06bd77146fbaf037a51698830af743b3568733443e0aac9b4cbe7
MD5 99d9f6f19baf958a3bca38e4930bbb65
SHA1 fa1b20d98950839bedc2aeac0cf86b1ce018f72f
SHA512 7b45de1fd84c7cdebbe74ddb406797bad6fbabccdf135d9b931c9ab82a7627e471c30124f0295f64151a72415b2744c69e983bb89ca1d04ec3294cb47badcc6c
TLSH
T1DA4111AC35B84CBB8CDAE15DD582378E53B09A4320CA1D532E91DE0C8C967DD336A42A
MD5 SHA1 SHA512 TLSH

Submit Download

8b4fe46f-cb07-4538-acd8-cdc53de198ae

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\semwmfoz.default-release\datareporting\glean\pending_pings\8b4fe46f-cb07-4538-acd8-cdc53de198ae
Size 3KB
SHA256 9672bad018620e5f71b316073ffe90a63c36978448c1e68355820e50e5f18594
MD5 818d55067110c939855afac965e20e9c
SHA1 8a23b007cf6a2588c4b156c862d8d22f42f30355
SHA512 55d20cc403e8e3ecccf3ef485035dcfb392b1d3858824b01ddb78d2d44424a3f43d7fefaf0f5abd1268a163a81c22dfef0e354fe77bbcd5edcebd835da53bf58
TLSH
T1FA6144211558A9738FECA044A33B7E558ADE33CF94570BCD21B9D92442B88A4478F35B
MD5 SHA1 SHA512 TLSH

Submit Download

8d147156-0a62-4fda-a4b0-ca25dea74e64

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\semwmfoz.default-release\datareporting\glean\pending_pings\8d147156-0a62-4fda-a4b0-ca25dea74e64
Size 235B
SHA256 1c6cc328ffacc1a51d0d26d9e01c3ddaf605889b6d50bc70e4d38b3f0df74cc4
MD5 a8a89b9faef5425fa67d90927a29d752
SHA1 f24b29f1f2b582df5cbff8a266104ba75a4d1879
SHA512 e32943cd2b123ee1c0f1deab825a47544e7258ca3bdc4d6c0f54a980e3bdb064efb126acac28b514a60e7699b3cd6f5b265f10795b66286d3996260d51e344e7
TLSH
T12AD09781389C637D0C040F06F1B02CEA35688C3728A0A820AA61003899FEAC842D1C5B
MD5 SHA1 SHA512 TLSH

Submit Download

98d7a1a7-ba93-42a7-9909-8609ed0129aa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\semwmfoz.default-release\datareporting\glean\pending_pings\98d7a1a7-ba93-42a7-9909-8609ed0129aa
Size 896B
SHA256 f265538af0e593795725a310c0508628bd13676bbd026208bb4497c09a4fb2e4
MD5 6170ec766dab7695c5fcad93c0b9830d
SHA1 bb0a7cbaf4d83f898639c911e88d728cca17cc71
SHA512 1d8e1594de0da5990406e126cb0c9d9a2cbd6d9a525e1d9d971c7db57a8a337cdec17c7daa186c989d22bfb30ad1425815441a7bad6110e65bd7ef2af729e7a9
TLSH
T16F11048096347DF2CDA5D18BD4D17B5243F47523C0C64D107DA65B080CEA51D7757306
MD5 SHA1 SHA512 TLSH

Submit Download

a6eb75da-5312-4fe3-80bb-8b4222cbd591

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\semwmfoz.default-release\datareporting\glean\pending_pings\a6eb75da-5312-4fe3-80bb-8b4222cbd591
Size 871B
SHA256 05f4267fcf19348e82c50e890dc6a57f2cf9b5c71bc93cf8e9dd6fe8dce35295
MD5 da6f9ae4426529aa9b27d253b253c22a
SHA1 aa51967b0b9b6612301ea14e10d9f04327d8a71e
SHA512 65daeafbc229fd01d6305b79ee17d82e7a361df337c0ccd3f600f1484285464c9a00483fecb4791fa8e23193501a9bbfe7c4c1f2dd9c6a02fdfd46dc7d673a52
TLSH
T1C911E390A63479F6CDB8D29FC4923B4687F47523C0CA59103EB65A080D7F92DE397207
MD5 SHA1 SHA512 TLSH

Submit Download

aae96fef-3023-4239-9135-0cf50176f2b0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\semwmfoz.default-release\datareporting\glean\pending_pings\aae96fef-3023-4239-9135-0cf50176f2b0
Size 3KB
SHA256 2d6a3b5fabba28fd113a975bc274102a0be276137d834f8ac2fce2fac24dd09e
MD5 d56cb057d1dd42491fc075b0d4807ae5
SHA1 2c9352bcd5deff1cfc0f9faffaae6d0999b1aaec
SHA512 723242c2ff88b726473c06d02b56aeaaee2c7062210df6433b36a4baa9bef090e27a6385e7450193d057202d680b6dffae1879aefb94e07a40f2a5afbe898ea9
TLSH
T176614531156C7D738EE8A044A37B6E558ADE33CF98470BCD21B9D92442F48A85B8B35B
MD5 SHA1 SHA512 TLSH

Submit Download

aeec1ddd-6fe5-4a4e-9e54-45691eba8374

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\semwmfoz.default-release\datareporting\glean\pending_pings\aeec1ddd-6fe5-4a4e-9e54-45691eba8374
Size 235B
SHA256 27a4fc3a6b3de4bfc4198e0a3eb4cbd14119d8364f4edcafc1e1c4361caa1b22
MD5 a1c4fc75bb06057405c86f8f60ccf4ae
SHA1 9bb3ae4572f92de64b72943a705ee85b731cb778
SHA512 e0f8e05c84c07538024a6897c57085107d263e9309bca2d484990e68187eabaa5ab6016097abf254ca362dd59ecd8a9a4efdb3b4074f62bda8795a60b6b3bbe3
TLSH
T1D6D0A7D81498676D48145F07F4F169C630888C336479A82095A1457499FDFD95265C5B
MD5 SHA1 SHA512 TLSH

Submit Download

b06f2b0a-7a3b-4211-871b-887abbe14605

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\semwmfoz.default-release\datareporting\glean\pending_pings\b06f2b0a-7a3b-4211-871b-887abbe14605
Size 3KB
SHA256 1421433eba47aa8220f2711b993ce132cc4838923aad6699ee562c788af07702
MD5 2adaacd18359ae05f1d9df3a22b17498
SHA1 066f3c67c54b3956eb52de1e53f9ec566792fef6
SHA512 333c40ece3f3380c74a04ea099631809462219bfb72d3d9625bcb3610a2911117afaf095306637337ff4bfc1cb736348385f902d1a4c37c0a524bc8dda60ad76
TLSH
T121613231155CB9738FECA044B37B6E558ADE33CF98470FCE21B9CA2442A44A8578F25B
MD5 SHA1 SHA512 TLSH

Submit Download

be13adc0-8f08-4d04-8a57-b928a21c210a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\semwmfoz.default-release\datareporting\glean\pending_pings\be13adc0-8f08-4d04-8a57-b928a21c210a
Size 3KB
SHA256 905cfff2697da6158c9bf9f41bd28ba5f7f88ad4284b7d7caac971ad307b6a8a
MD5 2de892424b7250148b99d476931d31b1
SHA1 76d6af313eeb40f6f12c87a33f8a2f1fd3c432fd
SHA512 98682734c1330f8c4130eda453bd346bc6aabf736a58e4a52570510cac31c5c1fdb7696870cf32fddc97364592742ebaca09546e6bdcf366fb5ed994261423c6
TLSH
T19D6176201558B9738FE8B045A37B6E559ADE33CF98470BCD21B9CD2442E88A4578B35B
MD5 SHA1 SHA512 TLSH

Submit Download

e5e80ca4-2598-4656-af0c-b71c45f97476

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\semwmfoz.default-release\datareporting\glean\pending_pings\e5e80ca4-2598-4656-af0c-b71c45f97476
Size 3KB
SHA256 ba5004564f8056f20978fbf6402d02e7e7d193ac4dbf14fadd784588ed9958bc
MD5 0dba4fa9ab69fd1248d54bcb56266502
SHA1 a491cc91e94cfaa5f211fa4c43e1bde60f9577d2
SHA512 d0524f540e9456e2c0a700543e314f5b4d84d25edfa52a41146cb9c830ce43db4f709a6a82563683fc4967b064b800a4a8971cf80ae2c4f4a12be32db48016ee
TLSH
T1A16154311558B9738FE8A045E33B6D548ADE33CF98470BCA21B9CD2442E84A8578B35B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\semwmfoz.default-release\prefs.js
Size 6KB
SHA256 0e9d8eb049a97b76bf0e222c89fd69b86eef49a1fb27c839dd7dd2ca55751221
MD5 1ecf21d67a004bfad1ded13afc9ebf10
SHA1 317d96adf3c7ad4ec46a7ab84521aa8447281ac9
SHA512 012ab8ba877d2f946870da4ce6505e3bd8ab5b168d862637b3d61fe36ee711c2eb5aaa5c5a167b434a47b959c8792295e7867a81f9379c6d14d9615f01804cef
SSDEEP 96:xHQwUTU9xqGqNzfCnKjPnjo1zSpnPSSl8pdv9jhnJH1HBw88n8L4cnQgN82k8y:mwtsRNzfCn0conPSSGp1HBw88P1Oy
TLSH
T15AE11F7894488FBF64B677ACAC688C316AB2013B77BF68D710B65484050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aspnet_regbrowsers.exe

Path C:\Users\Admin\AppData\Roaming\aspnet_regbrowsers.exe
Size 45KB
SHA256 816939877fc16426ef1c32c25572bb763750ffe66a4e3fa3765543d0266e6505
MD5 bb8b6b54fd50c08ab579b84bf07918cf
SHA1 3fc81b9c9ffb9a8d9bebab489f8c6b0938c1a711
SHA512 ce42920f15cd1167990b7a687ebcd7d832e21d45af63e20984a234ef9c35001450b3cfe13273b2b1be7c35bb1da314570a74d7eeebd7f554c6f2e91ed22f46e3
SSDEEP 384:ENAPwxabK/7YyoodyJ8Ood0XAKJ9Yl6dnPU3SERztmbqCJstdMardz/JikPZ+1Pv:mYGn//oAKodAT6Iq812HSpqWJ82n
TLSH
T13423C628D7F85356F2B78BB099F5D483AD36B553AE24D79C348E934D09223808653B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/180-34-0x0000000001710000-0x0000000001729000-memory.dmp

Download

memory/2128-90-0x0000000004990000-0x0000000004C11000-memory.dmp

Download

memory/2128-87-0x0000000000210000-0x000000000021E000-memory.dmp

Download

memory/2128-88-0x0000000005150000-0x000000000567C000-memory.dmp

Download

memory/2200-46-0x0000000007CD0000-0x0000000007CDE000-memory.dmp

Download

memory/2200-26-0x0000000007540000-0x00000000075A6000-memory.dmp

Download

memory/2200-44-0x0000000008480000-0x00000000085A0000-memory.dmp

Download

memory/2200-45-0x00000000085A0000-0x00000000088F4000-memory.dmp

Download

memory/2200-47-0x0000000008B00000-0x0000000008B4C000-memory.dmp

Download

memory/2200-73-0x00000000055A0000-0x00000000055B9000-memory.dmp

Download

memory/2200-27-0x0000000005310000-0x0000000005591000-memory.dmp

Download

memory/2200-72-0x0000000005310000-0x0000000005591000-memory.dmp

Download

memory/2200-21-0x0000000005680000-0x000000000571C000-memory.dmp

Download

memory/2200-28-0x00000000055A0000-0x00000000055B9000-memory.dmp

Download

memory/2200-29-0x00000000012C0000-0x00000000012C6000-memory.dmp

Download

memory/2200-23-0x0000000006730000-0x00000000067C2000-memory.dmp

Download

memory/2200-17-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2200-22-0x0000000005F80000-0x0000000006524000-memory.dmp

Download

memory/2200-24-0x0000000005F60000-0x0000000005F6A000-memory.dmp

Download

memory/2300-12-0x0000021A7EC00000-0x0000021A7EC22000-memory.dmp

Download

memory/2300-13-0x0000021A7EF90000-0x0000021A7F12C000-memory.dmp

Download

memory/2300-14-0x0000021A666B0000-0x0000021A666BA000-memory.dmp

Download

memory/2300-15-0x0000021A7EA80000-0x0000021A7EA90000-memory.dmp

Download

memory/2300-16-0x0000021A7EA80000-0x0000021A7EA90000-memory.dmp

Download

memory/2300-3-0x0000021A7EA80000-0x0000021A7EA90000-memory.dmp

Download

memory/2300-20-0x0000021A66390000-0x0000021A6639C000-memory.dmp

Download

memory/2300-4-0x0000021A7EA80000-0x0000021A7EA90000-memory.dmp

Download

memory/3248-78-0x00000174DDD70000-0x00000174DDE0B000-memory.dmp

Download

memory/3248-79-0x00000174DF910000-0x00000174DF91C000-memory.dmp

Download

memory/3336-490-0x0000000004E70000-0x00000000050F1000-memory.dmp

Download

memory/3336-76-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/3336-491-0x0000000005100000-0x0000000005119000-memory.dmp

Download

memory/3336-1622-0x0000000004E70000-0x00000000050F1000-memory.dmp

Download

memory/3336-94-0x0000000006590000-0x00000000065AE000-memory.dmp

Download

memory/3336-93-0x0000000006240000-0x0000000006290000-memory.dmp

Download

memory/3336-92-0x00000000061C0000-0x0000000006236000-memory.dmp

Download

memory/3336-1619-0x0000000004E70000-0x00000000050F1000-memory.dmp

Download

memory/3336-91-0x0000000006310000-0x00000000064D2000-memory.dmp

Download

memory/3336-1616-0x0000000004E70000-0x00000000050F1000-memory.dmp

Download

memory/3336-84-0x0000000006090000-0x0000000006142000-memory.dmp

Download

memory/3336-492-0x0000000002970000-0x0000000002976000-memory.dmp

Download

memory/3336-1613-0x0000000004E70000-0x00000000050F1000-memory.dmp

Download

memory/3336-1594-0x0000000006630000-0x0000000006652000-memory.dmp

Download

memory/3336-1595-0x0000000006660000-0x00000000069B4000-memory.dmp

Download

memory/3336-1597-0x0000000004E70000-0x00000000050F1000-memory.dmp

Download

memory/3336-1614-0x0000000005100000-0x0000000005119000-memory.dmp

Download

memory/3336-1605-0x0000000004E70000-0x00000000050F1000-memory.dmp

Download

memory/3772-181-0x0000023020D70000-0x0000023020D7E000-memory.dmp

Download

memory/4060-1-0x000001FF426C0000-0x000001FF4275B000-memory.dmp

Download

memory/4060-2-0x000001FF440B0000-0x000001FF440BC000-memory.dmp

Download

memory/4692-1603-0x0000000000920000-0x0000000000939000-memory.dmp

Download

memory/5052-25-0x000001B9E8240000-0x000001B9E82DB000-memory.dmp

Download

memory/5312-1604-0x0000000000CC0000-0x0000000000CD9000-memory.dmp

Download