phantom_stealer | 55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/06/2026, 08:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7.exe
Size 1.5MB
Sample260608-klqfrabs21
SHA256 55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7
MD5 6be8ddcc17d262e9a648712cac7ff348
SHA1 41d50f868c0a14049c88df57c2c47c4dc859815e
SHA512 5b6cdaab6ca17b2dfa0fed801e86b58bcee4f8bdfde9bf5cd3e3590310159624a896ad9459e447a187e3d74729d030a5781b110cbbd8d8921ab5c686801e2f89
SSDEEP 24576:v14A+J/8aH2qB6jzSqECsw7PoNNnvQFWthRKgE+1qwRb9UQ8QWVUdRi2UhR:dV8fH4WhCswToNZc8PdE8fWVui9
TLSH
T146751219021FDD06E9B7CBB80860E3B406B49E546A35D313CEF6BEEB783279169053D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution phantom_stealer persistence stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.gunsaldi.com
Port
587
Username
[email protected]
Password
=Otpg+DbxigRc`bI

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
mail.gunsaldi.com
Port
587
Username
[email protected]
Password
=Otpg+DbxigRc`bI
Email to
[email protected]

Mutex

TFU0XCLJJ0AJ3KL95LO4

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
1

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 1 IoCs

resource	yara_rule
behavioral1/memory/5904-13-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3612	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5040	BCuZxCyoAooO.exe
6000	RegSvcs.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BCuZxCyoAooO = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\caqn0tvfpwf.ps1\""	55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegSvcs = "C:\\Users\\Admin\\AppData\\Roaming\\RegSvcs.exe"	RegSvcs.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
382	icanhazip.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5640 set thread context of 5904	5640	55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7.exe	91
PID 5040 set thread context of 5224	5040	BCuZxCyoAooO.exe	185

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\6444_13425381744129920_6444.pma	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\msedge_installer.log	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\850c2e9f-35c4-4834-8ff0-bc6a82555416.tmp	setup.exe
File opened for modification	C:\Program Files\msedge_installer.log	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\metadata	setup.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCuZxCyoAooO.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1384	chrome.exe
1780	msedge.exe
4996	msedge.exe
4716	chrome.exe

Checks processor information in registry 2 TTPs 38 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134253817438082135"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{BB90B260-E470-47D4-BAA3-A5634C7F0C84}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5640	55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7.exe
5640	55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7.exe
3612	powershell.exe
3612	powershell.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
1072	chrome.exe
1072	chrome.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
836	firefox.exe
836	firefox.exe
836	firefox.exe
836	firefox.exe
836	firefox.exe
836	firefox.exe
836	firefox.exe
836	firefox.exe
836	firefox.exe
836	firefox.exe
836	firefox.exe
836	firefox.exe
836	firefox.exe
836	firefox.exe
836	firefox.exe
836	firefox.exe
836	firefox.exe
836	firefox.exe
836	firefox.exe
836	firefox.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	5640	55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7.exe
Token: SeDebugPrivilege	5904	RegSvcs.exe
Token: SeDebugPrivilege	3612	powershell.exe
Token: SeShutdownPrivilege	1072	chrome.exe
Token: SeCreatePagefilePrivilege	1072	chrome.exe
Token: SeShutdownPrivilege	1072	chrome.exe
Token: SeCreatePagefilePrivilege	1072	chrome.exe
Token: SeDebugPrivilege	5224	RegSvcs.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe
Token: SeShutdownPrivilege	1972	chrome.exe
Token: SeCreatePagefilePrivilege	1972	chrome.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
1072	chrome.exe
1072	chrome.exe
836	firefox.exe
836	firefox.exe
836	firefox.exe
836	firefox.exe
836	firefox.exe
836	firefox.exe
836	firefox.exe
836	firefox.exe
5660	msedge.exe
6052	msedge.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
1972	chrome.exe
1972	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
836	firefox.exe
3432	firefox.exe
5904	RegSvcs.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5640 wrote to memory of 1408	5640	55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7.exe	90
PID 5640 wrote to memory of 5904	5640	55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7.exe	91
PID 5640 wrote to memory of 5904	5640	55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7.exe	91
PID 5640 wrote to memory of 5904	5640	55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7.exe	91
PID 5640 wrote to memory of 5904	5640	55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7.exe	91
PID 5640 wrote to memory of 5904	5640	55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7.exe	91
PID 3612 wrote to memory of 5040	3612	powershell.exe	95
PID 5904 wrote to memory of 1072	5904	RegSvcs.exe	98
PID 1072 wrote to memory of 5216	1072	chrome.exe	99
PID 1072 wrote to memory of 3588	1072	chrome.exe	100
PID 1072 wrote to memory of 1384	1072	chrome.exe	101
PID 1072 wrote to memory of 4712	1072	chrome.exe	102
PID 1072 wrote to memory of 3764	1072	chrome.exe	103
PID 1072 wrote to memory of 5808	1072	chrome.exe	104
PID 1072 wrote to memory of 2192	1072	chrome.exe	105
PID 1072 wrote to memory of 1224	1072	chrome.exe	106
PID 1072 wrote to memory of 1564	1072	chrome.exe	107
PID 1072 wrote to memory of 408	1072	chrome.exe	108
PID 5904 wrote to memory of 4712	5904	RegSvcs.exe	102
PID 5904 wrote to memory of 4712	5904	RegSvcs.exe	102
PID 1072 wrote to memory of 3100	1072	chrome.exe	109
PID 5904 wrote to memory of 5808	5904	RegSvcs.exe	104
PID 5904 wrote to memory of 5808	5904	RegSvcs.exe	104
PID 5904 wrote to memory of 5216	5904	RegSvcs.exe	99
PID 5904 wrote to memory of 5216	5904	RegSvcs.exe	99
PID 5904 wrote to memory of 1072	5904	RegSvcs.exe	98
PID 5904 wrote to memory of 1072	5904	RegSvcs.exe	98
PID 5904 wrote to memory of 1384	5904	RegSvcs.exe	101
PID 5904 wrote to memory of 1384	5904	RegSvcs.exe	101
PID 5904 wrote to memory of 3588	5904	RegSvcs.exe	100
PID 5904 wrote to memory of 3588	5904	RegSvcs.exe	100
PID 5904 wrote to memory of 1224	5904	RegSvcs.exe	106
PID 5904 wrote to memory of 1224	5904	RegSvcs.exe	106
PID 5904 wrote to memory of 1564	5904	RegSvcs.exe	107
PID 5904 wrote to memory of 1564	5904	RegSvcs.exe	107
PID 5904 wrote to memory of 4712	5904	RegSvcs.exe	102
PID 5904 wrote to memory of 4712	5904	RegSvcs.exe	102
PID 5904 wrote to memory of 5808	5904	RegSvcs.exe	104
PID 5904 wrote to memory of 5808	5904	RegSvcs.exe	104
PID 5904 wrote to memory of 5216	5904	RegSvcs.exe	99
PID 5904 wrote to memory of 5216	5904	RegSvcs.exe	99
PID 5904 wrote to memory of 1072	5904	RegSvcs.exe	98
PID 5904 wrote to memory of 1072	5904	RegSvcs.exe	98
PID 5904 wrote to memory of 1384	5904	RegSvcs.exe	101
PID 5904 wrote to memory of 1384	5904	RegSvcs.exe	101
PID 5904 wrote to memory of 2192	5904	RegSvcs.exe	105
PID 5904 wrote to memory of 2192	5904	RegSvcs.exe	105
PID 5904 wrote to memory of 3588	5904	RegSvcs.exe	100
PID 5904 wrote to memory of 3588	5904	RegSvcs.exe	100
PID 5904 wrote to memory of 408	5904	RegSvcs.exe	108
PID 5904 wrote to memory of 408	5904	RegSvcs.exe	108
PID 5904 wrote to memory of 1224	5904	RegSvcs.exe	106
PID 5904 wrote to memory of 1224	5904	RegSvcs.exe	106
PID 5904 wrote to memory of 1564	5904	RegSvcs.exe	107
PID 5904 wrote to memory of 1564	5904	RegSvcs.exe	107
PID 5904 wrote to memory of 4712	5904	RegSvcs.exe	102
PID 5904 wrote to memory of 4712	5904	RegSvcs.exe	102
PID 5904 wrote to memory of 5808	5904	RegSvcs.exe	104
PID 5904 wrote to memory of 5808	5904	RegSvcs.exe	104
PID 5904 wrote to memory of 5216	5904	RegSvcs.exe	99
PID 5904 wrote to memory of 5216	5904	RegSvcs.exe	99
PID 5904 wrote to memory of 1072	5904	RegSvcs.exe	98
PID 5904 wrote to memory of 1072	5904	RegSvcs.exe	98
PID 5904 wrote to memory of 1384	5904	RegSvcs.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7.exe
"C:\Users\Admin\AppData\Local\Temp\55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5640
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:1408
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:5904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j1c0j2tc.jog"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1072
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\j1c0j2tc.jog /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\j1c0j2tc.jog\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\j1c0j2tc.jog --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7fff0a44c728,0x7fff0a44c734,0x7fff0a44c740
      4⤵
      PID:5216
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j1c0j2tc.jog" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1696,i,7050926849375770862,9521983304660812532,262144 --field-trial-handle=1808,i,16109326179760361922,3169568858815506232,262144 --variations-seed-version --mojo-platform-channel-handle=1800 /prefetch:2
      4⤵
      PID:3588
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j1c0j2tc.jog" --force-high-res-timeticks=disabled --metrics-shmem-handle=2032,i,17124014439970184856,12936637113933233455,524288 --field-trial-handle=1808,i,16109326179760361922,3169568858815506232,262144 --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:3
      4⤵
      System Time Discovery
      PID:1384
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j1c0j2tc.jog" --force-high-res-timeticks=disabled --metrics-shmem-handle=2176,i,8862559830453278850,5843184762281216484,524288 --field-trial-handle=1808,i,16109326179760361922,3169568858815506232,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:8
      4⤵
      PID:4712
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j1c0j2tc.jog" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2776,i,18420904904381665125,6760968511345174769,2097152 --field-trial-handle=1808,i,16109326179760361922,3169568858815506232,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:1
      4⤵
      PID:3764
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j1c0j2tc.jog" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2772,i,16586248716863833573,8232728559089294318,2097152 --field-trial-handle=1808,i,16109326179760361922,3169568858815506232,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:1
      4⤵
      PID:5808
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j1c0j2tc.jog" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3088,i,15381620045074539563,16841488234885053020,2097152 --field-trial-handle=1808,i,16109326179760361922,3169568858815506232,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:1
      4⤵
      PID:2192
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j1c0j2tc.jog" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3132,i,12881630212273533291,3522164181033674892,2097152 --field-trial-handle=1808,i,16109326179760361922,3169568858815506232,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:2
      4⤵
      PID:1224
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j1c0j2tc.jog" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3836,i,6123540625461271363,11643442085353412848,2097152 --field-trial-handle=1808,i,16109326179760361922,3169568858815506232,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:1
      4⤵
      PID:1564
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j1c0j2tc.jog" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4124,i,9593066727302792652,5334867895922862862,2097152 --field-trial-handle=1808,i,16109326179760361922,3169568858815506232,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:2
      4⤵
      PID:408
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j1c0j2tc.jog" --force-high-res-timeticks=disabled --metrics-shmem-handle=4208,i,16060056290516288041,14200210790295748550,524288 --field-trial-handle=1808,i,16109326179760361922,3169568858815506232,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
      4⤵
      PID:3100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\djs4psfa.zds"
    3⤵
    PID:1812
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\djs4psfa.zds
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:836
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27099 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2076 -initialChannelId {a440e58f-6003-41e3-9b7a-41d480735a74} -parentPid 836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.836" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:1336
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2240 -prefsLen 27135 -prefMapHandle 2228 -prefMapSize 270279 -ipcHandle 2312 -initialChannelId {27a41d1f-42c4-4e5f-90aa-c232485e1615} -parentPid 836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:2228
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e5799cb0-3947-43f2-868a-99ecda8a0adc.dmp"
        5⤵
        
        PID:4456
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2184 -prefsLen 27135 -prefMapHandle 2836 -prefMapSize 270279 -ipcHandle 2856 -initialChannelId {00da26d7-ac4b-4559-9164-3c9d9109ce2b} -parentPid 836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.836" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:4284
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b1044b05-6d41-46b0-ade1-99217503484f.dmp"
        5⤵
        
        PID:1064
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2856 -prefsLen 27135 -prefMapHandle 3004 -prefMapSize 270279 -ipcHandle 3032 -initialChannelId {5483d021-2e01-44b2-8077-ca8069fb4327} -parentPid 836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.836" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:4640
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0a4f3c2f-e28e-4930-8bdf-1abe16807904.dmp"
        5⤵
        
        PID:5244
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3544 -prefsLen 27200 -prefMapHandle 3516 -prefMapSize 270279 -ipcHandle 2932 -initialChannelId {defc4b79-f326-4a57-a19f-a77ccd11b68b} -parentPid 836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.836" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:2828
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3932 -prefsLen 27325 -prefMapHandle 3936 -prefMapSize 270279 -jsInitHandle 3940 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3948 -initialChannelId {685362e0-24e2-4300-b0f0-edff11cf62a0} -parentPid 836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:3308
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\82b80b7a-4af0-4f64-8459-bffee3ae5336.dmp"
        5⤵
        
        PID:5104
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2932 -prefsLen 27325 -prefMapHandle 4072 -prefMapSize 270279 -ipcHandle 4080 -initialChannelId {88d7cef8-9e52-41e8-8f38-6b497b908784} -parentPid 836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.836" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:5652
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3410721c-4130-4c2d-959c-02e0cbce8787.dmp"
        5⤵
        
        PID:3096
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4084 -prefsLen 27325 -prefMapHandle 2924 -prefMapSize 270279 -ipcHandle 4332 -initialChannelId {ea19612b-7f8e-4c9e-aabe-29e45e799892} -parentPid 836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.836" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:4852
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4696 -prefsLen 34878 -prefMapHandle 4700 -prefMapSize 270279 -jsInitHandle 2772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2856 -initialChannelId {1f172113-0b57-4cd0-a608-cb67cac8f217} -parentPid 836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:2856
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4072 -prefsLen 35012 -prefMapHandle 4688 -prefMapSize 270279 -ipcHandle 5000 -initialChannelId {ac3bf28c-4984-4b5c-af6c-671c7c6e8fd5} -parentPid 836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:5408
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5028 -prefsLen 32900 -prefMapHandle 5124 -prefMapSize 270279 -jsInitHandle 5128 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5136 -initialChannelId {c084abde-b100-446e-9a76-718b9996f3da} -parentPid 836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:4540
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5156 -prefsLen 32900 -prefMapHandle 5160 -prefMapSize 270279 -jsInitHandle 5164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5172 -initialChannelId {facec7e0-8c8f-4b16-8d91-66991b4299e3} -parentPid 836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:4348
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5552 -prefsLen 32900 -prefMapHandle 5556 -prefMapSize 270279 -jsInitHandle 5560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5568 -initialChannelId {4f1f6214-46a8-4d73-8754-3aa2413acfee} -parentPid 836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:3180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7fff0a42c188,0x7fff0a42c194,0x7fff0a42c1a0
      4⤵
      PID:5932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1772,i,9618506028342395170,8307263458308730154,262144 --field-trial-handle=2624,i,17473421044333789316,9879303769394710081,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:2
      4⤵
      PID:5928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,17889524277815847720,14253654741569022739,524288 --field-trial-handle=2624,i,17473421044333789316,9879303769394710081,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:3
      4⤵
      System Time Discovery
      PID:1780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,11283621026615595897,9780655567869148744,524288 --field-trial-handle=2624,i,17473421044333789316,9879303769394710081,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:8
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3128,i,7722086660726325456,2803597826760101917,2097152 --field-trial-handle=2624,i,17473421044333789316,9879303769394710081,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:1
      4⤵
      PID:5248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3132,i,12205573389705906406,12804041279302024348,2097152 --field-trial-handle=2624,i,17473421044333789316,9879303769394710081,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:1
      4⤵
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2936,i,12056961622758121351,4119189970585822346,524288 --field-trial-handle=2624,i,17473421044333789316,9879303769394710081,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:8
      4⤵
      PID:2288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,15675526140538486514,13823870204911350024,524288 --field-trial-handle=2624,i,17473421044333789316,9879303769394710081,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:8
      4⤵
      PID:544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,16771324655301004025,11587105979939856783,524288 --field-trial-handle=2624,i,17473421044333789316,9879303769394710081,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:8
      4⤵
      PID:5840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3652,i,2027466093126508481,17358764576025936228,2097152 --field-trial-handle=2624,i,17473421044333789316,9879303769394710081,262144 --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:1
      4⤵
      PID:4580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3668,i,961694176501330561,58367259626881312,2097152 --field-trial-handle=2624,i,17473421044333789316,9879303769394710081,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:2
      4⤵
      PID:5796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3688,i,8346204696120994839,7158520200233709122,2097152 --field-trial-handle=2624,i,17473421044333789316,9879303769394710081,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:1
      4⤵
      PID:2016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3712,i,2235227638972826013,1794710129130034428,2097152 --field-trial-handle=2624,i,17473421044333789316,9879303769394710081,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:2
      4⤵
      PID:2616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3724,i,13347653345676128722,7936374367398228023,2097152 --field-trial-handle=2624,i,17473421044333789316,9879303769394710081,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:1
      4⤵
      PID:1188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3736,i,1187003481528418572,11034670914998778090,2097152 --field-trial-handle=2624,i,17473421044333789316,9879303769394710081,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:2
      4⤵
      PID:5964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3752,i,14334568247375988607,7491952345494540633,2097152 --field-trial-handle=2624,i,17473421044333789316,9879303769394710081,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
      4⤵
      PID:4908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3764,i,14266603749150847078,3438242241427391569,2097152 --field-trial-handle=2624,i,17473421044333789316,9879303769394710081,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:2
      4⤵
      PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3780,i,13578643423685280278,12018135466004443808,2097152 --field-trial-handle=2624,i,17473421044333789316,9879303769394710081,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:1
      4⤵
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3792,i,5014323447992343157,7569826380841667712,2097152 --field-trial-handle=2624,i,17473421044333789316,9879303769394710081,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:2
      4⤵
      PID:1636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,6389985128309184794,6517800257860795824,524288 --field-trial-handle=2624,i,17473421044333789316,9879303769394710081,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:8
      4⤵
      PID:4684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,11489745610188590450,10966754028208146561,524288 --field-trial-handle=2624,i,17473421044333789316,9879303769394710081,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
      4⤵
      PID:3404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,6172086810183596559,2010863610226980567,524288 --field-trial-handle=2624,i,17473421044333789316,9879303769394710081,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
      4⤵
      PID:1820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,15150098743692918485,8791349680786891393,524288 --field-trial-handle=2624,i,17473421044333789316,9879303769394710081,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
      4⤵
      PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:6052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7fff0a42c188,0x7fff0a42c194,0x7fff0a42c1a0
      4⤵
      PID:1588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1764,i,7338528242248585855,2637798805497335136,262144 --field-trial-handle=2280,i,9590118360602440174,10686275996369234711,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,3488723176465514884,6217233507997724913,524288 --field-trial-handle=2280,i,9590118360602440174,10686275996369234711,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
      4⤵
      System Time Discovery
      PID:4996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,4842188882275981999,1228740049727183153,524288 --field-trial-handle=2280,i,9590118360602440174,10686275996369234711,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:8
      4⤵
      PID:5740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3032,i,3875812987935655329,14829880388209565945,2097152 --field-trial-handle=2280,i,9590118360602440174,10686275996369234711,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:1
      4⤵
      PID:228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3040,i,4584880460349580268,7700277351045253350,2097152 --field-trial-handle=2280,i,9590118360602440174,10686275996369234711,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:1
      4⤵
      PID:3308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3296,i,7557919377092210778,15312318146284290369,524288 --field-trial-handle=2280,i,9590118360602440174,10686275996369234711,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:8
      4⤵
      PID:5340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3356,i,17726185596069849901,14284587987350091751,524288 --field-trial-handle=2280,i,9590118360602440174,10686275996369234711,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:8
      4⤵
      PID:2424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3372,i,10871157948330932784,16256623778056017059,524288 --field-trial-handle=2280,i,9590118360602440174,10686275996369234711,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:8
      4⤵
      PID:924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3468,i,7727146160374407904,13593339660057230421,2097152 --field-trial-handle=2280,i,9590118360602440174,10686275996369234711,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:3032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3488,i,6499019399099095065,15043832793459306815,2097152 --field-trial-handle=2280,i,9590118360602440174,10686275996369234711,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:2
      4⤵
      PID:4044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3520,i,14981016688818756445,4329756836039087162,2097152 --field-trial-handle=2280,i,9590118360602440174,10686275996369234711,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:2036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3560,i,9352750867837914329,5698444487890069248,2097152 --field-trial-handle=2280,i,9590118360602440174,10686275996369234711,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:2
      4⤵
      PID:1156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3612,i,2476580032015802092,6071029630597693307,2097152 --field-trial-handle=2280,i,9590118360602440174,10686275996369234711,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:5692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3600,i,17146713657154136672,18115355528945523147,2097152 --field-trial-handle=2280,i,9590118360602440174,10686275996369234711,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:2
      4⤵
      PID:3544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3680,i,12516047346562497625,13862133527710136186,2097152 --field-trial-handle=2280,i,9590118360602440174,10686275996369234711,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:3480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3720,i,10459122792028464126,17133604964837425802,2097152 --field-trial-handle=2280,i,9590118360602440174,10686275996369234711,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:2
      4⤵
      PID:3808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3784,i,77209325403959349,14608854938722665534,2097152 --field-trial-handle=2280,i,9590118360602440174,10686275996369234711,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:1
      4⤵
      PID:6116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3808,i,8372909705032362408,6754673632879229657,2097152 --field-trial-handle=2280,i,9590118360602440174,10686275996369234711,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:2
      4⤵
      PID:972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,11742280293946846280,539836967863865663,524288 --field-trial-handle=2280,i,9590118360602440174,10686275996369234711,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8
      4⤵
      PID:6260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,12354565796599572979,3390476783357326519,524288 --field-trial-handle=2280,i,9590118360602440174,10686275996369234711,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
      4⤵
      PID:6380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,17448279190411505975,6629719131861702633,524288 --field-trial-handle=2280,i,9590118360602440174,10686275996369234711,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
      4⤵
      PID:6160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,9330285398736356783,2408586275568115462,524288 --field-trial-handle=2280,i,9590118360602440174,10686275996369234711,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
      4⤵
      PID:2016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,4613084558900065790,14442232714951863891,524288 --field-trial-handle=2280,i,9590118360602440174,10686275996369234711,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:8
      4⤵
      PID:5152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,4613084558900065790,14442232714951863891,524288 --field-trial-handle=2280,i,9590118360602440174,10686275996369234711,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:8
      4⤵
      PID:2444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,2976018559237563387,6938855200366904161,524288 --field-trial-handle=2280,i,9590118360602440174,10686275996369234711,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
      4⤵
      PID:6972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,1205030399292986662,1503470884279288974,524288 --field-trial-handle=2280,i,9590118360602440174,10686275996369234711,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
      4⤵
      PID:528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:5340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x210,0x214,0x218,0x1ec,0x21c,0x7ff7ed4904c8,0x7ff7ed4904d4,0x7ff7ed4904e0
        5⤵
        Drops file in Program Files directory
        
        PID:2236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        
        PID:6444
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x20c,0x210,0x214,0x1e8,0x218,0x7ff7ed4904c8,0x7ff7ed4904d4,0x7ff7ed4904e0
        6⤵
        Drops file in Program Files directory
        
        PID:6188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4dye0khq.jw0"
    3⤵
    PID:748
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\4dye0khq.jw0
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:3432
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270331 -ipcHandle 2092 -initialChannelId {f6c80a7b-21d1-45b3-b1bf-1602d4483dc0} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:6932
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2548 -prefsLen 27135 -prefMapHandle 2552 -prefMapSize 270331 -ipcHandle 2196 -initialChannelId {d0719275-424a-4d09-96b5-5e407d3d31d8} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:2424
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c4ffbf4d-f2a3-41c5-8d77-b3ade2247e02.dmp"
        5⤵
        
        PID:4888
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2180 -prefsLen 27135 -prefMapHandle 2864 -prefMapSize 270331 -ipcHandle 2336 -initialChannelId {cc60585c-ec71-4175-be1b-b9f0aa3682ed} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:1816
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\db6e9fa7-cd59-47e0-9e97-7c17e7b20d19.dmp"
        5⤵
        
        PID:5648
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3028 -prefsLen 27135 -prefMapHandle 2956 -prefMapSize 270331 -ipcHandle 2336 -initialChannelId {ad67c4a7-b3a4-4955-959e-63ff338afd4b} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:2308
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\4606d904-01ef-4803-9ede-65ad0f2eed0e.dmp"
        5⤵
        
        PID:5704
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2976 -prefsLen 27200 -prefMapHandle 3316 -prefMapSize 270331 -ipcHandle 3140 -initialChannelId {d5b873d5-7862-4580-91ab-60357cdb393f} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:6344
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3836 -prefsLen 27325 -prefMapHandle 3840 -prefMapSize 270331 -jsInitHandle 3844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2904 -initialChannelId {31811e62-f12a-463b-a479-ffcc856caa84} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:6156
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\fd0fc6e5-22d6-4b6d-a88b-1c9ef7e58801.dmp"
        5⤵
        
        PID:5408
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3024 -prefsLen 27325 -prefMapHandle 4008 -prefMapSize 270331 -ipcHandle 2380 -initialChannelId {dcb44ea7-f21e-4438-a5c7-548aa2969848} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:4588
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a4e9048a-60b8-407c-94dd-66d097f7633f.dmp"
        5⤵
        
        PID:5324
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4380 -prefsLen 27325 -prefMapHandle 4384 -prefMapSize 270331 -ipcHandle 3976 -initialChannelId {b0afe0f9-d610-47de-a5eb-2ddc4c6cbf3e} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:3680
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2712 -prefsLen 34878 -prefMapHandle 2792 -prefMapSize 270331 -jsInitHandle 2452 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4572 -initialChannelId {f55024ae-ae23-4760-b222-8e11a1097692} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:4496
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3156 -prefsLen 34878 -prefMapHandle 4988 -prefMapSize 270331 -ipcHandle 5004 -initialChannelId {4d733618-0ce0-43b0-9a36-b76280f7b07a} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:7096
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5248 -prefsLen 32818 -prefMapHandle 5244 -prefMapSize 270331 -jsInitHandle 5240 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5296 -initialChannelId {88ef6f23-1d21-497b-94d4-7e69c1c233ae} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        
        PID:4324
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4900 -prefsLen 32818 -prefMapHandle 4944 -prefMapSize 270331 -jsInitHandle 4952 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4104 -initialChannelId {a997c449-7f5b-4aaa-8943-470102266a37} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        
        PID:3404
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5584 -prefsLen 32818 -prefMapHandle 5588 -prefMapSize 270331 -jsInitHandle 5592 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5600 -initialChannelId {b95cbafb-9a27-4384-bbd2-0b29fc453aa3} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        
        PID:6520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vffqmkrx.o04"
    3⤵
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1972
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\vffqmkrx.o04 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\vffqmkrx.o04\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\vffqmkrx.o04 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff0af0c728,0x7fff0af0c734,0x7fff0af0c740
      4⤵
      PID:4176
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vffqmkrx.o04" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1744,i,9629868897766822194,3072312476143731993,262144 --field-trial-handle=2124,i,15202137446257784601,2609169491085732408,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:2
      4⤵
      PID:3764
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vffqmkrx.o04" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1932,i,12593237991266230968,10234971954558183,524288 --field-trial-handle=2124,i,15202137446257784601,2609169491085732408,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
      4⤵
      System Time Discovery
      PID:4716
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vffqmkrx.o04" --force-high-res-timeticks=disabled --metrics-shmem-handle=2148,i,8450437111030545862,12363899137644550358,524288 --field-trial-handle=2124,i,15202137446257784601,2609169491085732408,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:8
      4⤵
      PID:7140
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vffqmkrx.o04" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2940,i,16844815118210608468,7553135663488428193,2097152 --field-trial-handle=2124,i,15202137446257784601,2609169491085732408,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:1
      4⤵
      PID:3724
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vffqmkrx.o04" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2944,i,4555321097961553417,7964296594705366138,2097152 --field-trial-handle=2124,i,15202137446257784601,2609169491085732408,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:1
      4⤵
      PID:4100
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vffqmkrx.o04" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3360,i,12068463145510431667,144980075309206961,2097152 --field-trial-handle=2124,i,15202137446257784601,2609169491085732408,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:1
      4⤵
      PID:4472
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vffqmkrx.o04" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3372,i,11846507245298764221,1218581477011599363,2097152 --field-trial-handle=2124,i,15202137446257784601,2609169491085732408,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:2
      4⤵
      PID:5896
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vffqmkrx.o04" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3900,i,11515691729392187014,4760405122081882342,2097152 --field-trial-handle=2124,i,15202137446257784601,2609169491085732408,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:2
      4⤵
      PID:5300
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vffqmkrx.o04" --force-high-res-timeticks=disabled --metrics-shmem-handle=4152,i,17026039839144754889,14806324968244516996,524288 --field-trial-handle=2124,i,15202137446257784601,2609169491085732408,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:8
      4⤵
      PID:6780
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vffqmkrx.o04" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4224,i,2434658977128658457,4283263481710364484,2097152 --field-trial-handle=2124,i,15202137446257784601,2609169491085732408,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
      4⤵
      PID:3132

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\caqn0tvfpwf.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Users\Admin\AppData\Roaming\BCuZxCyoAooO.exe
  "C:\Users\Admin\AppData\Roaming\BCuZxCyoAooO.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:5040
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5224

C:\Users\Admin\AppData\Roaming\RegSvcs.exe
C:\Users\Admin\AppData\Roaming\RegSvcs.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fqkq4vem.default-release\activity-stream.contile.json
Size 4KB
SHA256 4ba179ec37c0fb040b7bbd598470c416af1eb28c543a7744eb771eb21de701b4
MD5 77ce765d24c1ce40d2f2e84725186893
SHA1 079df83177765cbd489f378134a753158ee558f4
SHA512 642ac9103b2057b1b6d55c3bb2454724c23e9e6c2cb3f73c3201f93678deec8ae68e952997bb6f0242a292ed70d0a27282989c10c96fc044a68e5e21644b276b
SSDEEP 96:KgHAytWDLLxVsoCToni/8DlSwLZV1tlY3wT+mR0Dl:KmtWDLdiToi8l7LZV1tlGBmR0Dl
TLSH
T16FA11AFB6C3484171731B3F47C4E235DF1177067A9E69A48BA924C01D9D924B81EBA88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fqkq4vem.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 e11bb53bb32fb6ac3fb63503747d1f22cdd814171cf278dded7bbcb3d41ebafb
MD5 f0ed771c02df7b1800d6e064c3601f65
SHA1 b8a76f19cfd268432ba2e6bb25c02aeef6317586
SHA512 1d741e4b0f82576f5a232a366faccdcffdbd12813e82179ad06453172ce480f818d5215d1314b994620d676eea88bea58262a12367e5b357c267b1621cfca5c1
SSDEEP 1536:kEyu29SBVWml7RMk7swv2dc+mlNYLvNg1QjwP:kJSBVp9sy2dyNklg1Q8P
TLSH
T110732CA3A6A871BB1BD037CF2C0BB55B66D18199E7C605CDECEDC50D818C754033A6AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fqkq4vem.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 ec6193c0a2fe41448486015971de377906dfe6cc21ed7e46e9cc29260e99ef28
MD5 45c73c021facf7600dd4ce9e6f36875f
SHA1 280825cad36fc938afb4e3e84dd320090936fc3c
SHA512 137d27a068ba792fae12e30bdeeaacad997f1316cf15864705e307d52c43fda6ecedb1b2c05b7a716cd3a2a32be4f3e958c4d6d661e8ce0a89d941b7dd202479
SSDEEP 1536:jTrliC8/DDxnrolT7OghsIi0sLWETExSPf5S7a53K0oLkpsZw3OFhZ9UHpzpR7uz:j3lqrolTvETVTEkxzpNOx9UJ/a27MB
TLSH
T11DA3AFFACBA3CE3D55FFD01D5A82893EFD272404B3A73019C963631461CABB86675648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q\Crashpad\settings.dat
Size 280B
SHA256 c6a69bed0b1bb8dd6af5b995eb69e2ef3fa7a28a828624de64c676e61f9ba148
MD5 138b7a82317c79d8fa681902cea4bbd1
SHA1 532f97da22780fd2a1563c59258f7a55433d3e7d
SHA512 c739024d3660373b1b462ba2ec4a56b78ba3755b01bda7150e57aec155cfce4fe7e78b24fd5ae2214a663d1d1a45766b6de9a72e0605a64f3dbb89f1b0088e32
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q\Crashpad\settings.dat
Size 280B
SHA256 73c426a033c6588304f0d34e1567361207d09077bc2091296ad633c871727a7c
MD5 f025cd9fd3d893bbd25fba6568f367c8
SHA1 3a6290d53669cbc11003429c7b4159edd3860552
SHA512 b5cbfa256633d8043c8ed65c493bbbaae5f9236330c02a24d47c91905fde6150a64e38d0d4dd496af6143f00bab3c33828f0ee8c6a61a4ad8f5efda719f72085
TLSH
T15ED022FCB302288CC0203230ACB3CF0C0BCCCE0A0CC000C0A8B880380ECB00EF0A0000
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 248B
SHA256 510d9f4336048b4cd52bbd819f76af8005aa8b3d9d950d39fa00350d5f133049
MD5 2a73d741131deee654818e902a8f51aa
SHA1 7cf74cef1f2fb920f83a55566182bb687e303641
SHA512 88924a7b422b22351570e6859b4b76834dd9f1a775e90929fda86219996457b98ed6cc266b0e04bbbdc3a0f7933030aeeb0f8ddee1b5206eb4a941114bc94225
TLSH
T196D0A7FB6DDB6845EE0B93D3A03258A89102BD4C8940AC4E641F72C360713123425C67
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 376B
SHA256 43a807ed1683cc7760c6d051a2b540fa9377d060565e69622a21294b040be88a
MD5 3d4e7cf85b9c4ae1464885b534d45ef9
SHA1 24dd16c6d51bbb83da956d955abecbf5199ba6d7
SHA512 e101e38906c2d9404a69e3ddf0360b3a8d98cb6adce1d2a798768a6e12e51fb85d9a231ab3a4fbd38d12247ecb4c4d1961ecc8fcbabbd7319a87c9e21808076a
TLSH
T168E068B62EEB1814AD6B93D2647140D84041FC984D48AC4F102E73C79870316241ACA6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58972a.TMP

Path C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe58972a.TMP
Size 153B
SHA256 9974740f37d72ce6462b1c5b913778697483b3f58d0edd2ea9facc31d3470e04
MD5 90e935d6a2e45b0ce37ef8fb9b78697f
SHA1 cc4019ea07298316a7a07f867587cfcda4cfd649
SHA512 e6a06c1f0c8920bef1a217c549b72c2bf4b72c656fbc8631364f68360c76d825d814d24a6b14092c7fafb7090315fc565de1c51575c6c289c95eb4c2d94f1bd7
TLSH
T180C04CFB28551441DE5AD2D6423258E99122AC8859C4AC99612E72D334702337526C62
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q\Local State
Size 3KB
SHA256 540449eabb60b764b76a35aa7dfda9c1d789ac98d80bcd7ac92074055e4b5471
MD5 aaab50b3e2fec754e8213b94469c352c
SHA1 2e3c36d9bcd075e8d65e6bc7a46817a5ca74185a
SHA512 743d5f9c226c4b5aa663d8e56c2ff7ed6eb779502cf1387eb48300c4dbe45faf316878d622fcb3e48da85eb2477b02a42fea35a2ee8a62b1963585d154e15c59
TLSH
T12F81B771742CEC2355E96A48B45B73938F7834B7AC256F48E7C9670800EB24C2B0E827
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q\Local State
Size 4KB
SHA256 5a86fac958075e17eb16c11109519b37deb012e6c1f764973af0db0430c9df5e
MD5 b6013bce4e35f39d77752b8980f55643
SHA1 7f9a51f8da7c48cf2e28711c658da61ada3e102c
SHA512 259e4ef2a81e3f02e99e760356ba92a82d11cd6750fbc97bfde2a9d581e70d4f7ae998091ad6c4a135c85ba30670deabe32eb8cc69656bf45a39b921225ef355
SSDEEP 96:vqGNkDQsFf1Ca2XO58Frh/cInURoDotovW2kDBBeZvmbCB3/0eUnpjdq4a:yGNHYYooDUw3S3EBvqpa
TLSH
T1B7A196726468EC275AF56944B48A3352AFA83577E8557F98E6DC1B0C00E738C2B4A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe588cab.TMP

Path C:\Users\Admin\AppData\Local\Temp\0d2tsr50.e3q\Local State~RFe588cab.TMP
Size 1KB
SHA256 41a387adde94a4414ae6b09d308563a90b726f585e2aa76a1fd75608883e9d40
MD5 7e5ec08cb14eac045e18f2d7e657604b
SHA1 2d8ce0e46406fe218b1a942388ead0875389bf34
SHA512 17b86001f119a3d22550b6e206999323d72f8de546367b4d9f8de07195eb5616195da0bd552fb6c23d207f29b395cc56b54b5228941cea55a3503574ef98e9b4
TLSH
T1853173B1A86C6C77F8E11749B20BF7570F346635A02A1F8C97EE1A0C01E728C160AC3B
MD5 SHA1 SHA512 TLSH

Submit Download

8ca22bd6-8be5-4f2e-b21b-7fd619b96b49.tmp

Path C:\Users\Admin\AppData\Local\Temp\8ca22bd6-8be5-4f2e-b21b-7fd619b96b49.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_cywfpjhb.250.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cywfpjhb.250.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

a027f747-635b-496d-8764-54747f1ddce7.tmp

Path C:\Users\Admin\AppData\Local\Temp\a027f747-635b-496d-8764-54747f1ddce7.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a6fa7948-e759-4772-97f3-1753800864a7.tmp

Path C:\Users\Admin\AppData\Local\Temp\a6fa7948-e759-4772-97f3-1753800864a7.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

caqn0tvfpwf.ps1

Path C:\Users\Admin\AppData\Local\Temp\caqn0tvfpwf.ps1
Size 1KB
SHA256 7adb7f803be147e7d00e0b155e6c4f796803fc2f4436801e77829643b67ed045
MD5 f1e7b5f76a6c5f74014259f7b415b390
SHA1 74c693d57a7aef06892ac80d3bb21022cc0689e1
SHA512 dc4b178c0386353f118b4b769875f8faca3086fefe8b0b20b224f687c1808de5200c44d868c8e26bf17605c7cc8ee09f483c4e07065282a4c36b60efa29816bd
TLSH
T1B621045B8E8803D6406447F11503B0CCB21EA2DB67BF05A049DCA4EDB32BD13393ADD4
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\j1c0j2tc.jog\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\j1c0j2tc.jog\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\j1c0j2tc.jog\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\j1c0j2tc.jog\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\j1c0j2tc.jog\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\j1c0j2tc.jog\ShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\j1c0j2tc.jog\ShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu\Crashpad\settings.dat
Size 280B
SHA256 19b8abaee28cfbd1730878b3cf628403dab17a20aac79d1555b7fb798da6a69a
MD5 69eca211d7b941c48d3a88e93a69b123
SHA1 c43a449718d5a5b885d52ce7c9c463fef639e82e
SHA512 5d376d80cda47aafb0a5fefeaec68cdac06133b0c4745a0a2598014273ff7ca6aa1373db683a6560bbd0edd95c59391f5dcfb0b4c82ec62fd62862c5a7b80c57
TLSH
T1ACD00410D3141107F155103541345540D550541C010111140050144D54414C14001415
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu\Crashpad\settings.dat
Size 280B
SHA256 1568d66b64ad0a6afdbccf42897f32b71c51fdee89997b099c18badb2f512590
MD5 89eb5e9077e4850e57e72c2ae650bbcd
SHA1 a5a93fc4835ad350f3adf9caad1b89eb67279168
SHA512 d1957a4fdd3cbbfd295da97d6351ccba58e0db0bc857cae9ad20527c46d6dd2863c673a657da6ce0c3e7e646d7e4e02ae80c5a9dfc7d911bbc825145ad5be270
TLSH
T1A3D02220FB38302FF0B3803F8330AEE8C0CEC20B02AAE003888008CA3C2C2C0B002830
MD5 SHA1 SHA512 TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu\Default\Cache\Cache_Data\f_000001
Size 33KB
SHA256 bcd9f8d1ec62670309f0a0f4f65ef09917f006d8fe3e1552b2088e92dc052e9a
MD5 ae212a9ead4ad33ce324d9a0cf02ba0b
SHA1 e0e823c9785359ac283fcd21deb4637ce4fec5b9
SHA512 172884edd7caed133dfe09db71e0831f85b43faaddade1731e2ec7dc6bde8b68d5120c22bab5ac46e6f43a84e3a2280d8d584dc5c5b2b2112576bad63b0d3169
SSDEEP 768:NxPDDlDtMz7ZYRPPSi+BUjSNdN6AxSkfyIO6U0oJRtSQnEhfU:nPbCUPiS8woSkfPOZ0oXMQj
TLSH
T15BF2F1EF93F8B73648368C04ADE345B5A9E432E9C1E7B0F93741709A4044A185C6DFD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu\Default\Cache\Cache_Data\f_000002
Size 96KB
SHA256 29f31e85536be418b97ec4911920a9954dc14ca18ddc5302c3b015527fd57a9e
MD5 cba62810300825d68a311b82a246de49
SHA1 378c2ea0eb8c9e86f83d323a99d477de070df295
SHA512 f781d4ba4b0a47fc68cd9b6de986635703128c1cfac048310981f4aabdfb5705553f40cf6a8b32d327034e6a14b358d281fbaad17ca8100bf77cc352bd6ee900
SSDEEP 1536:zVJ82fuU1I+KGLAHFHKAYDvxVWSc4KC/lh/c8ODF6ezVUYfeWJNuzBiwrymUrxUO:b8wuU1I+lMFODoDSc8lezbru3kSYGq
TLSH
T15AA3126B97298D90580B7FCC4FD3B2637973B2D2E856E1B5627F02016CEB9291B70316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu\Default\Cache\Cache_Data\f_000003
Size 67KB
SHA256 e7ff4fd8fbe9f4cf43eb0e5a3cb58d39138698f51a93a9e4158bf0cfe8fa7ea4
MD5 7a6eae123fa2364636bbab6833245b58
SHA1 6047b2613241d64b6236d4c914f283ebd235ce87
SHA512 d0850ca03996831989c26f6361d1fe1d9f47deb4cbe6364cb02968aa3b5dd5d34786b5ea8e38727330983a053e3aa96c54ae98e5b8b0aa6bae3623a3760dfad8
SSDEEP 1536:xtDYeWdrm8uosX7CRcf2cqfgLakgNC9n/yNN/3a6tU:x2eWlm8uokWaUI3h/8dFi
TLSH
T1C36301346A3E3EC5A05F43F61A9CDCD1BAC39779179CAA997128F229C0D6DE605114CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu\Default\Cache\Cache_Data\f_000005
Size 402KB
SHA256 a0144656522ab185f6b6d04cbdf050ee23550209ac722653bebcdf09c7cc1279
MD5 3bdc2cf3a60b4c5042cc39f99e61bbf6
SHA1 2bbb397db695ef5c1f955f7ce2e8b780d9bf14fc
SHA512 1e2e30663b276bfb4b3ab46e2ddb1b8a9a2d87e50c2869bfb431452fdfc01d0ed958f9938726e1c68be9b4b6cd8c4e7b360e485ba831f55af71e2f38a275cbef
SSDEEP 12288:8H5CH036tbqV+vrs4Z3NXO8lUKofa7KgO4:8H5pLV+js4ZpO8lGiK4
TLSH
T1E89423890E2FFD33FF18911E3B2560D157B41819E9EBAC0B719E1B6B384DA7D2427246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu\Default\Cache\Cache_Data\f_000008
Size 27KB
SHA256 97b5c3b18d66eefb5c1c8629a0a979875a7334938a121d940ae9eb4d4f14dc9f
MD5 f3c0878adb6e3d757c88acdf6cbcab23
SHA1 1e1fbf12f0f69a382f1c239ac3525b6582733a8c
SHA512 884ba4bf171c912ba7f9422046a2e824afe386a0590d0eb4628314f83e165037cd8b5a88712083caf6164f343a1d0887ff2646d41e3a9313a7527e0761c5ac4b
SSDEEP 768:KU3SHZcK0jhwdklmvg1a9xYHGY2wO47HG:5zlwvlMHnDG
TLSH
T16DD2F150C15DA61BB72D1AE9CF5FC7394DF4EE80224F780656ADF06BDAB00115B8970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu\Default\Cache\Cache_Data\f_000009
Size 77KB
SHA256 9e39486440a3c89ea544632bc62773caa3c30a69c0d66e998cebedffd798f6e7
MD5 14a782130d5fba11d0d6907167a1acc7
SHA1 a0e93036607920bea09d67d19bc2e5d01a1d763e
SHA512 879ab9e70cb2361f0db1227c607622066276d78df0a0886cbc7cfe17b17e89bd0a2dca9f2edf4dbe4808ff0d3aa6b5ba158c0de3837423f30131b811b4a55032
SSDEEP 1536:A3RdY10tY8B/NnTvtfauvbweOSCk3qunGehtHn1ad1rRD6JM4o:YdM0tlxlrcu0DSYqhV6ZRDuMP
TLSH
T1C97302D5EA9BF9F382C4AAB49C780A64138CC4CDD723B93A837A4DB1D0A418D76353C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu\Default\Cache\Cache_Data\f_00000a
Size 19KB
SHA256 39d2f0b409ea7f5c6741ce06f4e42f63cbf63e14e4e3ae38c88943f78583aa7c
MD5 3d269ce4bbe1983370c1ddd6b4ba569f
SHA1 e6bb57b425d38e05723457fa695156f889868e36
SHA512 91fe40e1d295e11d9e4bb5950061961496a140c2a05b47f97e6a8dad6593be160ffe931c09093a38e7038a4396943257a04d3e18c23fe63cff6a2d153bcf67de
SSDEEP 384:cKQxo4vJfpmhs5iKVCKyBicivJ+c6SMBfA+SVZzoA07CGyCjC4Pv:FUvVpmOk0yQc4OfrOZzHHGy/Yv
TLSH
T16F92E1AC93DD7418C6817721057CEEC65EBBD93E307913033D068A4B67B61396BECA20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu\Default\Cache\Cache_Data\f_00000e
Size 59KB
SHA256 ac2d5e8c0163675d5a39c26423f0be55c323c86628a7d7a76193c06e6b5af4c5
MD5 5c96515bd64ab139a074b7934d221722
SHA1 228a176a0210f7ad03314cf692a2e24355745d78
SHA512 d1379e23b61945daade2bcb94718ed0d101eea2c90b5f549333871764cc585949cfcafa28f9ab2b63f408765a336b9ad6f41949c30d2128b484c805dd470f4cd
SSDEEP 1536:w53Q6PSnPxx8XFUyCuDaYs6hw2wjK7Qg83sICAcv+lnLj:wxb6Zx8XF/CEaAS2wjK5esdt8Lj
TLSH
T130530189925ECA6BC1F8B4C6C9FB82362140D86F5D4F0A7CE9BF6100702E7A5D49C293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu\Default\Cache\Cache_Data\f_00000f
Size 72KB
SHA256 ddf3077d8b428fbee82ecb6336d54f25937daaf7dc66afb15e933d58868f5960
MD5 d99440b7711d078d2f12d4b1fb8665b3
SHA1 f68a021ccc260f1c733e1835ba129deefbf46b4a
SHA512 1c0a65ac7b21a00ba9f978cbaa9e69acbda56d8d1b825fabd0f9bd4a82e7d0986722394e0695748ccb421611f85947e5ce990d343b95d51aee1dd9033efd0226
SSDEEP 1536:79YKzsxq8LOJVA2V6+LgrJv8LQoRwXvg0uEgM2q68s:7SKgxGK2orgQoR4o0byj
TLSH
T1C373023588194C781D0C99C7EB1BC28E3155EFE2890DC59696AF488E0BDCE7AEC156FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu\Default\Cache\Cache_Data\f_000016
Size 17KB
SHA256 84199bf92fd6b65ba80ad32b03484aae8272d62d361449d9fe9747f63b745b8d
MD5 6cbe4e49fea69d111aed4ca0f908f8cf
SHA1 2d92c85a82ee0ba493b772cf8bfe3533dea99a88
SHA512 b1e8959d38f3247c4b9a91a6d021cc092d213607ca3aca61bdfbe1861c07a37684bf7e2bee11041e9ab8c9779d7c165acbd590822f2e273f92a6e31b48df9464
SSDEEP 384:HNTMkaT/tyEXNPNaPzMeS4su5npRTPjNAb+2spnjBUem8eFM:HCrQsNkPNS43pv2sZKM
TLSH
T1A272D013D62FBA5FA4AD856BC0A7B051B4D329B04DAB8D235519ACFD722491CFC2007E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu\Default\Cache\Cache_Data\f_000017
Size 36KB
SHA256 1f2687975699221845603893277696a0c1c50970b5c77d1db1af05e8dfbd5b89
MD5 b3dd32a3d3c41e429d7bdc6005de7eaf
SHA1 a0d3e3e0946439ffde8bc35aac02b5b5b7e1a068
SHA512 41d5238708923af187cbce18224158af9e75099e3633984dc8c4304880d7b2db95af6b02dc7fbebe85a2ab03f81e287596c3f7c8712c1768e832bfb1c63c72c5
SSDEEP 768:Oz0SeiaAMNGPXECQ9Sq3UfJ+cJpUyJ11xpoiSm/RhKuJQoib:y0SeaMW0h8AUf0ktFxpQuJEb
TLSH
T1D203F1F6D768C413B65C68940E56E6298F459E34F36E0E9FF2C256F283331ADD1B2884
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu\Default\Cache\Cache_Data\f_000018
Size 16KB
SHA256 5333864ecc3ca714e93deb11b85fd39d5ba952743871852a3c8b99390aee9c1f
MD5 878a1009ca77cb290f78a4321430b354
SHA1 a664c6d43477a601e1aac114188c2ed1aff17776
SHA512 9e72deff07d1385647e6ba5202d5d5dea516923685f5c0d742e37dad89e5a4957f8dc085c9495276ce14eb7c47fb65ff6cd8ec2bd7a289392247430dadcd9aff
SSDEEP 384:g0s9EJmbRs7oY7Px8xf5JbP2xx0wCg+cq6fRFlZ1od:JyV4o2yKHb+cpFlfG
TLSH
T14D72E1812BCFF27F837C3964280817CD12AED65FEA9630D48062D2B6ED7898B6951C14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 737a73f0ee83fea8eab62985bdd5aa96cf0e4f7e8062dbf613639676bd2a469c
MD5 250fe81be063de72bebffc9db44668f5
SHA1 57b2924a64d2c6a6e6c07efc3afc26d8262ce063
SHA512 ac01d9b75647f37c65d141eae4df4a1d1b5bfde910ecb26ccd7776f3924eba853f86b16e1c83b96571057662e4b2bb92efc15c9b7db8900d87d8a5d44cf313b3
TLSH
T17F216C3072AE27813C7DA51CCB54851B824130E1B1B6753BBF6830D9AD26E005EBCDDD
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu\Local State
Size 4KB
SHA256 e17b0665e8a2873474580b5607e4d7e195c335354343b8822dd2fd92f1b787f3
MD5 1e4bc2281abb5f4faf9e95a351203b1f
SHA1 e36b5deb94f029b1c4e7d6a0fb6aede04e92c70c
SHA512 4b8cc8a3ebe3bfe48e5f30b0f2762465369058177582b401731372d14b930cae5a08260072397f9e6747e9bf415311618d76335519e68af9bdffa0f602122b87
SSDEEP 96:rqGNklsFf1jCQIJ21KODDKIiB58Pkv4eTgy0/0eUnpXzq4a:uGNaYGMKkKIi5G1yiqpM
TLSH
T19D81B6B17439DC3649EA650875CA76938E7871B3DD65AF54E3CC570800E734C2B4A83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu\Local State
Size 5KB
SHA256 abd75c66996fda9fa589aa9e2f7fd0cd00ce01c871db1ce8a36c8cfdbf7832b7
MD5 33135d23486725e0255c6d93689a0367
SHA1 239a9ba056901b036d45060dc95ac9d7dcadcfe0
SHA512 600155e906f9195bf1bf3db5382a4c225f8eae2147e0ad591c5da0e1fe1cd03f5eef50b2ecfa520d116ca13febcbf68c2541705d767d8693aa5ef126695ffca4
SSDEEP 96:rqGNkKQsFf1jCQIJ258Frh/cInURoDotovK1cDKIpB58Pkv4eTgy0/0eUnpXzq4a:uGN6YGZooDUwKMKIv5G1yiqpM
TLSH
T1EBB1A6716479DC374DEAA904B4CA3743AEA47173E895BF98E7DC1B0C04E7388274A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58a3dc.TMP

Path C:\Users\Admin\AppData\Local\Temp\wo5nzhey.snu\Local State~RFe58a3dc.TMP
Size 1KB
SHA256 6e25244c78754aba5b4ffd3710d8b2e3575e4056eed9576daa80ea1edb892c0b
MD5 ab4e58521fd3c56b2db654129c6fd966
SHA1 7c43180b2356db0b2d44f515788931b9ece06848
SHA512 946daf359d27b1381360bf902a28da7000664f32c58e8c98a9e0f158e87ae1d71e950020a29228c7633dbb316d30af79fb7da8161683581358479ca857f5f91b
TLSH
T11B3186B1BC791D72ECA2550AA2CEBB5B5D74A172C0656F48A3DC5A0900F368C664AC3B
MD5 SHA1 SHA512 TLSH

Submit Download

BCuZxCyoAooO.exe

Path C:\Users\Admin\AppData\Roaming\BCuZxCyoAooO.exe
Size 1.5MB
SHA256 55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7
MD5 6be8ddcc17d262e9a648712cac7ff348
SHA1 41d50f868c0a14049c88df57c2c47c4dc859815e
SHA512 5b6cdaab6ca17b2dfa0fed801e86b58bcee4f8bdfde9bf5cd3e3590310159624a896ad9459e447a187e3d74729d030a5781b110cbbd8d8921ab5c686801e2f89
SSDEEP 24576:v14A+J/8aH2qB6jzSqECsw7PoNNnvQFWthRKgE+1qwRb9UQ8QWVUdRi2UhR:dV8fH4WhCswToNZc8PdE8fWVui9
TLSH
T146751219021FDD06E9B7CBB80860E3B406B49E546A35D313CEF6BEEB783279169053D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

T8IFM1NETKJP4N3XWSKJ.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\T8IFM1NETKJP4N3XWSKJ.temp
Size 4KB
SHA256 b870233a4eb522b7ae7628b29848b38d8202894a7041c9bc3171fade8326891d
MD5 35634637ee9f55c8616301711dab0861
SHA1 b8f63258c702ca73451bbbc7e2f2fbe703100761
SHA512 6f341496d76ef8146208b0721a59109e15006ceced1ca85018d82cd898d170889072dcc0cb1b8c39ed83ccc679c063fa24a14a01dc3d5734d9198c52ef4cc2bf
SSDEEP 48:C17/dOsEnkNqJ9zCNYYdLXuH8bHBp387/dOsEnkNqJ9zvYrgdLXuH8bHY28:ChUJoFuEHBZaUJvEIuEHs
TLSH
T1EA91E1406BE61566F3F7DE7195737B21AB3ABD094E184A4D00C041481C32F19DA6EFB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 1503f0fc8fcfc1109619f03e2e6d9121722317c8158ca6e51a1324b312072738
MD5 5d37741e3a959cd6d2746f7a5e862b26
SHA1 e7846686338d665cfa96775f84c2513a44bae1ca
SHA512 1a6b9a3b5b8f0acab7a5b6582c5e1b2d04f9590f0a5e662d079ca883215e987cda23eccb5f9ddc027dde5c43d3ac949de7df77d8816724d5d3ee261eef7a597f
SSDEEP 48:gX17/dOsEnkNqJ9zCNYDwdLXuH8bHBp7X87/dOsEnkNqJ9zvYDTgdLXuH8bHY28:gXhUJoxuEHBFXaUJvQIuEHs
TLSH
T11A91DF406BE61666F3F7DE7295737B11AA3ABD094E185B4D00C442481C32F19DA6EFB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0a4f3c2f-e28e-4930-8bdf-1abe16807904.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0a4f3c2f-e28e-4930-8bdf-1abe16807904.dmp
Size 65KB
SHA256 620a21cdb77f2fe893220011e10f1c97c6f4bb95824c2e788ee3615798b89629
MD5 f818b25f859b97c55156c2d268e0bc57
SHA1 99f926159f4d05b9f23b6d3404927fef7d31f037
SHA512 f4a4db027431e9bfdcebc3fec66491ccc652df2ec1fc9be253b518736d861d48400ae19fef963c8938e8c8887918fd38f5465c2c1413787cd0d4f639aa9043bf
SSDEEP 384:aWdkJTMvJTCvHTCjTCTULl5g/wWmPs7AVHZt6l0pV5xCnblq3iYrz5PMOyzUYOVh:ahJokzKlG1soBAxrz5P7yoYOi4
TLSH
T15A630F6A63D01662E42536746AE7EB60BBF6F41C4743435BA260D2BA1C6F3C56C3CE13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0a4f3c2f-e28e-4930-8bdf-1abe16807904.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0a4f3c2f-e28e-4930-8bdf-1abe16807904.extra
Size 10KB
SHA256 782cb9c57d0a2680b49f7ebd3a39c27b17ef5f0a1eaacc55131a793c8d1fbd41
MD5 f4892f4ef88d23e95f63aeea49d6e1fc
SHA1 bb53898bd5e4f592143eba92e28ed61a61aa8345
SHA512 4aa76a7298de24faaa3b2cb0ad77cf3436924f1962fe6dfa0913ecd695f23bbba9bfb37204be54fdd3e33237f5cf41f2baebebccca71fbe586d87021c951cc8c
SSDEEP 96:S7WCRTUXQY6pw6FFFdW6H0Rh7CsevBb1d0tjMLlIrLlhTLlaXv7avMcBvtILI5q+:ShhUWFLG7uvZ8JLPxsPpwljYfoP
TLSH
T181229453878724B79D5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0a4f3c2f-e28e-4930-8bdf-1abe16807904.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0a4f3c2f-e28e-4930-8bdf-1abe16807904.extra
Size 10KB
SHA256 a72fb329e29f5670019fc851232db67e19ba5b092baf5dc8eae6c798557d4e5e
MD5 e28067ffa521428124bbeed462f21189
SHA1 e58e3453500aea6085505c0035eb871fed9eb73c
SHA512 036288a14e045066605a054d2d32d574fe1d0c4143870e97533be5d4bb8f160439fb2ba65ecf38f657b0a601e9334747b525c5b041482909140a547fc6cc7aa5
SSDEEP 192:Sha6cFaiR4pmnTYapdVxzPjWBH84TofKNdalLYfojbLB/v:ejcFaiFz1LWBH84T3aKAjl
TLSH
T1BD320A31481CD837F7D7AC8EBB3A2E3AD66D7B1A00E6389C40CCCA59C1A54786779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3410721c-4130-4c2d-959c-02e0cbce8787.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3410721c-4130-4c2d-959c-02e0cbce8787.dmp
Size 64KB
SHA256 c4586bfd5bac0195f48d5e5f4b214c470d5b5061e9d4a59cbe775c6dddc77d36
MD5 01ee938f609425c71a93280bbdabb3bc
SHA1 36d519daa07f7b71dd3564b71436922466cf81cf
SHA512 ad2bbbd6b1045f6e9dcc31b2dd222918649efdef5f2933ab4a738c249ee9101b86e963d10b5a7aca5202351b6d25427b3c2540c09b907c675b857b819b223e37
SSDEEP 384:4+kJLEIC+CQC1Umtwl6m/88JWl8H/KxEEdGRiSWRj+6uMOyzUYOV04:4XJLaRQlYaHSmBWRap7yoYOi4
TLSH
T16F53EA5277909972D02392722EE7E7613BF6FA180753A39F622051FA1C6735A6C30F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3410721c-4130-4c2d-959c-02e0cbce8787.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3410721c-4130-4c2d-959c-02e0cbce8787.extra
Size 10KB
SHA256 95060832d245c6fd194099cefb86b97200aaee0e36d6575770ba64a234368a9c
MD5 805fcf0d00456f30ab148873322b10d9
SHA1 e5bf1c2bd5a05dabfc0ace47106737da4bfe5770
SHA512 190797faa3cda8899c2794b051bbf21e9edc627649babeecda880e5e12958b6a85f6e0d7829a7b8672be7cb9f581f5acc80e3b1617d5bbd45d6dc4f2b0081bd0
SSDEEP 96:S7WCSloTUXQY6pw6FFFdW6H0Rh7CsevBb1d0tjMLlIrLlhTLlaXv7akcBvtILI5e:ShSlUUWFLG7uvZ8JLPxsPpwlP6foW
TLSH
T1DD227353878724B79D5194C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3410721c-4130-4c2d-959c-02e0cbce8787.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3410721c-4130-4c2d-959c-02e0cbce8787.extra
Size 10KB
SHA256 f75905b284a58de5f9746f6cd68d05e3fe40b742fd84c1abb443298d354c7b48
MD5 b76b40fb72fce36e26421ff9f904c1af
SHA1 e3cb1bb72c0a38f6fb3b13775de1a060c6d5d793
SHA512 d520fb865e406756e09f10f860c9704ae1792cfee011e8f1e6469b875f7514e5b34606731be4650535fdc060f00ff1970ac73daeabc50bc5203ab475a551d2d8
SSDEEP 192:ShSl96cFaiR4pmnTYapdVxzPjWBHC4TofKNdalH6foObLB/v:eS6cFaiFz1LWBHC4T3aQAOl
TLSH
T18E320A31481CD837E7D7AC8DBB3A2D3AD66D7B1A00E6389C40CCCA59C1A9478A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82b80b7a-4af0-4f64-8459-bffee3ae5336.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\82b80b7a-4af0-4f64-8459-bffee3ae5336.dmp
Size 65KB
SHA256 05d3a3bb145079ae6d2f06d019e17fb4b186151ac76588948c265b8bce92027d
MD5 2463b3b3add13ce8dc47c34a532b7691
SHA1 7efa0d744a3557103b373836e8292edc7a337940
SHA512 a2980259790502bc26e7ca524ba589669c0c8e97d6ffbc725d6251d9fe669e5a31878bfe5da89969abbdb0d5a254eb9a4a91d26d9241a520633ffa2140b1b148
SSDEEP 384:1JkJIVlr8NFCR9r8NFCPr8NFC1U9osM45PgoU9+sDcBa/kzDk4PIObVjB3CMOyz+:1KJIz/0os8P94PIORjNC7yoYOi4
TLSH
T17B631D9277840CE9D82517782AEBE7613BF6F954678343EF262051AE1D6B364AC70F03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82b80b7a-4af0-4f64-8459-bffee3ae5336.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\82b80b7a-4af0-4f64-8459-bffee3ae5336.extra
Size 10KB
SHA256 869d6b48d680a51c0cb37ae16cf7f4e7d14cc7be9772554fefda66c654cf94d6
MD5 b6f5be30d6d0d1762c2d605220559f45
SHA1 77dc625341d80b6b8c7a125e461c702fcc13ad0c
SHA512 78947b83bd476b334de026ebc73d93ac834ed8913accf6fccc54a637c630509b2720d0898738d9dc549b16af6cacc845268de64b791d1154763fb428b67f1c12
SSDEEP 96:S7WCyTUXQY6pw6FFFdW6H0Rh7CsevBb1d0tjMLlIrLlhTLlaXv7aLcBvtILI5qw/:ShiUWFLG7uvZ8JLYxsPpwlPlfoA
TLSH
T15D228353878724B79D5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82b80b7a-4af0-4f64-8459-bffee3ae5336.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\82b80b7a-4af0-4f64-8459-bffee3ae5336.extra
Size 10KB
SHA256 3ee5e94a29680e88cc13661bc2475b013350dfe1e8a042ad9bb3e17b574e13ef
MD5 57fd9e927ccbc30683e30b98c2e543cc
SHA1 630b06175e99161e08bb2688cf03dd4deffde83a
SHA512 80ba0c885cc29e954e3faadfe136f05738abb6ee926418c2b72ecb50ab69deb5596d63f7c67b8bd4482bd2dfd2d955b99b43fabf4f06b11e80c0645fe70d7d0c
SSDEEP 192:ShX6cFaiR4pmnTYapdVxzPjWBHR4TofKNdalXlfogbLB/v:eqcFaiFz1LWBHR4T3aHAgl
TLSH
T117320A31481CD837E7D7AC8EFB3A2E3AD66D7B1A00E6389C40CCCA59C1A5478A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1044b05-6d41-46b0-ade1-99217503484f.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b1044b05-6d41-46b0-ade1-99217503484f.dmp
Size 67KB
SHA256 0ac6f7c9e226caaf43e95bcd37e9020ac75e0c3a008fab3e870fcc6f12ee56b9
MD5 43a7aa274b98c361b51c776f37833408
SHA1 7ed4dbd06c61a59ac4ef3761dce1701f24c2b9c6
SHA512 c125986bd196debf80894bb48db46478858dd9b8b2e71b2b914746a2da7502b974bd3fb5efd6e7b6913620d8d6fffba0551734d8e85f238fb7b4608aab450230
SSDEEP 384:fd4ZkJkxomfHCLfHCLfHCZUqkn92Y/JWI6RrZMJQfdw0DMOyzUYOV04:fyaJkx2on8Y2RrOJQVw0D7yoYOi4
TLSH
T1AC63EC2773D009A6E22D16746AE7F76A7BF6F8048793435B623051AE1DBB344AC71E03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1044b05-6d41-46b0-ade1-99217503484f.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b1044b05-6d41-46b0-ade1-99217503484f.extra
Size 10KB
SHA256 659a7c4a8d307aa232b73dece282d0714579e0cc472f538e9dc78103c535dffa
MD5 893754f63d511de1b0a3a33a1176e42d
SHA1 8b9af70c08e6496af77042fa37bf7ac3e44a6186
SHA512 1889b0fb1852dd63241adc4fae8401c222577a3d3191d1b046b451803b3c400c883165c49af13e30cd45fb746cd76dfd5993b141dd9f2b32130154a3c26517b0
SSDEEP 96:S7WCDTUXQY6pw6FFFdW6H0Rh7CTvBb1d0tjMLlIrLlhTLlaXv7ancBvtILI5qwvC:ShXUWFLG7WvZ8JLcxsPpwlxCfo6
TLSH
T187228453878B24B79D5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1044b05-6d41-46b0-ade1-99217503484f.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b1044b05-6d41-46b0-ade1-99217503484f.extra
Size 10KB
SHA256 149e3aca505882ec127572c96b268fa43342144f8060e421e4dc7928c278981d
MD5 bf99b12563c22342e3b8ae10726fc8f7
SHA1 4620d1ee5d761e360b37d3c40fd05d19d4d9c5bb
SHA512 dae52181876a7c95f2a0780cfadb8f77211b740409e166c2ae3e36b580dc28d1b1557b145b372bb0f771afb8f006f9a587c47a82fe4b4e22f1393fe590e32bd0
SSDEEP 192:ShM6cFaiR4pmnTYaVdVxzPjWBHf4TofKNdalJCfoabLB/v:ehcFaiF/1LWBHf4T3a6Aal
TLSH
T172221A31481CD837E7D7BC8EBB3A2E3AD66D7B1A00E6385C40CCCA59C1A94786779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5799cb0-3947-43f2-868a-99ecda8a0adc.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e5799cb0-3947-43f2-868a-99ecda8a0adc.dmp
Size 62KB
SHA256 eff1445f524a7267eef4450c222a1d5523462b3d1070ce20781e70341423c479
MD5 3ba860a7c4a9d8bdb372c32dff46a89c
SHA1 c5d8fa73472ed26bf49dd3c159c023b134c77a2c
SHA512 356acc6c260a3314a127d06e55450b0df9447a3ef5b3f83e370b4ab2aafa8cbadbeeb44cb393f557c5d7259766af34ab90536d983d7935c40d642758e44b22cb
SSDEEP 384:qSkJop7Q2tUpULxkV0z/En8iRbA7FUJVLOKVgeB+gOjXFGsGdzpFIGEV3ZMd61k8:qrJEkKpOUZ0NhjryW3DwoCr7yoYOi4
TLSH
T15453FB12B383D9B6D13912B42AE7E7A93BFAF4156347436BB22051BA1D673446C30E37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5799cb0-3947-43f2-868a-99ecda8a0adc.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e5799cb0-3947-43f2-868a-99ecda8a0adc.extra
Size 1KB
SHA256 89c1989122d72a4b421b96d2a396a28beb68d8ed5cc71d7a1ad0e2c0de01362d
MD5 870c0f4a52510701a1e1b78e5cc242b3
SHA1 7e06affd093ede4682ab428640cb0634e3534e13
SHA512 ab6912b16d0d901aa84df4500d3e56f48ee08950b5bca96600ae7c54a9abf52901ab07db9bcf34a111cb7666368954db25bc54f08beebb73af41b292729f799d
TLSH
T1DC3174B782EC2D228A578A98773A13038A9DB32744E35D0D35CD464C818E4DC9366AC7
MD5 SHA1 SHA512 TLSH

Submit Download

e5799cb0-3947-43f2-868a-99ecda8a0adc.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e5799cb0-3947-43f2-868a-99ecda8a0adc.extra
Size 3KB
SHA256 b1579c1f6a2ef6edaeaf812184d8f24d11ebe300d6a9ae1234860d3f92e7fda9
MD5 a68d766afa3592fa2bfcb660bc92f74f
SHA1 91a9bb2697e24d917f5362c2e52ac596cf5deb38
SHA512 87d1d17e7031472cf4bfe596b7fd346032b8f89a7d4c44a51679936b8beb9db7b8b3c8514a217c8a3454d6b3e1a6f7bfbd97bc1a85389a1ca8a052fcef91279a
TLSH
T19F814372409CE8375AEF5D8EB3376D1D99DEB31998622A8C50DAC36C45B8CF46387183
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

store.json.mozlz4.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\crashes\store.json.mozlz4.tmp
Size 8KB
SHA256 c939b31292ca4a75a72882fb4bf98f3ca5cd21b0daa43aa606ddf995360fc9f0
MD5 02d0c44c6e17ffa11d4a5618436da80e
SHA1 dcc220366e60f020c62ca2b14886a0e9057f72de
SHA512 beb6979820ea463736ddbc76c4d83a01773a107779f2ba49d35328cd7c13546bf2fba53b2fcd5c7bd93b2b8b487e1d89a02259403151a575918aee5539c551d7
SSDEEP 192:mGt4Jg/QHXMMStfuhC193Nqxut6ukukGKzw9+n8r57ljTjkZO9O9+4Kcy:mM4L1smc9qxut6uWJwJN7ljnkkvzr
TLSH
T19702AF32EE883A76FF808C4C7867A78105186F1B08C9FAE41DDB77A445F16949F14321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\db\data.safe.bin
Size 7KB
SHA256 f4d58f800c4c0b2327fdaafd40c05a70f1288c732a893b906ae8f801f0be777f
MD5 0acb669cbb1a2e7695d4e5917c80be92
SHA1 874549167954c4fbfd2c3fca96750c6c1b14040b
SHA512 3eb20a65ed1c26298732f647f2693c76b3b0631f799d33593487ac6253dfd2cd1fa17aa7ac35ab3a8c38b684310d78d6e71b5bcf66448a55e564902150e02aec
SSDEEP 192:tOv5zboPlZVTyjDyNss21d66JozGzgCl6mc0dz:CbotZVTyjH3d66JozGzgC1jd
TLSH
T135E10C64E629863FD418027BCCA22F414F39389B984E3F2836AD605C2D573DD3A8D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 f0e8bb31d14b60b4eabf4b09e11c363d346b4170006244419bab81a06e951169
MD5 d5134f85150b8ee86928a508581f56fb
SHA1 3f4f5cd4897ec83667e3230f839d2b08bbf78bd0
SHA512 e19be0320b67cfd19f39647563b596e7dde3474fdbc3b18ff4cc27c63d35e2f2c622a2819763375a6274e6f87ec99e0bff6c88ce7e6aed0d0c8a1cfc5e0de909
SSDEEP 192:zOv5zbowbVTyjDy0MuX1d66JozGzgCl6mc0dz:cbowbVTyjzld66JozGzgC1jd
TLSH
T1A4E1EB64E628863FC404123BCCA61F414F36399BA84E3F2936AD644C2D5B2DE7A8D17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 c27d6732eedb0ff002632f0a4d6cd43402ef8f9b6b8cc3df50482e4225406163
MD5 91dd630b9bd8307401d2500d1951cbfd
SHA1 792964819e30a486290fad1571d88b3661e11d0d
SHA512 ca52384e8620d8161121579c6ac8da31fbcaa2873293e31599f75a91cf5da93d0beafffe3e7328a3aaef59078ac2e2fb297f04944970341f64053ec037394ebe
SSDEEP 192:0Ov5zboPlZVTyjDy0sh1d66JozGzgCl6mc0dz:XbotZVTyjYfd66JozGzgC1jd
TLSH
T160E10C64E628863FD418027BCCA22F404F39389B984E3F2836AD605C2D573DD3A8D17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 0d0dfc70f6933ecf922d21e822bf867ba76f5b27684e5cd685adef1228358f28
MD5 eaca52d9166b35188b74d081a61c0009
SHA1 b8fff981d62d956a2fa8efb6fa7d949c0256f47d
SHA512 720ba926f41e3c84d146ab515a09b0ba20ce0b80ff9e698f53e90c18775909e0bffd3e7b688b5955a53abc5e6ddbcf574abeee455cf6e7d589f33e353310c555
SSDEEP 192:HMum1d66JozGzgCl6mc0d/Ov5zboP4ZVTyjDyL:HAd66JozGzgC1jabogZVTyjG
TLSH
T183E1FC64E628863FD414027BCCA21B814F39389B984E3F2876AD605C2D573DD3A8D17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 ef6949b06c5d58789ffddf6029b0a6637f07a8ba80636b0eee3377b30904b10b
MD5 460c6ef3fc496758f04b3cb29430aa0a
SHA1 704de23d1b3e65903d03f24f28f2cde4c7576c20
SHA512 6dc3bd8ca1be7cee3116a61569adbd4f440719d6fcbeac31d707eb71a7088e973331ed7bdbce1bffe76f02dc10942e339a9115cfa31eff4eaf2be38bcb8698ad
SSDEEP 192:qMP1d66JozGzgCl6mc0dXOv5zbowbVTyjDyL:Bd66JozGzgC1j2bowbVTyjG
TLSH
T166D1FC64E628863FC404123BCCA62F414F36395BD84E3F2936AD644C2D5A2DE7B8D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 b4f2a03d8aab8eb81e1a4d7e2fb8148a59d1b5683ab9a74fa80b7c99bd1d1d39
MD5 1efcdfd2e9696772d9ca2b60506977ca
SHA1 01ac53f6bcd3b0c314d53d45711c7b490e362af0
SHA512 130b4495bf0e7a628fc530a44ae8266303748f4efff02679e016b442ef5d58410693cbe16ee378c768d65d845f1d9f5ea8c76d3d779cd9bb8cdd53f6bf50abfd
SSDEEP 192:mOv5zboIbVTyjDy0sm1d66JozGzgCl6mc0dz:dboIbVTyjYAd66JozGzgC1jd
TLSH
T189E10C64F628863FD414123BCCA22F404F3A389B984E3F2936AD644C2D5B2DD7A8D17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 befa0a927581b577c2a16a0fdc91ffda116b94bb476b13ac1f8e5cfaa283cc5d
MD5 ade64b04ac9d2cc5e954539e1da1161f
SHA1 56ca335e59c36b4da06d55ac8c8ad4f3ff3b0480
SHA512 5c996ade81b8277479659c8426c7f1a3816812e744b350b51852232856479d45909a4f3c9ab6a6eb8c95aac501d32ac16864d8c9e85a382c11cb94fc8708a613
SSDEEP 192:YOv5zbo9ZVTyjDyNMub1d66JozGzgCl6mc0dz:jbo9ZVTyjUZd66JozGzgC1jd
TLSH
T12CE10D64E629863FC414023BCCA22F404F3A389B984E3F2936AD645C2D573DD3A8D17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 b71e8356ecec4ce029ce1c19f8d126c3bc0a9335d616c71b68d22bd7c14242c7
MD5 ab153e131f32ddde237fe11c560c17c0
SHA1 1768132b0e1809587a1e860055fd907115e3debe
SHA512 b9a13d93c76f650bbfb244f4fe506d01d58e57bfc6875e16f5edef4329fb4a6754944aceaaa1b8ff8fccc5c10b0ecced4b5f231e405c4c8d03fa4a0ae2ded721
SSDEEP 192:0Ov5zboP4ZVTyjDy0MuB1d66JozGzgCl6mc0dz:XbogZVTyjz/d66JozGzgC1jd
TLSH
T1D3E1FC64E628863FD414127BCCA22F414F3A389B984E3F2876AD605C2D573DD3A8D17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\events\events
Size 1KB
SHA256 1777a858fd90edcf64b4886ebb28a6bb71d67a64ce03c432234ac585f510fb99
MD5 1b9bd30a367cfbc4577c88addb731901
SHA1 4d2517868ee95c4ea2f32c0997cc99539a053596
SHA512 9da385623ac1610c653d2773659470fbd8179f161c6836659ae08769e3b3b8fbbf4f3dffc87f28f15b68e32a62b3eacf33fb7efdbffdf5e46cd085ab25bbd438
TLSH
T1F31166AC39F84D6A9ACBE29C744142CE9756CA0349872C434D52EF8CCE81AD9337E53C
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\events\events
Size 1KB
SHA256 1f9a1105cf9a86f42b2467f65e5f3dc2eb56492dafbfbacf374582c8dfa1ec40
MD5 592bbeda18112490bb48e79ef817e94a
SHA1 c1c21e22a1ee4c96bdb552eda6226ca62c3b13b2
SHA512 04281ad8e3dd3706d3400c44cfca61e3d2b9d0d9255b28980ca3b55b0251d191de9da9c5d9af021573b93aac91952d569b082106bf515921ed863a8139dedad1
TLSH
T139216A6C35F94D6A6AC7E29C745101DE5762CE56049B2E830E06EE8CCE82ADD327E438
MD5 SHA1 SHA512 TLSH

Submit Download

09096909-7879-47a7-b362-d69b15a3b64d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\09096909-7879-47a7-b362-d69b15a3b64d
Size 3KB
SHA256 afbd55627964777d3dbac0c0ad962ec368e06f7326a8367cb95d6feab21126c9
MD5 f2e9b30a7ef34fe56ed2d0c3aa5d8b82
SHA1 fc306adcc8ba848d926cc5b96359f99dd707e85d
SHA512 362eb10d3025b61bfb23f34797a7974c60e4a5b2876253ffcf642242264f3435981e10efbf5c4d4ffa666a2eee0a30ea786b0214ebed5706f2672374cea00bd3
TLSH
T1306162B15654A9338FECB045A3776E45CBDE33CB58470B8921668D3446F84688BCF26B
MD5 SHA1 SHA512 TLSH

Submit Download

10d046bc-bf58-4fe3-b955-094954f4aef9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\10d046bc-bf58-4fe3-b955-094954f4aef9
Size 886B
SHA256 700047a906cbb44708a22c42acceb4b14bfaf89ffa42f6580f59ca478a21750f
MD5 4bdec0355940a85cd75b852562990df6
SHA1 959c28241eb20e07cd57d5d9f799443f64c1e288
SHA512 6188ee8294367471dbd193cb4acae8576cd213ddc415978aee84060c581b4cf04165683c7af80db31b0e2f12ef0580c104ecb88c55fd365d41aa8c77086a34e6
TLSH
T148110060D638B5B28C78925795E177438BE03023C0C619147EA15A184DEB22E63AA70B
MD5 SHA1 SHA512 TLSH

Submit Download

1362a8ce-5f4b-4aa6-a631-0af3cdaa8aa3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\1362a8ce-5f4b-4aa6-a631-0af3cdaa8aa3
Size 871B
SHA256 6a22a5443878a2455e693bc9d3aed2ada8380bb73837273bc76d42f5bf3fc63d
MD5 fa3abf8e72a43082c81e2fb69e243bd7
SHA1 dc6016a3d46be7c30f9eddd5a633af982692bec0
SHA512 357105129c431ada37c790956f88fd39391a69d02dda74809f8c36fd46f6a678fb731fd5ba1b568c6e53de178b12733b110029a9f682041446e117006ec9b798
TLSH
T1FD112340D638F5B2DC7C920BC59233438BE47423C0C664143E626E1809AF62DA3B974F
MD5 SHA1 SHA512 TLSH

Submit Download

3881a1a1-2eba-4c1b-b9c7-41c7e5be50b3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\3881a1a1-2eba-4c1b-b9c7-41c7e5be50b3
Size 3KB
SHA256 c94ce49ea865fdd86b20e07599f68b5851eb64a445b23e77a0a0ca81ab46f185
MD5 0d265c87ebed7f5edae3b2b758aa7a6a
SHA1 d5c685fd8f0b4ea3b172fe643313b2c8c43333da
SHA512 49c451a2457601ab0302691dc1a91aa55de1500684a54584099475ef0f04da416e82fa1bca3b7219d6934b74435a4c0c589bb98f92890c1496cb09ba3f995c81
TLSH
T1576165A19664B5339EECB049A3376E459BDD33CF88470B8D21668D3446FC468478B35F
MD5 SHA1 SHA512 TLSH

Submit Download

3ba5ff98-9f27-4914-b5f8-2e05f24ce4d3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\3ba5ff98-9f27-4914-b5f8-2e05f24ce4d3
Size 3KB
SHA256 b3881e0c0f476f641b1cf91de23301d6ada4332e65d56a350bf31a940b9b29c4
MD5 51cde1322f1dd0dcf45d56f7acffa1f3
SHA1 a1a152509551ef5ebf14b5fa92f9d0461d426879
SHA512 ed5888b474ed086f66e4e033c47151c9c55b8215753ec72dc011f6588887d56b0017bb384e261470579b9c1bd7c3c043b8dd5e7c6df055fcc28b3089ae1a143e
TLSH
T1266153A1466879339EECA045E3376E458BCE33DF58470BCD226A8D3446F8468478B35F
MD5 SHA1 SHA512 TLSH

Submit Download

3cd7a9a2-747a-4987-aa3a-49b8b2a116d0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\3cd7a9a2-747a-4987-aa3a-49b8b2a116d0
Size 3KB
SHA256 7a90772ee6205cc25e918952317d94c289cf179c82a905b4c279dc289e08e5e2
MD5 2702aa5706f3effdc9c93c903fc9f3c2
SHA1 9da42477318478d43b3b0fa3649fa5e81d87b69e
SHA512 29e056c1de3f66c0fc6060caeea84a7dc1f081bc6311aa03db1d788727427386a6b4b93c107dcb18fe15bb7dd530a95c3613d2335bf1d7d38b9aedb89ea8482b
TLSH
T1966162B18568B5739EECA049A3376A498BDE33DF58470BCD216A8D3442E8468478B35B
MD5 SHA1 SHA512 TLSH

Submit Download

5d172fb1-a38a-4a43-9c73-91879278ee98

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\5d172fb1-a38a-4a43-9c73-91879278ee98
Size 235B
SHA256 30d5eda4d3962fa2da7147696a4a8ebcd4a97854e006b3dc8fe13ad06ae4581b
MD5 47c6f929d679a95291ee73a359d11b36
SHA1 1cd891510a21f3f81a50974b6cd167061b435ef4
SHA512 c39a04ab852d4a778cfe795f653a9be2918220f370374c6ec6eacc0d3011fc7d0b481414b7ae93cd6ceb109eb81bae2c564d29ffef11fbe8c35d14d5f77179f5
TLSH
T10FD0978074A8331D0C001F13B4E02AC2304A8C3324709854EAA242789ABF9D49172C16
MD5 SHA1 SHA512 TLSH

Submit Download

61c8304d-f08d-4503-81e9-7311af8fca4b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\61c8304d-f08d-4503-81e9-7311af8fca4b
Size 886B
SHA256 5cb7902306676c7405207628c7a0dd803a2f6c71dfa3f8d506d69e3f2ec4fc37
MD5 4c57b93d8ab7702bc9f80a715559c537
SHA1 d034fe6dafb5e24889b273c7a9ff917612974764
SHA512 b74439a3c9ff7cf62d68268e7f3d0ef5bcbd20e158aea32f739f89ecf06b666af437b52488fcdf1af3eae1b2755a508e47a1996abadf2f8725fcfb449577e65e
TLSH
T168110040E628B6B39C78D25B95A137828BD4652380C65C14BE516A184DBB21E637A70B
MD5 SHA1 SHA512 TLSH

Submit Download

788e483a-5d16-40d7-a740-efa19b891105

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\788e483a-5d16-40d7-a740-efa19b891105
Size 3KB
SHA256 72d410b05d07542ed487a8dbd0531f54795769da20b2741b8d3209302ec96229
MD5 d872236662ba82c932fe7e0e5e106c01
SHA1 ec2b006da8bd1bdeb4a9636ed99d657d702fa85d
SHA512 5371edf84f40b5885012ba3fa7fd3e3a72ba41fe1d28591d1a16b5404758672e47cd9070390f05b23a8ac3f4ef9f9b021cf98d25d4124432e7a3f775199764e3
TLSH
T1066183A18664B5339EECB045A3376A49CBDE33DF58870B8921668D3846F846847CF35F
MD5 SHA1 SHA512 TLSH

Submit Download

90a5f469-1e83-458a-a72d-67a79bb30495

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\90a5f469-1e83-458a-a72d-67a79bb30495
Size 883B
SHA256 39ec6d417db44b9f99b571bac433a1f42655f193e039f8bf5c1766cab9cd5e72
MD5 cc7860c58242a5e7a185ee0fc1cbbaa9
SHA1 f78c21ac38f7b4f7cac017a7af027f4fa127f366
SHA512 28c097d0c05bf759f28bd1ecc4372547dccb80a827ffac22612dd7a6f8fbb0316b7da9efc0f63b7f21a68a5afcd1231fefdd490a65f3a946d099ff12ee836423
TLSH
T15D112350E638B5F2CC78921FC59177428FE4362380C798543FA149184DBFA2DA36A70F
MD5 SHA1 SHA512 TLSH

Submit Download

97b1e799-c737-45eb-91ea-8b4a28a1c754

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\97b1e799-c737-45eb-91ea-8b4a28a1c754
Size 235B
SHA256 7b4d438956cd2c788d94d97948aacdce8b250a26e0354b00521a152d777f2019
MD5 182a31c196a8343acbdf8d7bd94e660f
SHA1 09d1a6afba8805e2e533cbd983bca22754074400
SHA512 7122521739151bca2a73c6e9580cf4e9c68476ac0e8b8e76fc4a57d75a507c88a26d06b8d2a92f325c3ce16f1e1e86c8afbc8efae65d2f49c1a9dc76ef53d798
TLSH
T11BD097C038886B2E08008F02B0E478DA3088CC3320A1B830AA50013CD9FDDC80172D0A
MD5 SHA1 SHA512 TLSH

Submit Download

a0e2881c-fb5f-4511-b5d3-53e9954d993b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\a0e2881c-fb5f-4511-b5d3-53e9954d993b
Size 235B
SHA256 5e6b27fc286bbe4d2746394813f36da99e20740237077ba7fb818b84110341e9
MD5 d2bb5a012073051f2b70bc47aef5301c
SHA1 941935a701ac04b2856366c3bc44cced96c94b04
SHA512 0565a69a98202c11d8a146f4fa12f435a4bb358e280d85f5f7c957a554ddea3b2690ec6ad10655838bf433921c1a4e7470320e073eebd56ed570ae290acb65cc
TLSH
T173D0A79164A867BD4C244F16B0E169DB704D4C331478AC1495D15578AEBEDC99251816
MD5 SHA1 SHA512 TLSH

Submit Download

a4a61706-2bf2-4194-8908-0d9716c44c52

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\a4a61706-2bf2-4194-8908-0d9716c44c52
Size 3KB
SHA256 62c1e3d41a4cf32f63c533ca6d1c46dc6c5d88e1c7d1ce7dc9cd34f772fbbee3
MD5 e552a4b5f169b62d7d3a8d09688e6e73
SHA1 91edba2a590ae66232c286329d51eab27d427c74
SHA512 0b1988b30738f2fdc64ea2ad6b082d65aec735989c40e791f110b86a84bfd8506f975c87e785632cfa1c4c9d19a79926f3caa194a10d2d71442d5f9820ac8b62
TLSH
T14C6185B15564B5339EECA045A3336E548BDE33DF48470BCD26AA893486F845807CB35F
MD5 SHA1 SHA512 TLSH

Submit Download

b3ba2e61-5666-42e2-9efe-b2f674708de3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\b3ba2e61-5666-42e2-9efe-b2f674708de3
Size 16KB
SHA256 ddea143e51e6ae8f6a4fc60eb91a379ea182d15b0c34d3d127321f7cd02273e6
MD5 56a6cc7c15a2ddffb95191f91468df7b
SHA1 cf481a8f840c71faa9364f37f2613e71601cd608
SHA512 fc06a39dadb0fd155abd960b034b9f37b33a6094d6e12ed79190e224340086c6ac4d925b6b1108f33e9b222d704104a8c9ea00821b078dc8d8a5869b248e4d2f
SSDEEP 192:E70oSndbz2nicYIy0bKSL8yi2MXG4wBHYiHl1Jv2opwU8OWXjyJN8mPHVzKWDsg:EjSndbanicxhbKSL8L2M24wFP5R
TLSH
T11972DA16286049BA8691E368D4F87FC3E6F538CF4C419FCA9BE4BD0869DF06D112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cdc90d2f-32f9-471e-a18f-3f371806c7ed

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\cdc90d2f-32f9-471e-a18f-3f371806c7ed
Size 3KB
SHA256 c390bb4bb0f26ebada569b72a5426cbd895ab59ceff1f163e3e0f964e24704c1
MD5 1eb09c055bea210438e4a70439c95e65
SHA1 aed444baaf569e69d0662865725253db276d9e0a
SHA512 93198402ead7fd7ac5085d744fd0d206ec7bdc215080a3df54fb2b19d7e647bee7ea2aaccc2d1112d6f4e67473fbd6997df14967427138dc924ab6a620bbc608
TLSH
T1646185A1596479339FEC7084E3376E84DADD33CF58170BC921968D3446F8868478F26B
MD5 SHA1 SHA512 TLSH

Submit Download

d0401e54-eb93-4456-ac6b-33f4da05ec3a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\d0401e54-eb93-4456-ac6b-33f4da05ec3a
Size 3KB
SHA256 bd04b98ac87ea9bbb6c52138075b39d7e59f7c68b9397c0818925c109b20802b
MD5 402637a22838e121676349f74c8aa1a1
SHA1 ec06f477be8ed07133d1cf21d47c9fbae46a12d0
SHA512 bb58d0a12ba39907f58644d027f021a5123b36eb4a8314b9b8c1bc12e568dcaf6227b0cf1456abbc10f8dbc2268b12ea98b93a29ea381d47a9862e60beb95078
TLSH
T1B76164A155A879338EEC7045B3376A44CFDE33CB58470B9921A6893446F84684B8B36F
MD5 SHA1 SHA512 TLSH

Submit Download

d5b7ab04-2319-4e50-aab4-797e3f60613a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\d5b7ab04-2319-4e50-aab4-797e3f60613a
Size 3KB
SHA256 64f250a8bb6638897c4338b3bfa3f9ca2fc9356f6c62ea4317f2527391a7f7c2
MD5 8c7cf4a005a652ad0f1ca2185d0fa2cc
SHA1 fcb44d2b91753deb4def05b330f848340bb1a63b
SHA512 88d5ec87cf7f1101452caef2ef9b0fdcd9471d99c10a3c7a57d6fa33faeb73cb59da92ea731a04ed5c81b0973eb569f37ee7682e3f795a5e31f4151d7091c25c
TLSH
T11E6186A15564B473AFEC7045A3376E44CBEE33DB98470B8921668D7885F8458078B35B
MD5 SHA1 SHA512 TLSH

Submit Download

d6ad4efb-cbd3-48aa-af12-f698d0ac4764

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\d6ad4efb-cbd3-48aa-af12-f698d0ac4764
Size 2KB
SHA256 13cbc7987b3816da1ecfc362498e77610dfdce956289cae886e22ffdd8763b58
MD5 00a28014b59d843e66fa4f1d31058c79
SHA1 d82f9019a12def445b5dc10d462a02312bc7d3da
SHA512 9e358f050fa5dbe8a524faafd79ac913b5bace606d8c0df74182b8bc95e82e814dcf0670d849813dfbfea8567803f429142376c22aa9c2b0a9d2cfea7d34143e
TLSH
T14141115C757C5DB68DEAE59DD4C2338E57604A0320C22D832F51DE4C8C9A7AD33AA63A
MD5 SHA1 SHA512 TLSH

Submit Download

e8c614d0-77ba-4b47-8436-9df07f577522

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\e8c614d0-77ba-4b47-8436-9df07f577522
Size 2KB
SHA256 2b6e81db936722d48487924eea29c6634cbbf28d3da48d1c01163f5ea5cc9e95
MD5 613009e6834fa975b2ba81cc691a48af
SHA1 5333c3f1f5155ab71d23e8a3535b2db6576df03e
SHA512 5297e4b49f72b661d67fc7398f2e8e572f2dcb3006aef9814da85ac20275bfe112af98c4e94ece77f1d7fae068571bc9a30bf3c0be6efff67ab991b5b1415717
TLSH
T11941636835B84C7B9DCAF54CA082338E5795CA0340C22C832E51EE4CCD86699337E52F
MD5 SHA1 SHA512 TLSH

Submit Download

ea281cc6-fbd2-4f96-9f91-1d38cae274cf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\ea281cc6-fbd2-4f96-9f91-1d38cae274cf
Size 235B
SHA256 20bcd2a4bc272244cbd7e941f5f05a1c65a8f484c9eaef47738be9eccf0c341b
MD5 66f513ac4ace1a0849f9eb61a2605c59
SHA1 eeb8aa5d17f0bf2b95f3bee764d93ab3bf21a869
SHA512 9505c2307d7dbf1d8b24ff957225ae323029d56082c9f4e1b67a80acee94a4fc1f90fbd625751d764b2a14877a728e6ec2cf491420914580162f8118724de21d
TLSH
T1AED0A7842498A75E08140F16F0E0A9E671984C3B54B4A820D6724979D9F9EC85262D67
MD5 SHA1 SHA512 TLSH

Submit Download

ed1534f6-a4c5-4eda-95a1-aa990b262893

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\ed1534f6-a4c5-4eda-95a1-aa990b262893
Size 3KB
SHA256 6343f7dcb7ab05dcd69fa1262b5a906c504bb554ee031b9b36358d0e4fb1426f
MD5 cadc3bc973268d534fc8862e0cba1a37
SHA1 f2917e38ee594b58bc90e812601b4dc6a4e4da5f
SHA512 515c1bbf390764e2d6bd67069a370dd69eb3fe6c4f992250b3f35a08d7263819e5adcc6a07cc76084d0f5f4266ff89a2e38d43218191a32e8d33aeacd4da8420
TLSH
T16F6162A1556478339FECB085A33B6E44CEDD33DF58070BC921668D3446B886C4B8B26B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\prefs-1.js
Size 6KB
SHA256 d9b8600790a959dfc350d65bfd163db55b6cb89a9c4b539b399f455fe169f683
MD5 a1ae6515384ff79912e49abd42824592
SHA1 0824dce0113109e476b20b7d880e5d9dd4785575
SHA512 f248b01fe1ff743cd629321d975802b2909cbbbe35b0b2fbe0a873a3409056f985209857640b5f4fcd44bf57be11e7ea5cf392dbeed64dffc30a39772f9db47d
SSDEEP 96:xHXUTUDqGqd2EfNuo1zSwYpSSlDdv9jpf+nhHOZYu9fBw88n8L4cnaVhfX:teRRfNuodYpSSXfQ8ZxBw88Dr
TLSH
T1FEE11F7890088F7F75B6776CAC6888716AB2413BB7BF68C610B954C5050CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\prefs.js
Size 6KB
SHA256 264ede1f6be5fc32ce67512a8c6c1dce8c7237f0be163a6d14fe9dfa9fd593ae
MD5 7fa71c9f3955755851ee73e3cd417ab2
SHA1 fcc2cf75666e83701a74982be8c5755e5b485079
SHA512 64f46dfc0e19824e50667f0f4cec977ee9a478af29f8e96d5aeca059deb534d6f5b8961a212e04a6f235dfb169f6eff1647ef8969629e1f91e85a38be7d6e9b8
SSDEEP 96:xHXUTUDqGqd2EfNt01zSq0SSlDdv9jTnhHOZYu9fBw88n8L4cnaVQX:teRRfNt030SSL8ZxBw88Ds
TLSH
T1A3E1007894088F7F75B676ACAC688C716AB2413BB7BF68C610B554C4014CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

RegSvcs.exe

Path C:\Users\Admin\AppData\Roaming\RegSvcs.exe
Size 44KB
SHA256 2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
MD5 9d352bc46709f0cb5ec974633a0c3c94
SHA1 1969771b2f022f9a86d77ac4d4d239becdf08d07
SHA512 13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
SSDEEP 768:4BbSoy+SdIBf0k2dsjYg6Iq8S1GYqWH8BR:noOIBf0ddsjY/ZGyc7
TLSH
T19323D82897F85203F2B74BB099F5C487AD36FA536D74D79C348A534D0A527808A53B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2444-2420-0x000001E5A82E0000-0x000001E5A92E0000-memory.dmp

Download

memory/2444-2389-0x00000000003A0000-0x00000000003A1000-memory.dmp

Download

memory/3612-17-0x0000021B65D30000-0x0000021B65D40000-memory.dmp

Download

memory/3612-18-0x0000021B65C90000-0x0000021B65CB2000-memory.dmp

Download

memory/4712-167-0x0000017428A50000-0x0000017428A5E000-memory.dmp

Download

memory/5340-2412-0x0000000000E70000-0x0000000000E71000-memory.dmp

Download

memory/5640-0-0x00000000002A0000-0x000000000042A000-memory.dmp

Download

memory/5640-1-0x0000000005230000-0x00000000057D4000-memory.dmp

Download

memory/5640-5-0x0000000005120000-0x00000000051BC000-memory.dmp

Download

memory/5640-6-0x00000000060E0000-0x00000000060FE000-memory.dmp

Download

memory/5640-3-0x0000000004F40000-0x0000000004F50000-memory.dmp

Download

memory/5640-2-0x0000000004D20000-0x0000000004DB2000-memory.dmp

Download

memory/5640-4-0x0000000004ED0000-0x0000000004EDA000-memory.dmp

Download

memory/5640-7-0x0000000004F40000-0x0000000004F50000-memory.dmp

Download

memory/5640-8-0x0000000008010000-0x0000000008162000-memory.dmp

Download

memory/5740-1923-0x000002A5A8170000-0x000002A5A817E000-memory.dmp

Download

memory/5904-42-0x00000000065D0000-0x0000000006792000-memory.dmp

Download

memory/5904-46-0x00000000067C0000-0x00000000067DE000-memory.dmp

Download

memory/5904-43-0x0000000006480000-0x00000000064F6000-memory.dmp

Download

memory/5904-3124-0x00000000069E0000-0x0000000006A02000-memory.dmp

Download

memory/5904-44-0x0000000006500000-0x0000000006550000-memory.dmp

Download

memory/5904-35-0x0000000006350000-0x0000000006402000-memory.dmp

Download

memory/5904-13-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/5904-15-0x0000000005570000-0x0000000005580000-memory.dmp

Download

memory/5904-16-0x0000000005AC0000-0x0000000005B26000-memory.dmp

Download

memory/5904-45-0x0000000006CD0000-0x00000000071FC000-memory.dmp

Download

memory/5904-395-0x0000000005570000-0x0000000005580000-memory.dmp

Download

memory/5904-3125-0x0000000007200000-0x0000000007554000-memory.dmp

Download

memory/6000-38-0x0000000000FB0000-0x0000000000FBE000-memory.dmp

Download

memory/6000-39-0x0000000005770000-0x00000000057AC000-memory.dmp

Download

memory/6000-40-0x0000000005730000-0x0000000005751000-memory.dmp

Download