phantom_stealer | 332c63fac0deb1b5a81b3270e55a5cfdcc08dce46d31747f5346a1f3abb46979

Analysis

max time kernel
299s
max time network
276s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/04/2026, 14:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO 4500272644 -R0-S - 254902/PO 4500272644 -R0-S - 254902.exe
Size 1.8MB
Sample260427-rrls3sdw2w
SHA256 332c63fac0deb1b5a81b3270e55a5cfdcc08dce46d31747f5346a1f3abb46979
MD5 10e4b4a4bc364295d93b5311b825288e
SHA1 4d94153111bc9b71c426710c44c04f28f937123b
SHA512 0736f6cc21882d979c33b399a6682e98cf59359d4f39d37aaf14daa1f3768833209b989b3f50db7196d2d50b14cb982b5034b76ddd7b67083f4aa01a2d00821c
SSDEEP 24576:fm/BXSQwFqEWr1AWZnFuif07+jV+CcI7FKESh0fQPiAQJldX7wOA7vKLeHfL:KB7wFqEWRznDf06ZcIRQ01JA7vx
TLSH
T1249501927749DF11C44F12B2C4B2C2F823276E04DC0193DBB6CAFE6B78B62E96955583
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution phantom_stealer persistence spyware stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

Mutex

EXFPIBTWTOJMS2KZWIX6

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 1 IoCs

resource	yara_rule
behavioral1/memory/5048-25-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2532	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	PO 4500272644 -R0-S - 254902.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HANQYBGnTHzm.lnk	PO 4500272644 -R0-S - 254902.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PO 4500272644 -R0-S - 254902.exe
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PO 4500272644 -R0-S - 254902.exe
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PO 4500272644 -R0-S - 254902.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
225	icanhazip.com

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral1/memory/1732-6-0x0000000005E10000-0x0000000005E22000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1732 set thread context of 5048	1732	PO 4500272644 -R0-S - 254902.exe	97

Drops file in Program Files directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\465d8226-22d3-4db9-ad19-9d8443a5a1e0.tmp	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\46f1db08-a9a7-4415-8fe8-2e06c41375db.tmp	setup.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3360_13421773626209212_3360.pma	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3380_13421773626315617_3380.pma	setup.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\msedge_installer.log	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\msedge_installer.log	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PO 4500272644 -R0-S - 254902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PO 4500272644 -R0-S - 254902.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4120	chrome.exe
5956	msedge.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	PO 4500272644 -R0-S - 254902.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	PO 4500272644 -R0-S - 254902.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134217736051075766"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-312252282-3884318443-358092420-1000\{4359F5A4-F1BE-4D0E-B8C5-868CE5AA402C}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
1732	PO 4500272644 -R0-S - 254902.exe
1732	PO 4500272644 -R0-S - 254902.exe
1732	PO 4500272644 -R0-S - 254902.exe
1732	PO 4500272644 -R0-S - 254902.exe
2532	powershell.exe
2532	powershell.exe
4064	powershell.exe
4064	powershell.exe
5048	PO 4500272644 -R0-S - 254902.exe
5048	PO 4500272644 -R0-S - 254902.exe
5048	PO 4500272644 -R0-S - 254902.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5048	PO 4500272644 -R0-S - 254902.exe
5048	PO 4500272644 -R0-S - 254902.exe
5048	PO 4500272644 -R0-S - 254902.exe
5048	PO 4500272644 -R0-S - 254902.exe
5048	PO 4500272644 -R0-S - 254902.exe
5048	PO 4500272644 -R0-S - 254902.exe
5048	PO 4500272644 -R0-S - 254902.exe
5048	PO 4500272644 -R0-S - 254902.exe
5048	PO 4500272644 -R0-S - 254902.exe
5424	firefox.exe
5424	firefox.exe
5424	firefox.exe
5424	firefox.exe
5424	firefox.exe
5424	firefox.exe
5424	firefox.exe
5424	firefox.exe
5424	firefox.exe
5424	firefox.exe
5424	firefox.exe
5424	firefox.exe
5424	firefox.exe
5424	firefox.exe
5424	firefox.exe
5424	firefox.exe
5424	firefox.exe
5424	firefox.exe
5424	firefox.exe
5424	firefox.exe
5424	firefox.exe
5424	firefox.exe
5424	firefox.exe
5424	firefox.exe
5048	PO 4500272644 -R0-S - 254902.exe
5048	PO 4500272644 -R0-S - 254902.exe
5048	PO 4500272644 -R0-S - 254902.exe
5048	PO 4500272644 -R0-S - 254902.exe
5048	PO 4500272644 -R0-S - 254902.exe
5048	PO 4500272644 -R0-S - 254902.exe
5048	PO 4500272644 -R0-S - 254902.exe
5048	PO 4500272644 -R0-S - 254902.exe
5048	PO 4500272644 -R0-S - 254902.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	PO 4500272644 -R0-S - 254902.exe
Token: SeDebugPrivilege	2532	powershell.exe
Token: SeDebugPrivilege	5048	PO 4500272644 -R0-S - 254902.exe
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
5020	chrome.exe
5020	chrome.exe
5348	chrmstp.exe
5424	firefox.exe
5424	firefox.exe
5424	firefox.exe
5424	firefox.exe
5424	firefox.exe
5424	firefox.exe
5424	firefox.exe
5424	firefox.exe
3388	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5424	firefox.exe
5048	PO 4500272644 -R0-S - 254902.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2532	1732	PO 4500272644 -R0-S - 254902.exe	93
PID 1732 wrote to memory of 2520	1732	PO 4500272644 -R0-S - 254902.exe	95
PID 1732 wrote to memory of 404	1732	PO 4500272644 -R0-S - 254902.exe	96
PID 1732 wrote to memory of 5048	1732	PO 4500272644 -R0-S - 254902.exe	97
PID 1732 wrote to memory of 5048	1732	PO 4500272644 -R0-S - 254902.exe	97
PID 1732 wrote to memory of 5048	1732	PO 4500272644 -R0-S - 254902.exe	97
PID 1732 wrote to memory of 5048	1732	PO 4500272644 -R0-S - 254902.exe	97
PID 1732 wrote to memory of 5048	1732	PO 4500272644 -R0-S - 254902.exe	97
PID 5048 wrote to memory of 5020	5048	PO 4500272644 -R0-S - 254902.exe	100
PID 5020 wrote to memory of 2604	5020	chrome.exe	101
PID 5048 wrote to memory of 5020	5048	PO 4500272644 -R0-S - 254902.exe	100
PID 5048 wrote to memory of 5020	5048	PO 4500272644 -R0-S - 254902.exe	100
PID 5048 wrote to memory of 2604	5048	PO 4500272644 -R0-S - 254902.exe	101
PID 5048 wrote to memory of 2604	5048	PO 4500272644 -R0-S - 254902.exe	101
PID 5020 wrote to memory of 4576	5020	chrome.exe	102
PID 5020 wrote to memory of 4120	5020	chrome.exe	103
PID 5020 wrote to memory of 4160	5020	chrome.exe	104
PID 5020 wrote to memory of 2600	5020	chrome.exe	105
PID 5020 wrote to memory of 1316	5020	chrome.exe	106
PID 5020 wrote to memory of 5060	5020	chrome.exe	107
PID 5020 wrote to memory of 4876	5020	chrome.exe	108
PID 5020 wrote to memory of 2756	5020	chrome.exe	109
PID 5048 wrote to memory of 5020	5048	PO 4500272644 -R0-S - 254902.exe	100
PID 5048 wrote to memory of 5020	5048	PO 4500272644 -R0-S - 254902.exe	100
PID 5020 wrote to memory of 2516	5020	chrome.exe	110
PID 5048 wrote to memory of 2604	5048	PO 4500272644 -R0-S - 254902.exe	101
PID 5048 wrote to memory of 2604	5048	PO 4500272644 -R0-S - 254902.exe	101
PID 5020 wrote to memory of 4540	5020	chrome.exe	111
PID 5048 wrote to memory of 2756	5048	PO 4500272644 -R0-S - 254902.exe	109
PID 5048 wrote to memory of 2756	5048	PO 4500272644 -R0-S - 254902.exe	109
PID 5048 wrote to memory of 4120	5048	PO 4500272644 -R0-S - 254902.exe	103
PID 5048 wrote to memory of 4120	5048	PO 4500272644 -R0-S - 254902.exe	103
PID 5048 wrote to memory of 1316	5048	PO 4500272644 -R0-S - 254902.exe	106
PID 5048 wrote to memory of 1316	5048	PO 4500272644 -R0-S - 254902.exe	106
PID 5048 wrote to memory of 4160	5048	PO 4500272644 -R0-S - 254902.exe	104
PID 5048 wrote to memory of 4160	5048	PO 4500272644 -R0-S - 254902.exe	104
PID 5048 wrote to memory of 4876	5048	PO 4500272644 -R0-S - 254902.exe	108
PID 5048 wrote to memory of 4876	5048	PO 4500272644 -R0-S - 254902.exe	108
PID 5048 wrote to memory of 5060	5048	PO 4500272644 -R0-S - 254902.exe	107
PID 5048 wrote to memory of 5060	5048	PO 4500272644 -R0-S - 254902.exe	107
PID 5048 wrote to memory of 5020	5048	PO 4500272644 -R0-S - 254902.exe	100
PID 5048 wrote to memory of 5020	5048	PO 4500272644 -R0-S - 254902.exe	100
PID 5048 wrote to memory of 2516	5048	PO 4500272644 -R0-S - 254902.exe	110
PID 5048 wrote to memory of 2516	5048	PO 4500272644 -R0-S - 254902.exe	110
PID 5048 wrote to memory of 4576	5048	PO 4500272644 -R0-S - 254902.exe	102
PID 5048 wrote to memory of 4576	5048	PO 4500272644 -R0-S - 254902.exe	102
PID 5048 wrote to memory of 2604	5048	PO 4500272644 -R0-S - 254902.exe	101
PID 5048 wrote to memory of 2604	5048	PO 4500272644 -R0-S - 254902.exe	101
PID 5048 wrote to memory of 2756	5048	PO 4500272644 -R0-S - 254902.exe	109
PID 5048 wrote to memory of 2756	5048	PO 4500272644 -R0-S - 254902.exe	109
PID 5048 wrote to memory of 4120	5048	PO 4500272644 -R0-S - 254902.exe	103
PID 5048 wrote to memory of 4120	5048	PO 4500272644 -R0-S - 254902.exe	103
PID 5048 wrote to memory of 1316	5048	PO 4500272644 -R0-S - 254902.exe	106
PID 5048 wrote to memory of 1316	5048	PO 4500272644 -R0-S - 254902.exe	106
PID 5048 wrote to memory of 4160	5048	PO 4500272644 -R0-S - 254902.exe	104
PID 5048 wrote to memory of 4160	5048	PO 4500272644 -R0-S - 254902.exe	104
PID 5048 wrote to memory of 4876	5048	PO 4500272644 -R0-S - 254902.exe	108
PID 5048 wrote to memory of 4876	5048	PO 4500272644 -R0-S - 254902.exe	108
PID 5048 wrote to memory of 5060	5048	PO 4500272644 -R0-S - 254902.exe	107
PID 5048 wrote to memory of 5060	5048	PO 4500272644 -R0-S - 254902.exe	107
PID 5048 wrote to memory of 5020	5048	PO 4500272644 -R0-S - 254902.exe	100
PID 5048 wrote to memory of 5020	5048	PO 4500272644 -R0-S - 254902.exe	100
PID 5048 wrote to memory of 2516	5048	PO 4500272644 -R0-S - 254902.exe	110
PID 5048 wrote to memory of 2516	5048	PO 4500272644 -R0-S - 254902.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PO 4500272644 -R0-S - 254902.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PO 4500272644 -R0-S - 254902.exe

C:\Users\Admin\AppData\Local\Temp\PO 4500272644 -R0-S - 254902\PO 4500272644 -R0-S - 254902.exe
"C:\Users\Admin\AppData\Local\Temp\PO 4500272644 -R0-S - 254902\PO 4500272644 -R0-S - 254902.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO 4500272644 -R0-S - 254902\PO 4500272644 -R0-S - 254902.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2532
- C:\Users\Admin\AppData\Local\Temp\PO 4500272644 -R0-S - 254902\PO 4500272644 -R0-S - 254902.exe
  "C:\Users\Admin\AppData\Local\Temp\PO 4500272644 -R0-S - 254902\PO 4500272644 -R0-S - 254902.exe"
  2⤵
  PID:2520
- C:\Users\Admin\AppData\Local\Temp\PO 4500272644 -R0-S - 254902\PO 4500272644 -R0-S - 254902.exe
  "C:\Users\Admin\AppData\Local\Temp\PO 4500272644 -R0-S - 254902\PO 4500272644 -R0-S - 254902.exe"
  2⤵
  PID:404
- C:\Users\Admin\AppData\Local\Temp\PO 4500272644 -R0-S - 254902\PO 4500272644 -R0-S - 254902.exe
  "C:\Users\Admin\AppData\Local\Temp\PO 4500272644 -R0-S - 254902\PO 4500272644 -R0-S - 254902.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:5048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffaad26c728,0x7ffaad26c734,0x7ffaad26c740
      4⤵
      PID:2604
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1908,i,20547764456213762,11067705230400993111,262144 --field-trial-handle=2124,i,13250596685174213107,4839966612434843009,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
      4⤵
      PID:4576
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz" --force-high-res-timeticks=disabled --metrics-shmem-handle=2272,i,7091271864719321605,5256284877026586462,524288 --field-trial-handle=2124,i,13250596685174213107,4839966612434843009,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
      4⤵
      System Time Discovery
      PID:4120
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz" --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,8220985501086826717,4107881979926004294,524288 --field-trial-handle=2124,i,13250596685174213107,4839966612434843009,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:8
      4⤵
      PID:4160
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3116,i,2676990037545129313,1155332952746724550,2097152 --field-trial-handle=2124,i,13250596685174213107,4839966612434843009,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:1
      4⤵
      PID:2600
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3128,i,14290326474750490355,3026778430636758551,2097152 --field-trial-handle=2124,i,13250596685174213107,4839966612434843009,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:1
      4⤵
      PID:1316
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3472,i,2983914077462213747,5979569465506097634,2097152 --field-trial-handle=2124,i,13250596685174213107,4839966612434843009,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
      4⤵
      PID:5060
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3560,i,56969695622536483,10691327368831773883,2097152 --field-trial-handle=2124,i,13250596685174213107,4839966612434843009,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:2
      4⤵
      PID:4876
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4276,i,4205064974290545941,5247136954570493499,2097152 --field-trial-handle=2124,i,13250596685174213107,4839966612434843009,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
      4⤵
      PID:2756
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4040,i,6296673183515710493,472274578728224908,2097152 --field-trial-handle=2124,i,13250596685174213107,4839966612434843009,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
      4⤵
      PID:2516
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz" --force-high-res-timeticks=disabled --metrics-shmem-handle=4388,i,7288015290444794725,5581643593376433450,524288 --field-trial-handle=2124,i,13250596685174213107,4839966612434843009,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
      4⤵
      PID:4540
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz" --force-high-res-timeticks=disabled --metrics-shmem-handle=5020,i,14997491656007410271,15771414260900140085,524288 --field-trial-handle=2124,i,13250596685174213107,4839966612434843009,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
      4⤵
      PID:844
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5068,i,205158781606663176,7670735345861032676,2097152 --field-trial-handle=2124,i,13250596685174213107,4839966612434843009,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:1
      4⤵
      PID:4864
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4980,i,5524346657513434387,17370626201769384739,2097152 --field-trial-handle=2124,i,13250596685174213107,4839966612434843009,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
      4⤵
      PID:2692
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz" --force-high-res-timeticks=disabled --metrics-shmem-handle=5224,i,14262064165916427756,15704306423981157810,524288 --field-trial-handle=2124,i,13250596685174213107,4839966612434843009,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
      4⤵
      PID:5144
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:5228
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x7ff69bd455a0,0x7ff69bd455ac,0x7ff69bd455b8
        5⤵
        Drops file in Program Files directory
        
        PID:5292
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:5348
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x7ff69bd455a0,0x7ff69bd455ac,0x7ff69bd455b8
        6⤵
        Drops file in Program Files directory
        
        PID:5380
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5160,i,5248858152538804860,11094323108556111103,2097152 --field-trial-handle=2124,i,13250596685174213107,4839966612434843009,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
      4⤵
      PID:5792
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz" --force-high-res-timeticks=disabled --metrics-shmem-handle=5284,i,16355059061275223505,8764408063317196009,524288 --field-trial-handle=2124,i,13250596685174213107,4839966612434843009,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
      4⤵
      PID:5800
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5424,i,12452052598591119675,10503139495828988089,2097152 --field-trial-handle=2124,i,13250596685174213107,4839966612434843009,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
      4⤵
      PID:5812
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz" --force-high-res-timeticks=disabled --metrics-shmem-handle=5108,i,3984004581810550802,3385100281419815370,524288 --field-trial-handle=2124,i,13250596685174213107,4839966612434843009,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
      4⤵
      PID:5820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5yvq2ebw.0xv"
    3⤵
    PID:5368
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\5yvq2ebw.0xv
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:5424
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27099 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2076 -initialChannelId {98ad6f78-10b8-4fc6-a22c-fc05e8d8f582} -parentPid 5424 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5424" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:5720
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2172 -prefsLen 27135 -prefMapHandle 2160 -prefMapSize 270279 -ipcHandle 2104 -initialChannelId {b8c4ba72-090f-4913-a4a9-f9fbf982c068} -parentPid 5424 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5424" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:5144
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\06b6c537-cd06-457d-8335-dc8ebac68a94.dmp"
        5⤵
        
        PID:5584
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2248 -prefsLen 27135 -prefMapHandle 2816 -prefMapSize 270279 -ipcHandle 2836 -initialChannelId {dddf8ccb-251a-4144-bf91-5214c3d83a66} -parentPid 5424 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5424" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:5516
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ee1eaa6d-a80b-4109-942c-12151ddb34a8.dmp"
        5⤵
        
        PID:5992
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2972 -prefsLen 27135 -prefMapHandle 2872 -prefMapSize 270279 -ipcHandle 3136 -initialChannelId {52716ac0-3b4e-4e06-bc4a-8573e55e6113} -parentPid 5424 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5424" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:6016
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a70ebd98-7e7a-4858-9455-56adcfe3ed52.dmp"
        5⤵
        
        PID:6100
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3312 -prefsLen 27200 -prefMapHandle 3308 -prefMapSize 270279 -ipcHandle 3380 -initialChannelId {e3dabdd3-c86a-488c-a9b0-42d06c19503f} -parentPid 5424 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5424" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:6112
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c72b338d-70c6-400c-a882-f93d37cd7b5c.dmp"
        5⤵
        
        PID:5132
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3380 -prefsLen 27249 -prefMapHandle 3156 -prefMapSize 270279 -ipcHandle 3384 -initialChannelId {60f2eb78-29c0-45f6-8fbf-bb20dead0175} -parentPid 5424 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5424" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:5140
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3912 -prefsLen 27325 -prefMapHandle 3916 -prefMapSize 270279 -jsInitHandle 3920 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3928 -initialChannelId {4cee25d1-1734-4086-8de6-2d4041642580} -parentPid 5424 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5424" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        5⤵
        Checks processor information in registry
        
        PID:5384
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\96fb6b9a-72f7-4d18-9366-0e6a709ea440.dmp"
        5⤵
        
        PID:3660
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3220 -prefsLen 27325 -prefMapHandle 3896 -prefMapSize 270279 -ipcHandle 3576 -initialChannelId {210f1ccc-a142-4c30-82c9-c1f1f754c59b} -parentPid 5424 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5424" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 gpu
        5⤵
        
        PID:5540
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9914e634-5821-4f58-bc61-84bc74eee4d0.dmp"
        5⤵
        
        PID:5960
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4312 -prefsLen 27325 -prefMapHandle 4316 -prefMapSize 270279 -ipcHandle 4324 -initialChannelId {65dd9600-4de4-4d8b-8f48-3c19f43dad31} -parentPid 5424 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5424" -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 rdd
        5⤵
        
        PID:1220
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2668 -prefsLen 34824 -prefMapHandle 2672 -prefMapSize 270279 -jsInitHandle 2632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3160 -initialChannelId {cf5a766a-39bc-4166-9f33-c30d0a03632e} -parentPid 5424 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5424" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:3840
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2880 -prefsLen 35012 -prefMapHandle 4464 -prefMapSize 270279 -ipcHandle 2552 -initialChannelId {c95ea8a6-cc32-4036-8c76-2a8977023f55} -parentPid 5424 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5424" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
        5⤵
        Checks processor information in registry
        
        PID:6688
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5188 -prefsLen 32952 -prefMapHandle 5192 -prefMapSize 270279 -jsInitHandle 5196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5204 -initialChannelId {ca6e64e0-a79c-494f-8721-b645373b84a7} -parentPid 5424 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5424" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:6844
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5324 -prefsLen 32952 -prefMapHandle 5320 -prefMapSize 270279 -jsInitHandle 5316 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5312 -initialChannelId {5e9dc40a-6149-49bf-ae0c-43cd296c42dd} -parentPid 5424 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5424" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:6860
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5080 -prefsLen 32952 -prefMapHandle 4600 -prefMapSize 270279 -jsInitHandle 5456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5552 -initialChannelId {dd17090c-cb56-4c89-8c97-ba3181111214} -parentPid 5424 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5424" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
        5⤵
        Checks processor information in registry
        
        PID:6940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:3388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x248,0x7ffaabbbc188,0x7ffaabbbc194,0x7ffaabbbc1a0
      4⤵
      PID:2120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1736,i,3452710746385081605,4893699554306892026,262144 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:2
      4⤵
      PID:5356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,5055370956627625584,9513222482209355158,524288 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:3
      4⤵
      System Time Discovery
      PID:5956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,5376423061269322960,12830834661423894792,524288 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:8
      4⤵
      PID:5804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3144,i,8214181150997814955,7954183483881945924,2097152 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:1
      4⤵
      PID:5540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3148,i,9529066774645403763,304618605624135259,2097152 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:1
      4⤵
      PID:5316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,6551203317195935419,13618421947750992154,524288 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
      4⤵
      PID:6004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,2287212400760752085,1452550056729687976,524288 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
      4⤵
      PID:4352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,8434487392550320236,11581989846291374967,524288 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:8
      4⤵
      PID:3768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3788,i,17774146355487651009,16886448340511174736,2097152 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:1
      4⤵
      PID:4212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3816,i,12149947166760885938,14277974164067902962,2097152 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:2
      4⤵
      PID:4164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3824,i,18129346756332865511,7779866455031586709,2097152 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:1
      4⤵
      PID:5588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3896,i,6074665268144661183,722985801465791160,2097152 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:2
      4⤵
      PID:1892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3924,i,1935657729589337991,469611980124653003,2097152 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:1
      4⤵
      PID:4140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3908,i,12071143544285677440,12022017942594262140,2097152 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:2
      4⤵
      PID:3252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3932,i,9850868742936893749,5372014608932112803,2097152 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:1
      4⤵
      PID:2984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3964,i,5203505083753737140,627706977490277587,2097152 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:2
      4⤵
      PID:5656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4016,i,17659671074276543656,7605598080164544567,2097152 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
      4⤵
      PID:6136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4052,i,4287430240799908436,16342976943306713945,2097152 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
      4⤵
      PID:1100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,5660800689312830900,3415653198205146136,524288 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
      4⤵
      PID:5488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,1357173699762754899,14047970900365541520,524288 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:8
      4⤵
      PID:2976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,10046941084346119658,1837761062780731977,524288 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
      4⤵
      PID:6880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,4859148564439396507,1818751199907120812,524288 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
      4⤵
      PID:6888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,806723538376247841,16915842571128562717,524288 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:8
      4⤵
      PID:6580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,806723538376247841,16915842571128562717,524288 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:8
      4⤵
      PID:6876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7024,i,11101718119112305933,12928536202406200297,524288 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:8
      4⤵
      PID:5324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7080,i,12309789389582726238,14728858122121736893,524288 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:8
      4⤵
      PID:4108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:3380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x218,0x21c,0x220,0x1f4,0x224,0x7ff7b4a904c8,0x7ff7b4a904d4,0x7ff7b4a904e0
        5⤵
        Drops file in Program Files directory
        
        PID:6952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        
        PID:3360
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x20c,0x210,0x214,0x1e8,0x218,0x7ff7b4a904c8,0x7ff7b4a904d4,0x7ff7b4a904e0
        6⤵
        Drops file in Program Files directory
        
        PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,14418480139765085717,15048090739073103478,524288 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
      4⤵
      PID:4288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,1446194818209878763,2961838681972189159,524288 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
      4⤵
      PID:5560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,1711128864760067299,3997485622043630035,524288 --field-trial-handle=2608,i,17610746926196251411,2552768075304217274,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
      4⤵
      PID:6696

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 7d134c2044469e4807c5aa3772ab53f41442829b91956991a7ea4ed581d5fe7e
MD5 fa04f5cd1c44d66d0ecd3c1e546f5506
SHA1 e3b54020dad44b177969a58b8ef975c0750e7002
SHA512 0d1226852f1765c4da01dc2525f4891b998f343fdef7e49158f7bf2e4a9c7b41c47022b30cbfb5318d30ae275b8e83bbe399cd074ce951935091e630734214c2
MD5 SHA1 SHA512

Submit Download

5228_13421773604996192.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5228_13421773604996192.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

5348_13421773604965893.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5348_13421773604965893.pma
Size 696B
SHA256 da9a8ae0c04da6ceae900796a026f4777895bf149eed2c495fbdae098362f596
MD5 3f5af086a83b749aa34a3aac1b986a0a
SHA1 0e67e17122beec914722d98cef0e669541560ff3
SHA512 0a12749b3971d0023cc1dd4f87113c94cc2c961ef824009c89a32ba24fe51de83357bb0757af7612ffb3a638302f5a298a2fc823dec8d117cf27255d2996191b
TLSH
T153010E49A3144F77CC828D3584FE27412BB0FA501B821BBF7B10724F2E021C9AED9168
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 8KB
SHA256 b75185d87852ef4f7e0c47f7368b82f7849d73510cd795b1ea21c0606810d3d3
MD5 d2d3bd4678740a66009b8673e127c889
SHA1 b4e2e1d8464a00268e3cfb21b5b3f8d3aa6df5bc
SHA512 2f703eaa5bb40ae7573b4120ee02a42b67fee3116f27104bbbc75b678a588e56fde9d3b5c7954bcae76802eb0c8c807d3cd9154b6080e4f253d95a89aae8e755
SSDEEP 96:oRaezWcv5u1m4KkhK3XK3OcuRl6BwSUhK27K2iEtkLJnfWknzhK37AK3lH1X0:fe6IuZkftlvlIzn92AyH1k
TLSH
T184129DD69F02446F3B839F6B325335656DAF240AC7E4A4B27BEF5106B4CA964002F1B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PO 4500272644 -R0-S - 254902.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO 4500272644 -R0-S - 254902.exe.log
Size 1KB
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
TLSH
T104219B303222B5D84D022F530C0869C513EF4759BB64EE2CB959231EDD2A457AB211E3
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3ac514c1986f0a12e0a441a2bc3df73a7fd40a7166ca0b641d42ad169ae81b58
MD5 6787ee58fd4f8feff85cb017d4a6da97
SHA1 809f664b06fc09b112d9d3b14f282ddf72a2633a
SHA512 9eb688c259519f36be2a41a611d900f423b7520cee793d0f3985b0eac107423b63453f8e8abfd3981baae3d3d646cde26d6c688062738b43fa5583ad9ad30377
TLSH
T12941289CB6E91144B3B76F1AAFF6B86E487E7D371E06905E10110E4F4A27B00C8A1B77
MD5 SHA1 SHA512 TLSH

Submit Download

0ffbfcb6-4a8a-42ea-af7f-fb1c8be93258.tmp

Path C:\Users\Admin\AppData\Local\Temp\0ffbfcb6-4a8a-42ea-af7f-fb1c8be93258.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f02e663-82f6-4112-8730-0a0a1f45eb3c.tmp

Path C:\Users\Admin\AppData\Local\Temp\1f02e663-82f6-4112-8730-0a0a1f45eb3c.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47cddfb9-4d42-4159-a5e2-18aa1efb062f.tmp

Path C:\Users\Admin\AppData\Local\Temp\47cddfb9-4d42-4159-a5e2-18aa1efb062f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_gpcnvxzn.i5k.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gpcnvxzn.i5k.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz\Default\Extension Scripts\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png
Size 1KB
SHA256 bff3a19327fd09a24c1aa4e7f34c508d7e668a8eb32f2cc7c33bcaa7e9ee2319
MD5 2f1881da261cfaea89605ee7a5e33e40
SHA1 fe61ed428aa3636adcfbeb66162f43f0ee091d25
SHA512 a9d8a4172c83030bf4472e900540b2ef3bbbb5e565c39f278cb8aae355354f063a4723c5ed8c3b32dcea45c70903271d170e56879a096b169697fc28dc768494
TLSH
T1FC413B2333F81ABFD81CD69BE465C8A50F395483DA39060706031CE8116343B19DDAF9
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png
Size 2KB
SHA256 afbfdd55b59a6385a28bfe27ef81ffae07f9d77b8c073dc299c6060b5d964a89
MD5 4d5d17c7e7c06b887bb383077131f50e
SHA1 8b29cf29af8358672e31bee5472025b7b07e7df8
SHA512 ccb20424ba2566e11a359bd04cbcb54bc21947bc254f4939c334f7db8c784a1da35461f60a1fc559ab5bde5cda443c82b633b8cc5bda89f5019b391148050be3
TLSH
T179515DED0389C698FB6F764206866917621D39F824EC51E09AE816A3EB101AC1CC1FD2
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png
Size 3KB
SHA256 02bd0f5d045eb5247e576d8151da19d36dc0eee7746c9a426d4dc92ee83125c8
MD5 aceb6eccca82014c9472e49e8b4b6eb4
SHA1 91d2c703fe33ea1867dd3d87b760aa2e5e68a55a
SHA512 b18d0edf51fb6245dc730b5aca21601dc40c762d6c3d96c950b38312406bce16fe7165e786bd0d6ee106d95c90139094bfc4fca08b0f37eb88c086606821ade4
TLSH
T111814D53467373A8BC788965CBCDD0EA8D732D594E4244F884CAD93429D54049825BDF
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 ccefdc2d816137b5954b591e8954c392e0cf27388fef2e437991e3999d9ad3d8
MD5 efa437b6fe5031994d5917a91c19990f
SHA1 d46a1115227ead4e92346b600c28e9ac72cce96f
SHA512 ab52261f15a3f21728b41b4765da5ec6c9e71051b720204ee2decf6f09ac8a0c9a5c12313d921f232f1e698a7425d34415eca8db21a37f423535806bcdf238bb
TLSH
T1F3310AC7644047BA52EDDAF37F6B0C57DC12210107D4A440599F56E17FEEEC86015478
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 bff87e21fa845d8ce3c266db6d904e9c7a3bf9fc2b95a1f1a5ca375f3fdb045a
MD5 097f67b0d583db3f8487ac27379c7eae
SHA1 18acf62fb9bc4e95899c4597cd72de66b6bef763
SHA512 0b6b323fa14e5b0dd6bb87fce791bbd0b7a867988d8332385ba76a35d93d4dd5b67f6be9be5a69fbdcd5da68c30bc840712daa83b9a0187b727d963dc9a9a045
TLSH
T15E514C54BEF34CB2EBC67C7254E65BF5A564C1E62D407A0C86B9CA1245BDD410CCD003
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 3KB
SHA256 abe4eaa1a6fa423bcef61b423dc72386a9cf1968b1041de5270c56a7780254ad
MD5 8e589c60e0ba95ca1b178bad0a8298db
SHA1 d981cd3f9eb63636471e3bd4c0fd7585460ad6fd
SHA512 e8c7b5d340e698f3b1b42d6c3b7653b666e0add095611c00f502782928eb788070ca977b54b42f9515127861e55138a3cc0f02540f0bc2e44694fb0ea595ee34
TLSH
T196517D1B4B8AC56A0E53770E02E57ED454996C569EF383CC2106E7C0081A99F43EBBE7
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\jehb2xxv.jsz\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5\Crashpad\settings.dat
Size 280B
SHA256 dc95f50b916f5977eb19b94bc1a565dea5ce6ade745ea26a8b1e502ef3328d91
MD5 cd5dbd587615ce7a4a830977698dcad1
SHA1 a515ad0dd768b3a474cc07c8ba9160d971e46b75
SHA512 1413a4718360fa7e483f9dcaab6a7c9ba6cb30d81b9305e7f7ecaae3aaab11f29a5e11b930cf1b8c7365c267a591ff5d38c228b57a5001f327eb6ba31c3f9d93
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5\Crashpad\settings.dat
Size 280B
SHA256 f1ec7485c4c131fe3219b4781d5a531cfa450955d34ea87b2f4d528c28358708
MD5 e4c19b8b8ce39b79147c35de5a1e0e61
SHA1 beb95bfa87c475ca4a362b35de9521c3444da118
SHA512 69fa347f72c9fddd4407ae764f7ef85c4065a59a3ce1725c53e5183589958d6f4f8e60f293191455f122900aa78e1899b4ed8eb18360905277b9f3e0e05c07fb
TLSH
T197D02470D1D53CC4F130CD71401457004D30F0C545010310F0D074C05F53100010C341
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 457f1714e76388fc60c4f5964ca7332f9f390ee802f749d625f170cdabc38cc0
MD5 7dcc2c02d95fdb9bf20e431944360c72
SHA1 1083928ad6899831a16535d21dd690704ec330b8
SHA512 299ca9c0d60587bb3cbec0cb79ad9938d0c8b2c365f8fd6bc59f05da3afc4824a7754932c6f837e646c2c49a4b252bb9e92044640479409e88cf8ef23b153260
TLSH
T159D02BFF58AA49209C7F43D64432909400837CA44E44AC5F905DB18710703727826C32
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 8dbf6261ac1ef34ce05327f52cc9e386b4f0a9d6184a1ccdcd84a5564d132b61
MD5 d5c116cb218a81dc458129f50f55877c
SHA1 25227fc0fc53bcad5f2640e36b9b582cead30589
SHA512 32e3128484e398a9f2b814f4959af554afa6a441c3d45f547ffcbc1e75b101a82fdccbc848f6a766a0272a69a25cd640cad6675597d1576d5d3f7fa453d7ca51
TLSH
T153E0C0FF6DFB1818AD2F83DA6032849400427C98C944EC4FC02B71C720B1320AC25C3B
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59090e.TMP

Path C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe59090e.TMP
Size 153B
SHA256 c29cc900ef9e774636b57f86ea828d27a85e82f8cd1ae294354f8fb16488b2a6
MD5 d22bee4087d38ef53952d2b027b957ae
SHA1 9b145b03b1956b401bdcc277b6cc2bbea60b730f
SHA512 25cfd8e831c5b6708c1cb8d9fffa6b6ad58c7d74f22628cc408ed9dfc5d36b36124498eadb2cc9140fa828dc598a0377b0662d6e79af59b9e5101e702e8eda08
TLSH
T133C08CFB2CAA8C04AA1612C6003284E881133CC44A84ACAB801EB1DB21302327822C21
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5\Local State
Size 4KB
SHA256 7c70aee53db7590f3c05fad0b94db23baad0997962fc61d01069b461a54ff9cf
MD5 23b0704985c791283db2133d2d702feb
SHA1 5d9dd2ce78cfb3684342288f139554f49fc45624
SHA512 9e27d01f096682ee5afbd50b99cc5d4943697f211c6e0b5b03defa3f86576c641c6ce4e944946ff2b11d5f5b4cd34ac16b36734c60f1d4db19e47d9ab4d528b1
SSDEEP 96:qqGNknsFfK01AHi1hODRBIP7veFbJxa0eUnJQFjuq4a:hGNYj2AM+n6wbJoqJQX
TLSH
T1CB81EAB13828EC2356D55948B48932A34E3475B3DE41BF9CD9D8571C04EB35C3B0AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5\Local State
Size 7KB
SHA256 1a72bdf0ceb7a0aabf2f2463ce7051589dff138841f4ed72a27d47add4a99093
MD5 691c6e8a0e287a85bd645b597c63a36c
SHA1 f6e5dcf699324c16b720d68978ca91173c74949b
SHA512 cd605a190224e1fce8ebf781106419c908881a306cccaa4aadc4b01efa1a9d9f26879369f99210a61cd75fa20280c0accc2d36ebf97283b077ee3c330696f273
SSDEEP 192:uuOL8Nlc2APw/roDUhN7xTW4oqJQRmXHeUn:nE8NlKxIN37veS
TLSH
T19BF1087A6878DD3349EA9588B54936536EB47473D9807F9CD9EC5F0D04DB39C230A807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5\Local State
Size 5KB
SHA256 fd23ec1c8d155a0a4097e56950cdf7365f1321d86523b35a196c2c8c08b7e1cf
MD5 343033034abfb70420911d54a9276495
SHA1 fc64179a50061b1e7845f21061f8ddd4b51bc4ee
SHA512 5c67b401e042ff6313fa30140e077300fbd0a28ab34df418ae28d322450d25193bd673419a14d7b93136b4df771f69b80ac7d664a486dcbc07ad559730ad6f2a
SSDEEP 96:qqGNkYQsFfK01AHi58Frh/cInURoDotovE5DyBIP7veFbJxa0eUnJQFjuq4a:hGN0j2AZooDUwCS6wbJoqJQX
TLSH
T14AB1A8B16878EC275EE59948B4C523636EA43577D984BF9CD9EC1F0C04E7398270AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58f5f4.TMP

Path C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5\Local State~RFe58f5f4.TMP
Size 1KB
SHA256 c5eeb9812d60abf44f7540c0cbe73406fcfd59805ba6a2e6965f58f6f14a767e
MD5 0889fd35dd68a0e97782f738c5484ae4
SHA1 903fb6663147d59cf01b683e301342eb22684f5f
SHA512 88fe4d738214aa47a4bdbf7ebe7b5563ca20dab56317af6b6e4aef6dcf15b2688bab7769dd0ac6f0407d707d79c9cb2b9ba2cce5895ceb938f32f56bf793ec2e
TLSH
T1EE3174B07CA8BCB7A9D04688A289B6631E357677C3917E8C89EC4D1C19E339C5116C37
MD5 SHA1 SHA512 TLSH

Submit Download

cdcc8ed7-2e33-4004-aeb5-a79c5263b0ca.tmp

Path C:\Users\Admin\AppData\Local\Temp\ljmvue1n.fj5\extensions_crx_cache\cdcc8ed7-2e33-4004-aeb5-a79c5263b0ca.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3388_1981210404\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3388_925246544\CRX_INSTALL\manifest.json
Size 1KB
SHA256 609995e8dbdba5ba968a6c604750e725059902b4e8c1f693851c738d3938317e
MD5 8afea622647be84467127ef5cb12745d
SHA1 dbbecddc500f406b199dabaa7cd38b1bd3d34557
SHA512 51e562c06c99d5a7bdc56df7b61d8b420a42e18e46d9d7ba182c07ac6fd671f68b9c65c0a2356d4ab17e7c6b4f22920d94f57514ac831a46d0fd60450a98034a
TLSH
T1744169F7BC00AD634BA49898AA1E710EFB29B24D55CFD4DB8298107342CCDAE1D601E5
MD5 SHA1 SHA512 TLSH

Submit Download

afd572c6-6891-49e3-b1ef-1b5084f01059.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5020_1757183663\afd572c6-6891-49e3-b1ef-1b5084f01059.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Google Chrome (2).lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome (2).lnk
Size 2KB
SHA256 663e994bc3a90f557e88f78a6b479dba0e11ae9316bf0915cccfa7ea8810c2a8
MD5 aa1bf67a0a719bbcae3f0a4ad9eabb7c
SHA1 f661a159fa444e1bed7dcb991c45514aa2027c2c
SHA512 d7c311f11e41f76ba257ce76a36370cadb5041d2e91c1f1ba8b51471a75d5473219d3247c28743d123b4bc3ae19a2a393e6d92239acc6389c151d4dfec45c9d0
TLSH
T1BE41AA02B7F90B28F3F39A326DB237A10FBBF823D6645A1E5094424808B5A10599CF77
MD5 SHA1 SHA512 TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 28116bcd37145d9a38f7f886a136ece8838636b1650a314062ee24b3025915aa
MD5 d56947025eda97767d64af7d35fdb004
SHA1 5c43a92bd26498e3c4e9826b65d5ae6f0c4f51c0
SHA512 3187f90d40e105c5cfa26b881159e9fda2406c2645537ef318a145d23ed6a4acb7b3f1b5deef6bdda4c1766aba933ddd526e8dfc76e104fb3615068dee3b1860
SSDEEP 48:o1kgTdO0GGAMTaJ9zCNYBQdLXuHp1ppQ8kgTdO0GGAMTaJ9zvYBzgdLXuHp1A2z:oeVJoXuJP6HVJvaIuJR
TLSH
T1EC91CD40ABDA1656F3F7DE7295B37B116B7BB9099A084A5D008042181C73B04DABFFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HANQYBGnTHzm.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HANQYBGnTHzm.lnk
Size 1KB
SHA256 5130cba120ff2be16c7f62b9a1bb0ddc10fb078d94b421475d09d31fcae3a260
MD5 ca1edb9d6096d5782c77f361ce521a59
SHA1 2cfb7919c04fcaf9f76786096f2cf034f2b50638
SHA512 7596ea79736d7028e1816bb82606016eb90a4be13f827089206bfd9379ba5381bd8924804fcc48df2f72bf021137796d031c0d7f1409bf28af45755103b734b7
TLSH
T12B31BB141BF51718D7F7CA3CA4FA33225A3ABC11ED664F9E1080C1984C55624E964F2F
MD5 SHA1 SHA512 TLSH

Submit Download

06b6c537-cd06-457d-8335-dc8ebac68a94.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\06b6c537-cd06-457d-8335-dc8ebac68a94.dmp
Size 60KB
SHA256 656afe3db7e77a638000c5b2298f8edddbe875afe68f89906161c19522a56ecb
MD5 0b9c34887cd701cb7579538bb1c5858b
SHA1 346f5f07b87fbcd1cbd8edaf3b7509c36bfe1b66
SHA512 51861022b7fe359b9cf84e80bbfbee468fbad4005e7790dba6d28c473743fdf9851733d2ae71fe995c75758e8d11ba5d591513fe04eca7e3ed0352740b6d78fb
SSDEEP 384:KzjFJryjUcwhfZBi+y5438C9wDCiReKk:KzjFJryjRwhfy543XwDd
TLSH
T1EC53AA5BB7D8083AD53A4B3899E767223FFBF8200793C79B020051BA5D677486E71E25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06b6c537-cd06-457d-8335-dc8ebac68a94.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\06b6c537-cd06-457d-8335-dc8ebac68a94.extra
Size 1KB
SHA256 1442df29c05f15a666df8a4b65d565bbff586bc4764cd58773b1e1fabc99cdbd
MD5 eab80848d21b15b5e8a24e4658b3b1aa
SHA1 57daf2d7d4155e0cf75d0a56098dc648cba0f9f1
SHA512 74875de28f857b9e71ca67b38c48fb0c5ddbbd737a7a960eae1e45e63a88ccd81b2a4ca3f5b23c8ae81e13b074071185398474ca2f094803c6e0d0cfd441c0d8
TLSH
T1AB3174F381EC6D1289674A99773F230386A9B33304D31D4D24CD4A4C818E4DC92269C3
MD5 SHA1 SHA512 TLSH

Submit Download

06b6c537-cd06-457d-8335-dc8ebac68a94.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\06b6c537-cd06-457d-8335-dc8ebac68a94.extra
Size 3KB
SHA256 587787f70799c00bc3e1f0b8be3841e21928c684273f90945e6d7cf6a8eddf95
MD5 3469983055ad689984fbd2ef4b112a98
SHA1 5d52ad3cdc403ff4a68b8cb84ae3ed1d5d995c2c
SHA512 1f57ec8e681fd84ac22f6c2b16c94d2d9d22f75034c46f62085fa3b95eb456f2e30126db461025f3a8b7eee3feb4eca120f579521bd8e8f4e7191f3722055bd5
TLSH
T113812031109CDC275EEA5DCEB3376D1D899EB36998623A8C50CAC75C45BCCF46386143
MD5 SHA1 SHA512 TLSH

Submit Download

96fb6b9a-72f7-4d18-9366-0e6a709ea440.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\96fb6b9a-72f7-4d18-9366-0e6a709ea440.dmp
Size 62KB
SHA256 52dd929240ef7968f63b209968d655680e587c42ef6ef5ac93ef2e9ef9e0a50d
MD5 4c0dca2b31397cc7c147fa9eab665824
SHA1 ccaf8ce05d0efaa8ce8331e984145e6db68b1c82
SHA512 f0e3dff09bf48229f5f6b0c44ba058a7888fe4ac71290a67527f2cfbf7331f5dc39d0a8f3a3f65542319f9bde2065e54520a2cefb91b2d565e32fb7ab89db866
SSDEEP 384:wkF/hgFmGgFmPgFmTU1W/QuOBrZpIrILusuCxLGKk:wkF/8I9utrID
TLSH
T12153A937A7D80C66D52AABB8B5E7A3113BFBF8240793CB9B060051BA1C677486C71E15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96fb6b9a-72f7-4d18-9366-0e6a709ea440.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\96fb6b9a-72f7-4d18-9366-0e6a709ea440.extra
Size 10KB
SHA256 04fdea83620eb496035cc5f88476b25ead981553becf65ef57a857d3ad67c042
MD5 12281a5eb71fe487a29606805efcc0cd
SHA1 edf698a0f1681d24c8035b3f0b1014bb41c1e710
SHA512 60c9e33257d225c2d2c6dfa21b492254b17be13d1de83b680eec2bf79f35f89b8e142fdef6a8445ef1eba1fdf03b9468f0f80027353bb0417b48cc3e86b49ccd
SSDEEP 96:S7WC21T0TY6pw6FFFdW6H0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7aecBvtILI5qwX:ShuyFLG7uvZ8RLVxsPpwlO3foX
TLSH
T168228353878724B79D5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96fb6b9a-72f7-4d18-9366-0e6a709ea440.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\96fb6b9a-72f7-4d18-9366-0e6a709ea440.extra
Size 10KB
SHA256 ad1b9c37f676f0945904bf108c1d8a57457ac5d970de68eba6650b63bb01d450
MD5 016bb11e85a02c11193fef21fe07d413
SHA1 9770aa183f5b728f61b95a84a40d00dd1ace6e40
SHA512 b9bdb3646cb8cc0ba637b121b7e91a8d0d9fb34be53aa396517803049018c15b063492e5d2ceebf9273fa7c3c155b02fc2613411eb0150be57445820c1203ce8
SSDEEP 192:ShpcFaiR4pmnTYapdVxzPjWBH84TofKNdalW3fobbLVOwq:epcFaiFz1LWBH84T3ayAbO
TLSH
T1C632E921081CDC37E7D76C8DBB3A2D3AD66D7B2A10E6789C40CCCB49C1A9878A779517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9914e634-5821-4f58-bc61-84bc74eee4d0.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9914e634-5821-4f58-bc61-84bc74eee4d0.dmp
Size 65KB
SHA256 3280bf2ae0ef0dc0f013b850c84ea0b863b1037d8cb6d714fc5f86511957f2e9
MD5 d76a39e14dd6dc30bdb6c2d685b5f503
SHA1 8297d84dec7118a327ec6d46aeaecbd4b26145c8
SHA512 0b2ec422db9b7c19fc882eeb3b094417f844ad1c97987f3f25abf8f37dd8592ebda7fcc8f1b7db3fec18c076403f0d47aa8ce87597b844ee62c7d1ce203e34ae
SSDEEP 384:Iy7awYwFmswFmbwFmWU3Z3Fsgiocoe/37gFF8vvwKk:Ioaw8khy/3E
TLSH
T18F630C17B7D80426F1A60BB854E76750FBFBF820878357AB124251BA1C6734AAC3BF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9914e634-5821-4f58-bc61-84bc74eee4d0.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9914e634-5821-4f58-bc61-84bc74eee4d0.extra
Size 10KB
SHA256 18d1241805a5d9862ff7720a8d3f36445c50c95633c302d966b7083b8d997b7e
MD5 5467fb912a6115e82b3994713291dd8d
SHA1 abcd2015b0aabfa3def2f5aeeb85131d0b70207f
SHA512 b3bfb17b07fd564e713f35ba0318f694f6d483dbb8d4b420d7de3673dc1e45b8d96e1e92aed1a63a5c5a5c2d6286d0d689cfbc11895c9dd3be45a445c42673f5
SSDEEP 96:S7WC2b7T0TY6pw6FFFdW6H0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7aEcBvtILI5q+:ShEvyFLG7uvZ8RLvxsPpwlv5fow
TLSH
T1F3228553874724B79D5198C4BC30AE7C45EC6FAA51F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9914e634-5821-4f58-bc61-84bc74eee4d0.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9914e634-5821-4f58-bc61-84bc74eee4d0.extra
Size 10KB
SHA256 b272b181740c3eedd02fff8c0a943918a8f8eff29a56e86a27b3aa9c7aba8a6c
MD5 0c68f3c108fd304649969653def9b88a
SHA1 345b6428b1e2ac574ba43e6d7d37702163e8a88d
SHA512 c60060796c013c84ed4a129fe16a6eba761bf4a78332907f41afd58f510a77e375b797a1abb0cd08fee1bd2cff1f71f43163c8d52ceb0401b38b3966d11e029d
SSDEEP 192:ShEOcFaiR4pmnTYapdVxzPjWBHW4TofKNdal35fowbLVOwq:eTcFaiFz1LWBHW4T3arAwO
TLSH
T1C132E931081CDC37E7E76C8DAB3A2D36D26D7B2A10D6789C40CCCB49C169878A778517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a70ebd98-7e7a-4858-9455-56adcfe3ed52.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a70ebd98-7e7a-4858-9455-56adcfe3ed52.dmp
Size 63KB
SHA256 b09d26a47e53b2c0846d4339417be138df34a75c681fb6200cbf4238413359cb
MD5 8f06e2610dfb8fec5fbc0ade28cfcb18
SHA1 ac3c9d82f797778b81c86a49ad640bdac1b02c0e
SHA512 cd6d3759f006bd534c5546064bcfd82fa6f2d7ede96c26ebf6e6f761a0534c163ac77b4eb1565fd8401ba171fa44392b216514f0c7a0e2b240a37e1d4de08232
SSDEEP 384:yFS2xa8jnFm50nFmEnFmaUhKl+jPTrVQ1oHL9ZmKk:yFS2a8D7l+LVpL9Z
TLSH
T1E153CA2777E8086BD42257B598E763127BF7F8141B93479B2A0072BE3CA73485C7AE11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a70ebd98-7e7a-4858-9455-56adcfe3ed52.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a70ebd98-7e7a-4858-9455-56adcfe3ed52.extra
Size 10KB
SHA256 d9eb9f7f6f491857a6220a7d2e07c15ceb70707f5aeee6caff24f5026192ce31
MD5 61aba28006decadd9b41c365927e618b
SHA1 203a73db7d9e9516dccd643f081b1e646b727191
SHA512 9c26ecae93b577df1b128c23ba28782142a8127f45391924228ad579c99919495b440fdbfe5163c60a3ca917c756b8a886d4a0c75418b89eeb0613e881e6988d
SSDEEP 96:S7WCxT0TY6pw6FFFdW6H0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7aXxcBvtILI5qwY:ShByFLG7uvZ8RLKxsPpwlPJ9fogY
TLSH
T183228353878724B79D5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a70ebd98-7e7a-4858-9455-56adcfe3ed52.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a70ebd98-7e7a-4858-9455-56adcfe3ed52.extra
Size 10KB
SHA256 34d66897a42c0479d65c563bbbe2525c56f366bdeb34c3a93f495e1e20af3890
MD5 7c7c4c7695619783b697ee6453a4b7e9
SHA1 88589b4ba3cc0ad005d439160b233bddc8d67370
SHA512 58c5b755b6a53be54e2309a4ee62debc518e0f66480c99031b72bc2c0a1aa9ee7178739163ac4d412fac3e4a9c3f94031168aab333413d7cc7f5720a3f48a7da
SSDEEP 192:ShIcFaiR4pmnTYapdVxzPjWBHv4TofKNdalnJ9fog43bLVOwq:eIcFaiFz1LWBHv4T3aL9AgoO
TLSH
T18E32E921081CDC37E7D76C8DAB3A2D36D66D7B2A10E6789C40CCCB49C1A9878A779517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c72b338d-70c6-400c-a882-f93d37cd7b5c.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c72b338d-70c6-400c-a882-f93d37cd7b5c.dmp
Size 63KB
SHA256 d42f606c48d6043d085667e2fef5e2f992f8ff1ba9efdb6bdd3a5bc08efa5c47
MD5 7cce1d94e6f366852b1c8da437015fcd
SHA1 55529dafadef9649175f3a58223b0bed895adf83
SHA512 904dbdd8f6c543bcc0f4e1de3caaa406d954d3fab0553cac3967670d483fe7af9710cb4946fbff2665f46ad5ed005610416da2188bd42a2ef82d1fa3de731d5a
SSDEEP 384:SFfaxYtxHEFmEHEFmZHEFmoUGPpuBPaXUn30qo5mFL20YexM1BXrfKk:SFaxYtTTuKUkqGmFL20Ye619r
TLSH
T1FD53DA17A7D8186EE4364F3995E76354BFFBF82007B3479B029091BA1D673486CB1E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c72b338d-70c6-400c-a882-f93d37cd7b5c.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c72b338d-70c6-400c-a882-f93d37cd7b5c.extra
Size 10KB
SHA256 7cd9f083cebd5fb7eabdd1a36a1c1dc867c9a8c5c5ffb81680a46cffbc3406ab
MD5 f8ba30efeb997d4a4572a02788d53fa0
SHA1 a3cb26079f73a67cdafac31ca100fa3e997544b8
SHA512 7ded94b0e65002673990850570a0e48152032f139b335dbd6f9d239689082f766c2bed7dc6c969ff180990523597736b2c388ff4b504e53a95fb5115b63779a6
SSDEEP 96:S7WC02T0TY6pw6FFFdW6H0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7a0cBvtILI5qwF:Sh0eyFLG7uvZ8RL/xsPpwlWLYfoG
TLSH
T1D6228453878724B79D5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c72b338d-70c6-400c-a882-f93d37cd7b5c.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c72b338d-70c6-400c-a882-f93d37cd7b5c.extra
Size 10KB
SHA256 5e6fc0d5bbf69404f65c80189279a18be6ffffc063c9724ceb3ccc2508236409
MD5 a21d195e90ef05ec97d7d2af73b64bfb
SHA1 ac5162b921c45bd7c2dd870268860fb0fa5aaeab
SHA512 6a6a9b9ca6343fb5c3ff6f890a3231523e8d4f1162b8413308e0e08cb0e04e25776e97d93ecfa8c672cc43d63a2374d5a6724dca764333817e44b9186b171a01
SSDEEP 192:Sh0ZcFaiR4pmnTYapdVxzPjWBHa4TofKNdaluLYfoebLVOwq:e0ZcFaiFz1LWBHa4T3aE8AeO
TLSH
T18432E931085CDC37E7D76C8DAB3A2D3A926D7B2A10E6789C40CCCB49C1A9878A779517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee1eaa6d-a80b-4109-942c-12151ddb34a8.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ee1eaa6d-a80b-4109-942c-12151ddb34a8.dmp
Size 64KB
SHA256 19f8520be27342cba4afac121b2afd7d1f67672aa942ceae4b4730fbacfdd48c
MD5 60dd43560919cb3fc5113ce75c3f84b5
SHA1 a35cb0d5dd28b365b6af02608d8d67c63c5d9ca5
SHA512 c4fe5dfa02fe17b4c32a92b19c9bdd913d83b8de553a1491a4da4fbfb827de6c19797a349ec9bb95ea48ff1d7d450df8bcb6446d8dd34c945b8e6d21c3da4924
SSDEEP 384:inVZaMPEpeY+fPFm1PFm1PFmIU3cJQQeY+Qs8fCMPb66KW10Kk:inzaLpeYysQeYhNfNP+6
TLSH
T16853BA1767980876D62A4B37B9EF63103BFBE859C793A79B0210D1BE9C673486C70E11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee1eaa6d-a80b-4109-942c-12151ddb34a8.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ee1eaa6d-a80b-4109-942c-12151ddb34a8.extra
Size 10KB
SHA256 fee4491c7bb62f09eb3d0adac211394a4bd30fa427ec37ab9bb8092d7800efcd
MD5 f62c5e23aea85e6f1e201cef95127302
SHA1 609511523a35aa2a8c766ade8a4755e58f19b7ea
SHA512 310598d02d3e5411012fd7999504b5732c55593634804e592e1e03001feace3bc81441f258c55ec47cc1b03a7f2d1e2fac49d97602b0e094d3956ab51110150a
SSDEEP 96:S7WCrT0TY6pw6FFFdW6H0Rh7CTvBb1d0FjMLlIrLlhTLlaXv7aLDcBvtILI5qwvT:Sh/yFLG7WvZ8RLsxsPpwl8ifoS
TLSH
T1A7227353878724B79D5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee1eaa6d-a80b-4109-942c-12151ddb34a8.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ee1eaa6d-a80b-4109-942c-12151ddb34a8.extra
Size 10KB
SHA256 11e7bc109f1021623ccc25285aed2c316407695db7c0f46992d8f62c72987ade
MD5 b679cb298e2cbacdd56c0c60a48671f2
SHA1 0248ad30167773fc9ab2c68b1a0fcac485654bac
SHA512 1c338549782ba0e58b6270781a7b245306cf37aaf1cbae9b01398fd3485f8529a3eca13e7e29ec7a425c4499777a8a43b19067d83880a8ee50d8429cb7d71ef4
SSDEEP 192:ShecFaiR4pmnTYaVdVxzPjWBH14TofKNdalUifoibLVOwq:eecFaiF/1LWBH14T3aFAiO
TLSH
T16722D921081CDC37E7D76C8DBB3A2D36D26D7B2A10E6789C40CCCB59C1A9878A779517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 a0768f5622b50b6696de46ad462ec4d1a5726239e0279826694cb344d1738ef7
MD5 0372a2dc87084e5890e40977a1f4e97d
SHA1 33d79aaea0d8d1f0fa8278cfcfc445ee2ac4a596
SHA512 18402a14a90c1a76b9ba1d97568b1769210af582c860e501367d4adb51f7f51a29360159a383c716c38b5fdcd7dc75395a11158f9d2a390dce73fa6cba813d86
SSDEEP 192:Q01d66JozGzgCl6mc0dvOv5zbowby0yjgjI:Q+d66JozGzgC1j+bowby0yjD
TLSH
T131E11D64FA38463FC448427BCCA60B410F3A394BD88E7F15359DA1082D5B2DE7A8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 07779782125ad4dc1ef1aebd97053ed0ea03bef5e822413d0e56f45d0e90d24b
MD5 c3089514c8e25d7c8db401f3e5374bd9
SHA1 e51e4cd613ea7648b5c2993cc23f2fcc2c469378
SHA512 84471fc1a6b0784a5e9ab265b87f79bf66fecae174a523535c541ccc3df410c26d0c157b38a88fbc6bfe653191255662b1dfe631990f58f3a579c0e984c4ca7e
SSDEEP 192:de1d66JozGzgCl6mc0dXOv5zboP4Zy0yjgjI:d4d66JozGzgC1jCboQZy0yjD
TLSH
T14EE1FDA4E629863BC408427BCCA61B410F39398A988F7F15359DA00C2D5B2DE7ACE17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 ae070816c68b7da2beae87cf42dc2349d95761255784700702ed4a2c69b93b5f
MD5 12b1ac2f378469f9533f5d00b0beda5f
SHA1 f9dc51bdc1cd029ffe83ae3087d590e3502723f2
SHA512 2112d6fd8cce77450613efdb8ff3738e7cb96939aa78f0d8e3c6720f9ffe75a8f70270755dd97d4c6829b798bf7682285c7397feb9b84e897cbf12871af576ea
SSDEEP 192:Qe1d66JozGzgCl6mc0dpOv5zboQby0yjgjI:Q4d66JozGzgC1jYboQby0yjD
TLSH
T1F2E11D64E638863FC448427BCCA60B400F3A394BD88E7F15359DA4082D5B2DE7ACE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\events\events
Size 1KB
SHA256 3add43f0fc2c41af9c5b69b1d261091ca1e334d6ac93c89bbc7926809ac3cafd
MD5 ba681b02910252310ea2ef58973fc031
SHA1 1b3628779c0fb940d3052cb92caab754e64b4451
SHA512 4eb91bb1885c476ec64b46890d69106fd1fc83d410b3768e8d3f50e7a47d193bc7659cd390730e68093e045674394798f46fcd30905cd27de3ab752c26b9fcaa
TLSH
T1D1116D9C7AF88D2A989BD29CB446058E53634E0205C71D434D22DECDCDC4ADA322E43D
MD5 SHA1 SHA512 TLSH

Submit Download

2f2cc96c-eede-4094-bb71-bbd2fec246fc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\2f2cc96c-eede-4094-bb71-bbd2fec246fc
Size 896B
SHA256 d0ccb7fb69f5ee12b72f09a7fd4662b2cc13f6e24b11c62fb3eac92531b1b6ea
MD5 7b6949e071226ed24470b40f8f314e8a
SHA1 f9adfa2dd0f5fb5c74bd771c1d73805b5e8f8ad2
SHA512 55ef85f52820230bcbd5cad3677d115c4a9c13463c4f18db1e74e6ba9c5cf3e22a6f3f12d33fcfe10b9d3bd203a947b7ce8bd400eb6f695761db1d91c3ca95e7
TLSH
T14B110491977579B2CC68D3979491774247E47613C0CB49147EA28A180DBF11EF79B30B
MD5 SHA1 SHA512 TLSH

Submit Download

5b24c6a6-ecfc-4327-b4ef-36644ac4f74a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\5b24c6a6-ecfc-4327-b4ef-36644ac4f74a
Size 235B
SHA256 56a79ba18279498ae94dcb07010aacb5d2c81d1d4d8bf72aa2964249cebaef3f
MD5 921ee3ef4f9e73ee1c03ad5970d2d6bc
SHA1 af7397ebec19c727e041016f4ed98692c220c4c6
SHA512 12c82501a9d894af6dbf6901a26a622d10374858502a3c2235f7bb2246187f7f0ee875d3853daacf386804ffcdc5e06ebe9ae0ae44377fa2b546196f6aa88656
TLSH
T1F5D0979514986B2D48050F03B1E169C330484C335060A860E9A205389AFEAC84221C27
MD5 SHA1 SHA512 TLSH

Submit Download

6e7ff308-c83b-4405-adfa-b279adb9a439

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\6e7ff308-c83b-4405-adfa-b279adb9a439
Size 2KB
SHA256 7470f9429de94c05cb150be809b3e075cd829d340a0d202f992772ee5a42949b
MD5 037eda101b33261c5c78ab8b93c58424
SHA1 21a1229fdc7462a0029fad62e2fca0a108662a6d
SHA512 791b6808e7b25b3037c86a63f3fbf460254d82c7f64eb76e06fd9110f40fa9b39485f864925c9cbf76e279f45325ddd1fa014018a6fc0afbf882a77605747a7c
TLSH
T19041016836784C7B9CCFF69DD492278A53A5890340C61C532E62CE0C8D966EA736B52F
MD5 SHA1 SHA512 TLSH

Submit Download

9333ee97-c25c-48ee-9230-4cc9d25e8248

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\9333ee97-c25c-48ee-9230-4cc9d25e8248
Size 3KB
SHA256 0f90caaf1a1517af2422adf084197347fa6d7a49227b1ccb4506b3e21d8bf431
MD5 194d67a7200d012a242db78e0d195714
SHA1 731fd8e1231007ddcfd2c1fe55b074022b095125
SHA512 b92f5ab5aec76784d133c6a43a903630ea13d3917fc92de1574ad777efa030f7dc9cf00bb3971cdeebeced5d708f40abf4c03584d0120a0be4f6699b37610194
TLSH
T15A61952015646C738FE8A144A37769448BDE33EF584B1BCD11A6CF2486FC8684BCB35B
MD5 SHA1 SHA512 TLSH

Submit Download

9d02b1e8-187b-428e-b3a7-f40c8da0197b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\9d02b1e8-187b-428e-b3a7-f40c8da0197b
Size 3KB
SHA256 a13bb16dc90713d0055094f62ab8d0f49aa523d4c752ab4b5631f0de6b4ae769
MD5 f598a2d5600dd7008b04a168dcafd4b1
SHA1 f79795ce34f75eb38ffa16389af8c862bef282bf
SHA512 833b1eb433ab60bd07dc30189f0460f2cf826835ae14f100ce768aa7fcf7a42b6eda46e80ec4ef8c0777ea6ca456c1eaa80056c3bb475bf4bd5854bd25db1e72
TLSH
T19761752115646D738FF8A14093776D448ADE33DF544B1BCD116ACE2846BC8684B8B31B
MD5 SHA1 SHA512 TLSH

Submit Download

9d04a8c6-6692-4ab3-9e06-b3ee2647abf8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\9d04a8c6-6692-4ab3-9e06-b3ee2647abf8
Size 235B
SHA256 31ca3e11d6715bba13264979b92e42f41b1d34f437e7d4773f43d63277064dc3
MD5 de541687750db8a6292e9726403044bd
SHA1 bcb14a888c47eccc9024c7b32bb15d6fbae102be
SHA512 199eb17626620fab7b98599682060bc3277395091cb836403cdd86c781c5e585ef0384d79816dcc396dedce2e675caefe51b3fba03db2c7f2719f438f79f16fc
TLSH
T1D9D097812488635D48080F03F0E06AC630854C3718B17860D6A241B4A9FDEC40351C2B
MD5 SHA1 SHA512 TLSH

Submit Download

a379e010-476d-477e-b610-612be29056f2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\a379e010-476d-477e-b610-612be29056f2
Size 883B
SHA256 8ef1befb62c219b8b96d79458ce0b3c46e3b6a335bc35edae60e052fdbb47ff4
MD5 810390a1c3feb0416414ecab1d5c5ff6
SHA1 8182a4a91362900e2abecffe36fde4e394d09f1b
SHA512 1b6c820e8b235f1db40a599f424a06a708b341236930c620f5e971e967b18a2b58c8cf66c6c2568dc1d01fa15a5c87338f3dec2b385fbb6f4802facaa775edbf
TLSH
T1AC11DC809735B8A2CD68D39AC8A6370247E8741380CB80243EA189240D7E52EE7AA30A
MD5 SHA1 SHA512 TLSH

Submit Download

af407f83-1322-44ab-980c-f56857761ec8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\af407f83-1322-44ab-980c-f56857761ec8
Size 16KB
SHA256 e02d763b8986fb783295bd8d503e045247c358e29b4832d86f02ed11e8d91afa
MD5 b350b47b51eaedc547748909aa395635
SHA1 1cd1cce80e5b31a36e10cc89f6d21e08b410e777
SHA512 7166383e9d69ec712ac383ae753184e34fb0dfe163243a248a9f139b0045f3214f66b34ea13ee133693ed369ef5bbd945134d150666456b5d6703edafb11f1db
SSDEEP 192:1RXR1ZvMoMBATgTyitTUJZOclEjRWcWL6MyKX7QZZhoMB8BqdyfO6zJBlo4j6hK7:5MoMtkOWmZKVIdy2Kl16hKJfRObe88
TLSH
T1FA72CA566830457AC291E36994EDBFC3E5F538CB4C418FC99BE4BD082DDE0AE112798B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b56c9b0f-54cc-4268-ace7-4ae3adf332f8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\b56c9b0f-54cc-4268-ace7-4ae3adf332f8
Size 3KB
SHA256 126f4d46fe781819811828dcbd5e31fd106a780a487cfdfb33dfba69d4762d81
MD5 ec82301ccab86976755f973412c96637
SHA1 542f4498f23fa5fcb869f749d887eb52d7ed5a15
SHA512 e13fc342054a300e9157ce87d498627e36eb2642cd0fe18225d0f79607c97afa4aaca65542aa2d54bfa818c45264fde0ffd9faa5fd0dc0d3407382f40b432b95
TLSH
T1C261662115646D738FF8A040A3776D448ADE33EF584B1BCD12AACE2446FC86847CB35B
MD5 SHA1 SHA512 TLSH

Submit Download

be3320bd-104f-4271-8140-0d2ea4904852

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\be3320bd-104f-4271-8140-0d2ea4904852
Size 3KB
SHA256 537ee2c14a593749ad92cdbe96ac4ff71a76f6d4d1b444bd3cb0b33f3a1678ce
MD5 eceb4b90b2997ee3294479b24675b88c
SHA1 a272f4dab083a76e10a1791e1c1c84919808c66d
SHA512 7b833648f0fde71623d246e3d4ea3343c624f3765ee4d660819d785ad1f3fedfc2d4197352295cafd9e54275c1ea939303f801a1556622aca53fd77bee8a7126
TLSH
T1E961642115646D338FFCA044937769858ADE33EF584B1BCD11AACE2846BC868478B35B
MD5 SHA1 SHA512 TLSH

Submit Download

bf92387a-590a-43a1-9ac3-d9fe6e8fded7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\bf92387a-590a-43a1-9ac3-d9fe6e8fded7
Size 3KB
SHA256 43d052036c569d31f6386f8387584ec4af8f9242f81bc9d7ba4826ad1cc6fe46
MD5 dcc93e71a065b33d8b6157c0989fffe1
SHA1 5d6b73d40b3de4c86d391d9c468820f764a62d41
SHA512 48e626e9ee56efd2e72f2316841639e640eb376c3be87e6913a21d872784ab9c853f7ec4e4647b828d5448b41a94e0ba2b1b170f72fb720b0aa831fc8ad4e5d7
TLSH
T11961642115646D738EECB140A3776D458BDE33EF580B1BC9219ACE2846FC8684BCB35B
MD5 SHA1 SHA512 TLSH

Submit Download

ea910d7b-78de-4c5d-ac10-087ed11c3577

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\ea910d7b-78de-4c5d-ac10-087ed11c3577
Size 3KB
SHA256 3b2e00c15ceaba13dede7a42dd7ed596991829f7e03c059658e84092a5d4a06b
MD5 e7745320f54badc081930aa6b79bc695
SHA1 2f2e4b018dba30e0c7940dab20eb95f84bba3bec
SHA512 b9a5ed9df368e1fe6ab9cfe2eed8c45ec20e3f061c33af334707a08d8709353bfe389c03b74d409bd503dd93d24b864e657bb5f2c96f4775bf52499504d029a0
TLSH
T14261862115686D738FE8A14493776D458BDE33DF584B1FCE219A8E2846FC86847CB34B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\prefs.js
Size 6KB
SHA256 748f388278af20ea373501352a193f26e88bc3328a3134dc07965a2b30b8bd5d
MD5 fee5bed19ec0a6473a8dca753fa9c878
SHA1 b52caa56928c967f9cd60fcd3d4159bcdf35fb87
SHA512 27a6fca51d2ba9304e9fc9d729c62d0db40898d26120dbfee6708954b159d90ebebde9015b7102fd8a90ce283ffa50ccdf35d3b98b3a09706aec540c7b531b1e
SSDEEP 96:xHNUTUr4qGqOfCyKjcnjl1zSpRrZR7SSl8pdv9jzn5HDg/GY9Bw88n8L4cnd88Lg:TnROfCyvBoLJSSGLMeaBw88Z9
TLSH
T1BEE12F789408CB7F64B677ACAC6888316AB2413BBBBF68D750B544C4055CF3441FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1732-1-0x0000000005E20000-0x00000000063C4000-memory.dmp

Download

memory/1732-13-0x00000000013D0000-0x00000000014F0000-memory.dmp

Download

memory/1732-4-0x0000000005840000-0x000000000584A000-memory.dmp

Download

memory/1732-3-0x0000000005910000-0x0000000005920000-memory.dmp

Download

memory/1732-2-0x0000000005790000-0x0000000005822000-memory.dmp

Download

memory/1732-9-0x0000000005910000-0x0000000005920000-memory.dmp

Download

memory/1732-21-0x00000000013D0000-0x00000000014F0000-memory.dmp

Download

memory/1732-22-0x0000000005460000-0x00000000056E1000-memory.dmp

Download

memory/1732-6-0x0000000005E10000-0x0000000005E22000-memory.dmp

Download

memory/1732-5-0x0000000005A60000-0x0000000005AFC000-memory.dmp

Download

memory/1732-28-0x0000000005460000-0x00000000056E1000-memory.dmp

Download

memory/1732-27-0x00000000013D0000-0x00000000014F0000-memory.dmp

Download

memory/1732-8-0x0000000005460000-0x00000000056E1000-memory.dmp

Download

memory/1732-12-0x0000000008B00000-0x0000000008C58000-memory.dmp

Download

memory/1732-7-0x00000000013D0000-0x00000000014F0000-memory.dmp

Download

memory/1732-0-0x0000000000840000-0x0000000000A10000-memory.dmp

Download

memory/2120-1069-0x0000010F5C4C0000-0x0000010F5C690000-memory.dmp

Download

memory/2532-72-0x00000000079F0000-0x00000000079FE000-memory.dmp

Download

memory/2532-56-0x00000000705C0000-0x000000007060C000-memory.dmp

Download

memory/2532-20-0x0000000002530000-0x0000000002566000-memory.dmp

Download

memory/2532-24-0x0000000002490000-0x00000000024A0000-memory.dmp

Download

memory/2532-23-0x0000000002490000-0x00000000024A0000-memory.dmp

Download

memory/2532-30-0x0000000004F30000-0x0000000005558000-memory.dmp

Download

memory/2532-32-0x0000000004E60000-0x0000000004E82000-memory.dmp

Download

memory/2532-33-0x0000000005D60000-0x0000000005DC6000-memory.dmp

Download

memory/2532-40-0x0000000005E40000-0x0000000006194000-memory.dmp

Download

memory/2532-43-0x0000000004BB0000-0x0000000004BCE000-memory.dmp

Download

memory/2532-44-0x00000000064C0000-0x000000000650C000-memory.dmp

Download

memory/2532-55-0x0000000007680000-0x00000000076B2000-memory.dmp

Download

memory/2532-64-0x0000000006A10000-0x0000000006A2E000-memory.dmp

Download

memory/2532-65-0x00000000076C0000-0x0000000007763000-memory.dmp

Download

memory/2532-66-0x0000000007E10000-0x000000000848A000-memory.dmp

Download

memory/2532-67-0x00000000077C0000-0x00000000077DA000-memory.dmp

Download

memory/2532-68-0x0000000007830000-0x000000000783A000-memory.dmp

Download

memory/2532-70-0x0000000007A40000-0x0000000007AD6000-memory.dmp

Download

memory/2532-71-0x00000000079C0000-0x00000000079D1000-memory.dmp

Download

memory/2532-84-0x0000000004E30000-0x0000000004E3E000-memory.dmp

Download

memory/2532-86-0x0000000006A40000-0x0000000006A61000-memory.dmp

Download

memory/2532-83-0x0000000005560000-0x0000000005B68000-memory.dmp

Download

memory/2532-85-0x0000000005CF0000-0x0000000005D0E000-memory.dmp

Download

memory/2532-73-0x0000000007A00000-0x0000000007A14000-memory.dmp

Download

memory/2532-74-0x0000000007B00000-0x0000000007B1A000-memory.dmp

Download

memory/2532-75-0x0000000007AE0000-0x0000000007AE8000-memory.dmp

Download

memory/3360-1962-0x00000225266A0000-0x000002252674D000-memory.dmp

Download

memory/3380-1969-0x0000019873730000-0x00000198737DD000-memory.dmp

Download

memory/3660-949-0x0000014990480000-0x0000014990621000-memory.dmp

Download

memory/4064-547-0x0000021991670000-0x0000021991678000-memory.dmp

Download

memory/4064-545-0x000002198FB20000-0x000002198FCC1000-memory.dmp

Download

memory/4064-546-0x000002198FDB0000-0x000002198FDBC000-memory.dmp

Download

memory/4064-52-0x00000219A9E10000-0x00000219A9E32000-memory.dmp

Download

memory/4064-53-0x00000219A9FE0000-0x00000219AA024000-memory.dmp

Download

memory/4064-54-0x00000219AA2B0000-0x00000219AA326000-memory.dmp

Download

memory/4956-2430-0x00000000008A0000-0x00000000008A1000-memory.dmp

Download

memory/5020-92-0x0000018AFB3C0000-0x0000018AFB590000-memory.dmp

Download

memory/5048-25-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/5048-2442-0x0000000005500000-0x0000000005781000-memory.dmp

Download

memory/5048-327-0x0000000005850000-0x0000000005871000-memory.dmp

Download

memory/5048-325-0x0000000005500000-0x0000000005781000-memory.dmp

Download

memory/5048-2593-0x0000000005500000-0x0000000005781000-memory.dmp

Download

memory/5048-2537-0x0000000005500000-0x0000000005781000-memory.dmp

Download

memory/5048-2477-0x0000000005500000-0x0000000005781000-memory.dmp

Download

memory/5048-69-0x0000000006880000-0x0000000006932000-memory.dmp

Download

memory/5048-2467-0x0000000005500000-0x0000000005781000-memory.dmp

Download

memory/5048-2457-0x0000000005500000-0x0000000005781000-memory.dmp

Download

memory/5048-2458-0x0000000005850000-0x0000000005871000-memory.dmp

Download

memory/5048-2459-0x0000000006640000-0x000000000665D000-memory.dmp

Download

memory/5048-34-0x00000000066A0000-0x0000000006706000-memory.dmp

Download

memory/5048-2443-0x0000000005850000-0x0000000005871000-memory.dmp

Download

memory/5048-31-0x0000000005880000-0x0000000005890000-memory.dmp

Download

memory/5048-2444-0x0000000006640000-0x000000000665D000-memory.dmp

Download

memory/5048-76-0x0000000006B00000-0x0000000006CC2000-memory.dmp

Download

memory/5048-2445-0x00000000071E0000-0x00000000071F6000-memory.dmp

Download

memory/5048-330-0x0000000005880000-0x0000000005890000-memory.dmp

Download

memory/5048-80-0x0000000006660000-0x000000000667E000-memory.dmp

Download

memory/5048-328-0x0000000006640000-0x000000000665D000-memory.dmp

Download

memory/5048-79-0x0000000007200000-0x000000000772C000-memory.dmp

Download

memory/5048-78-0x0000000006A30000-0x0000000006A80000-memory.dmp

Download

memory/5048-2447-0x0000000008530000-0x000000000853A000-memory.dmp

Download

memory/5048-2446-0x0000000008260000-0x0000000008268000-memory.dmp

Download

memory/5048-77-0x00000000069B0000-0x0000000006A26000-memory.dmp

Download

memory/5048-2437-0x0000000007730000-0x0000000007A84000-memory.dmp

Download

memory/5132-948-0x000001F35BF90000-0x000001F35C131000-memory.dmp

Download

memory/5228-412-0x0000019F43D00000-0x0000019F43DAD000-memory.dmp

Download

memory/5292-543-0x000001F42B3B0000-0x000001F42B45D000-memory.dmp

Download

memory/5348-409-0x000001CA31120000-0x000001CA311CD000-memory.dmp

Download

memory/5380-544-0x000002521F1E0000-0x000002521F28D000-memory.dmp

Download

memory/5584-620-0x000001EBF9A70000-0x000001EBF9C11000-memory.dmp

Download

memory/5660-1192-0x000001E27E200000-0x000001E27E2AC000-memory.dmp

Download

memory/5960-954-0x0000021C3AAB0000-0x0000021C3AC51000-memory.dmp

Download

memory/5992-615-0x00000285A89F0000-0x00000285A8B91000-memory.dmp

Download

memory/6100-639-0x00000256A3C80000-0x00000256A3E21000-memory.dmp

Download

memory/6876-2435-0x00000199993F0000-0x000001999949D000-memory.dmp

Download

memory/6876-1994-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

Download

memory/6876-2405-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

Download

memory/6876-2436-0x0000019999690000-0x0000019999698000-memory.dmp

Download

memory/6952-2424-0x0000000000B30000-0x0000000000B31000-memory.dmp

Download