phantom_stealer | 55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/06/2026, 08:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7.exe
Size 1.5MB
Sample260608-klqfrabs21
SHA256 55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7
MD5 6be8ddcc17d262e9a648712cac7ff348
SHA1 41d50f868c0a14049c88df57c2c47c4dc859815e
SHA512 5b6cdaab6ca17b2dfa0fed801e86b58bcee4f8bdfde9bf5cd3e3590310159624a896ad9459e447a187e3d74729d030a5781b110cbbd8d8921ab5c686801e2f89
SSDEEP 24576:v14A+J/8aH2qB6jzSqECsw7PoNNnvQFWthRKgE+1qwRb9UQ8QWVUdRi2UhR:dV8fH4WhCswToNZc8PdE8fWVui9
TLSH
T146751219021FDD06E9B7CBB80860E3B406B49E546A35D313CEF6BEEB783279169053D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution phantom_stealer persistence stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.gunsaldi.com
Port
587
Username
[email protected]
Password
=Otpg+DbxigRc`bI

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
mail.gunsaldi.com
Port
587
Username
[email protected]
Password
=Otpg+DbxigRc`bI
Email to
[email protected]

Mutex

TFU0XCLJJ0AJ3KL95LO4

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
1

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 1 IoCs

resource	yara_rule
behavioral2/memory/2680-13-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2156	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1248	BCuZxCyoAooO.exe
5516	RegSvcs.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Run\BCuZxCyoAooO = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\3i5ojarrydb.ps1\""	55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Run\RegSvcs = "C:\\Users\\Admin\\AppData\\Roaming\\RegSvcs.exe"	RegSvcs.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	icanhazip.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4936 set thread context of 2680	4936	55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7.exe	80
PID 1248 set thread context of 2712	1248	BCuZxCyoAooO.exe	166

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCuZxCyoAooO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
852	chrome.exe
232	msedge.exe
3280	msedge.exe
4624	chrome.exe

Checks processor information in registry 2 TTPs 38 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{0A76BD7D-CB18-453B-80BD-5301E11B6841}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2156	powershell.exe
2156	powershell.exe
2680	RegSvcs.exe
2680	RegSvcs.exe
1724	chrome.exe
1724	chrome.exe
2680	RegSvcs.exe
2680	RegSvcs.exe
2680	RegSvcs.exe
2680	RegSvcs.exe
2680	RegSvcs.exe
2680	RegSvcs.exe
2680	RegSvcs.exe
2680	RegSvcs.exe
5084	firefox.exe
5084	firefox.exe
2680	RegSvcs.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
2680	RegSvcs.exe
2680	RegSvcs.exe
2680	RegSvcs.exe
2680	RegSvcs.exe
2680	RegSvcs.exe
2680	RegSvcs.exe
2680	RegSvcs.exe
2680	RegSvcs.exe
2680	RegSvcs.exe
2680	RegSvcs.exe
2680	RegSvcs.exe
2680	RegSvcs.exe
2680	RegSvcs.exe
2680	RegSvcs.exe
2680	RegSvcs.exe
2680	RegSvcs.exe
2680	RegSvcs.exe
2680	RegSvcs.exe
2680	RegSvcs.exe
2680	RegSvcs.exe
2680	RegSvcs.exe
6692	firefox.exe
6692	firefox.exe
6692	firefox.exe
6692	firefox.exe
6692	firefox.exe
6692	firefox.exe
6692	firefox.exe
6692	firefox.exe
6692	firefox.exe
6692	firefox.exe
6692	firefox.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	2680	RegSvcs.exe
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeDebugPrivilege	2712	RegSvcs.exe
Token: SeShutdownPrivilege	6884	chrome.exe
Token: SeCreatePagefilePrivilege	6884	chrome.exe
Token: SeShutdownPrivilege	6884	chrome.exe
Token: SeCreatePagefilePrivilege	6884	chrome.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
1724	chrome.exe
1724	chrome.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5084	firefox.exe
5856	msedge.exe
5864	msedge.exe
6692	firefox.exe
6692	firefox.exe
6692	firefox.exe
6692	firefox.exe
6692	firefox.exe
6692	firefox.exe
6692	firefox.exe
6692	firefox.exe
6884	chrome.exe
6884	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5084	firefox.exe
6692	firefox.exe
2680	RegSvcs.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 2680	4936	55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7.exe	80
PID 4936 wrote to memory of 2680	4936	55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7.exe	80
PID 4936 wrote to memory of 2680	4936	55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7.exe	80
PID 4936 wrote to memory of 2680	4936	55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7.exe	80
PID 4936 wrote to memory of 2680	4936	55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7.exe	80
PID 2156 wrote to memory of 1248	2156	powershell.exe	84
PID 2680 wrote to memory of 1724	2680	RegSvcs.exe	87
PID 1724 wrote to memory of 5976	1724	chrome.exe	88
PID 1724 wrote to memory of 4784	1724	chrome.exe	89
PID 1724 wrote to memory of 852	1724	chrome.exe	90
PID 1724 wrote to memory of 3240	1724	chrome.exe	91
PID 2680 wrote to memory of 1724	2680	RegSvcs.exe	87
PID 1724 wrote to memory of 2284	1724	chrome.exe	92
PID 1724 wrote to memory of 2972	1724	chrome.exe	93
PID 2680 wrote to memory of 1724	2680	RegSvcs.exe	87
PID 1724 wrote to memory of 4804	1724	chrome.exe	94
PID 1724 wrote to memory of 1144	1724	chrome.exe	95
PID 2680 wrote to memory of 3240	2680	RegSvcs.exe	91
PID 1724 wrote to memory of 3844	1724	chrome.exe	96
PID 2680 wrote to memory of 3240	2680	RegSvcs.exe	91
PID 2680 wrote to memory of 852	2680	RegSvcs.exe	90
PID 2680 wrote to memory of 852	2680	RegSvcs.exe	90
PID 1724 wrote to memory of 2768	1724	chrome.exe	97
PID 2680 wrote to memory of 4784	2680	RegSvcs.exe	89
PID 2680 wrote to memory of 4784	2680	RegSvcs.exe	89
PID 2680 wrote to memory of 5976	2680	RegSvcs.exe	88
PID 2680 wrote to memory of 5976	2680	RegSvcs.exe	88
PID 2680 wrote to memory of 1724	2680	RegSvcs.exe	87
PID 2680 wrote to memory of 1724	2680	RegSvcs.exe	87
PID 2680 wrote to memory of 3240	2680	RegSvcs.exe	91
PID 2680 wrote to memory of 3240	2680	RegSvcs.exe	91
PID 2680 wrote to memory of 4804	2680	RegSvcs.exe	94
PID 2680 wrote to memory of 4804	2680	RegSvcs.exe	94
PID 2680 wrote to memory of 852	2680	RegSvcs.exe	90
PID 2680 wrote to memory of 852	2680	RegSvcs.exe	90
PID 2680 wrote to memory of 1144	2680	RegSvcs.exe	95
PID 2680 wrote to memory of 1144	2680	RegSvcs.exe	95
PID 2680 wrote to memory of 4784	2680	RegSvcs.exe	89
PID 2680 wrote to memory of 4784	2680	RegSvcs.exe	89
PID 2680 wrote to memory of 5976	2680	RegSvcs.exe	88
PID 2680 wrote to memory of 5976	2680	RegSvcs.exe	88
PID 2680 wrote to memory of 3844	2680	RegSvcs.exe	96
PID 2680 wrote to memory of 3844	2680	RegSvcs.exe	96
PID 2680 wrote to memory of 2972	2680	RegSvcs.exe	93
PID 2680 wrote to memory of 2972	2680	RegSvcs.exe	93
PID 1724 wrote to memory of 4652	1724	chrome.exe	98
PID 2680 wrote to memory of 2768	2680	RegSvcs.exe	97
PID 2680 wrote to memory of 2768	2680	RegSvcs.exe	97
PID 2680 wrote to memory of 1724	2680	RegSvcs.exe	87
PID 2680 wrote to memory of 1724	2680	RegSvcs.exe	87
PID 2680 wrote to memory of 3240	2680	RegSvcs.exe	91
PID 2680 wrote to memory of 3240	2680	RegSvcs.exe	91
PID 2680 wrote to memory of 4804	2680	RegSvcs.exe	94
PID 2680 wrote to memory of 4804	2680	RegSvcs.exe	94
PID 2680 wrote to memory of 852	2680	RegSvcs.exe	90
PID 2680 wrote to memory of 852	2680	RegSvcs.exe	90
PID 2680 wrote to memory of 1144	2680	RegSvcs.exe	95
PID 2680 wrote to memory of 1144	2680	RegSvcs.exe	95
PID 2680 wrote to memory of 4784	2680	RegSvcs.exe	89
PID 2680 wrote to memory of 4784	2680	RegSvcs.exe	89
PID 2680 wrote to memory of 5976	2680	RegSvcs.exe	88
PID 2680 wrote to memory of 5976	2680	RegSvcs.exe	88
PID 2680 wrote to memory of 3844	2680	RegSvcs.exe	96
PID 2680 wrote to memory of 3844	2680	RegSvcs.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7.exe
"C:\Users\Admin\AppData\Local\Temp\55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:2680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vmc0pr21.p3n"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1724
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\vmc0pr21.p3n /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\vmc0pr21.p3n\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\vmc0pr21.p3n --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff9784bc728,0x7ff9784bc734,0x7ff9784bc740
      4⤵
      PID:5976
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vmc0pr21.p3n" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1636,i,12564056915950732031,9074427052198323178,262144 --field-trial-handle=1936,i,9448240008582203455,8425019522015103155,262144 --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:2
      4⤵
      PID:4784
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vmc0pr21.p3n" --force-high-res-timeticks=disabled --metrics-shmem-handle=2020,i,12525838846285147526,11654797822398262664,524288 --field-trial-handle=1936,i,9448240008582203455,8425019522015103155,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
      4⤵
      System Time Discovery
      PID:852
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vmc0pr21.p3n" --force-high-res-timeticks=disabled --metrics-shmem-handle=2184,i,3911579280768859540,9475100304088585135,524288 --field-trial-handle=1936,i,9448240008582203455,8425019522015103155,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:13
      4⤵
      PID:3240
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vmc0pr21.p3n" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2924,i,17966768741656923719,18276232120179419379,2097152 --field-trial-handle=1936,i,9448240008582203455,8425019522015103155,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:1
      4⤵
      PID:2284
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vmc0pr21.p3n" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2932,i,13100574352881390017,11796727898800618580,2097152 --field-trial-handle=1936,i,9448240008582203455,8425019522015103155,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:1
      4⤵
      PID:2972
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vmc0pr21.p3n" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3132,i,7950504182650667695,14990602539362089731,2097152 --field-trial-handle=1936,i,9448240008582203455,8425019522015103155,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:1
      4⤵
      PID:4804
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vmc0pr21.p3n" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3144,i,12090789001297460430,14303444410090307779,2097152 --field-trial-handle=1936,i,9448240008582203455,8425019522015103155,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:9
      4⤵
      PID:1144
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vmc0pr21.p3n" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3712,i,18271136520805932414,7173629286901848427,2097152 --field-trial-handle=1936,i,9448240008582203455,8425019522015103155,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:9
      4⤵
      PID:3844
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vmc0pr21.p3n" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4000,i,10892527125522451491,4628139469717166718,2097152 --field-trial-handle=1936,i,9448240008582203455,8425019522015103155,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:1
      4⤵
      PID:2768
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vmc0pr21.p3n" --force-high-res-timeticks=disabled --metrics-shmem-handle=3688,i,869550668012631426,9582981124930863951,524288 --field-trial-handle=1936,i,9448240008582203455,8425019522015103155,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:14
      4⤵
      PID:4652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\20giuwnp.l0m"
    3⤵
    PID:5152
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\20giuwnp.l0m
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:5084
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1976 -prefsLen 27097 -prefMapHandle 1980 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {f073d8fd-bf6c-4549-ba6e-58311f6a4dad} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:5796
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2256 -prefsLen 27133 -prefMapHandle 2244 -prefMapSize 270279 -ipcHandle 2220 -initialChannelId {b9fa975b-3d6b-44d8-9f1d-259b783b239d} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:4520
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1c68b15b-792d-4859-ba45-47a34eb158fa.dmp"
        5⤵
        
        PID:5136
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2292 -prefsLen 27133 -prefMapHandle 2776 -prefMapSize 270279 -ipcHandle 2796 -initialChannelId {26fbb80a-4695-4a60-b57a-b1fed79d2998} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:1292
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a2db5d3a-39a4-49f3-8a98-890c252adf0b.dmp"
        5⤵
        
        PID:4800
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2796 -prefsLen 27133 -prefMapHandle 2948 -prefMapSize 270279 -ipcHandle 2976 -initialChannelId {ea9fb754-5b6f-4719-9681-7d7c2770ad3a} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:1004
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3764 -prefsLen 27274 -prefMapHandle 3768 -prefMapSize 270279 -jsInitHandle 3772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3780 -initialChannelId {eabaab44-fe77-4606-807b-d13db4a34b9b} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:2420
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2eb63e6e-6e96-4332-91d6-32fc86c0acdc.dmp"
        5⤵
        
        PID:5896
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3340 -prefsLen 27274 -prefMapHandle 3248 -prefMapSize 270279 -ipcHandle 3908 -initialChannelId {4ff7ad60-a2bb-4baa-b610-ac40a8f5af23} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:5708
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9a9095ab-9d9e-4451-811b-eb0ebb33b473.dmp"
        5⤵
        
        PID:3288
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4180 -prefsLen 27274 -prefMapHandle 4184 -prefMapSize 270279 -ipcHandle 4144 -initialChannelId {273b17ec-1b8e-452a-ae0b-16257bc222d9} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 rdd
        5⤵
        
        PID:4972
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4424 -prefsLen 34773 -prefMapHandle 4548 -prefMapSize 270279 -jsInitHandle 4428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4336 -initialChannelId {4f88e631-4b3d-4825-b245-77a613ac5a9d} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:4904
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3256 -prefsLen 35010 -prefMapHandle 2768 -prefMapSize 270279 -ipcHandle 5124 -initialChannelId {9586a641-e2c9-4048-8fae-f344337bf9b9} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        5⤵
        Checks processor information in registry
        
        PID:3752
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4468 -prefsLen 32900 -prefMapHandle 3028 -prefMapSize 270279 -jsInitHandle 3188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3196 -initialChannelId {34b5c683-88e0-44be-b992-11533d4d44ae} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:4320
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4996 -prefsLen 32900 -prefMapHandle 5124 -prefMapSize 270279 -jsInitHandle 2768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5156 -initialChannelId {520cb578-f13b-474b-85d5-109fe5c4d625} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:5544
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5580 -prefsLen 32900 -prefMapHandle 5576 -prefMapSize 270279 -jsInitHandle 5572 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5564 -initialChannelId {e3f71a4f-699e-4d26-8740-77ddfac10ab4} -parentPid 5084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:2492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff96766c188,0x7ff96766c194,0x7ff96766c1a0
      4⤵
      PID:948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1628,i,15758294711505598565,8661736829050860448,262144 --field-trial-handle=2148,i,14302867007777261501,9614545542250171328,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:2
      4⤵
      PID:2272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,4872457386128717045,6533592708445234020,524288 --field-trial-handle=2148,i,14302867007777261501,9614545542250171328,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:11
      4⤵
      System Time Discovery
      PID:232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,7488889556019352710,12717371873283160282,524288 --field-trial-handle=2148,i,14302867007777261501,9614545542250171328,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:13
      4⤵
      PID:4176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3088,i,11093800856925120682,5507539304744752337,2097152 --field-trial-handle=2148,i,14302867007777261501,9614545542250171328,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:1
      4⤵
      PID:1992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3092,i,13446156532365412196,10350479759284424965,2097152 --field-trial-handle=2148,i,14302867007777261501,9614545542250171328,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:1
      4⤵
      PID:4628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,7298429267276206513,15662718929192311323,524288 --field-trial-handle=2148,i,14302867007777261501,9614545542250171328,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:14
      4⤵
      PID:4296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,16641709460963770093,9862232948742425700,524288 --field-trial-handle=2148,i,14302867007777261501,9614545542250171328,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:14
      4⤵
      PID:348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,5640092621837117497,12822190892433701104,524288 --field-trial-handle=2148,i,14302867007777261501,9614545542250171328,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:14
      4⤵
      PID:4976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3588,i,15616226520609193780,10861649255760218722,2097152 --field-trial-handle=2148,i,14302867007777261501,9614545542250171328,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
      4⤵
      PID:5176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3632,i,13629939344264365501,16670345017331758804,2097152 --field-trial-handle=2148,i,14302867007777261501,9614545542250171328,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:9
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3644,i,6409011223666514942,16693074458592779369,2097152 --field-trial-handle=2148,i,14302867007777261501,9614545542250171328,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
      4⤵
      PID:4792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3668,i,7787801922727969958,17852608897829174283,2097152 --field-trial-handle=2148,i,14302867007777261501,9614545542250171328,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:9
      4⤵
      PID:4920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3688,i,11568179818788012660,17893324762202051910,2097152 --field-trial-handle=2148,i,14302867007777261501,9614545542250171328,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1
      4⤵
      PID:5804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3708,i,2884888848248145266,17504186690520151270,2097152 --field-trial-handle=2148,i,14302867007777261501,9614545542250171328,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:9
      4⤵
      PID:3936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3720,i,17209383189690113800,11169018561860646986,2097152 --field-trial-handle=2148,i,14302867007777261501,9614545542250171328,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
      4⤵
      PID:1856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3732,i,5045112272161418159,13640705147979655144,2097152 --field-trial-handle=2148,i,14302867007777261501,9614545542250171328,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:9
      4⤵
      PID:1656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3744,i,11166050752123393203,15498667140543346616,2097152 --field-trial-handle=2148,i,14302867007777261501,9614545542250171328,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1
      4⤵
      PID:324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3760,i,8526138088635098233,644594455826867996,2097152 --field-trial-handle=2148,i,14302867007777261501,9614545542250171328,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:9
      4⤵
      PID:2944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3080,i,10891327835023692978,9656915884140227103,524288 --field-trial-handle=2148,i,14302867007777261501,9614545542250171328,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
      4⤵
      PID:5036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1080
        5⤵
        
        PID:1808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,18316731482909197946,6851556348454045639,524288 --field-trial-handle=2148,i,14302867007777261501,9614545542250171328,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
      4⤵
      PID:1848
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=596
        5⤵
        
        PID:2340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,17707536799460950285,5226823629926750079,524288 --field-trial-handle=2148,i,14302867007777261501,9614545542250171328,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:14
      4⤵
      PID:3224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,3000690846569332630,3705953186595716331,524288 --field-trial-handle=2148,i,14302867007777261501,9614545542250171328,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:14
      4⤵
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,16684223903177496093,17299276153930479293,524288 --field-trial-handle=2148,i,14302867007777261501,9614545542250171328,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:14
      4⤵
      PID:4208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:5864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff96766c188,0x7ff96766c194,0x7ff96766c1a0
      4⤵
      PID:2340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1624,i,5534025952266263393,549721884756672957,262144 --field-trial-handle=2264,i,16127293018271498020,7813721206806743607,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
      4⤵
      PID:3464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,10502782174501407791,16442123733481127078,524288 --field-trial-handle=2264,i,16127293018271498020,7813721206806743607,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:11
      4⤵
      System Time Discovery
      PID:3280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,10586897450836444991,11415074439914848810,524288 --field-trial-handle=2264,i,16127293018271498020,7813721206806743607,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:13
      4⤵
      PID:1124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3024,i,373910148880229726,9273005404099505322,2097152 --field-trial-handle=2264,i,16127293018271498020,7813721206806743607,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:1
      4⤵
      PID:2484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3028,i,12733725846715850993,252530741286795544,2097152 --field-trial-handle=2264,i,16127293018271498020,7813721206806743607,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:1
      4⤵
      PID:5064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3340,i,11574164201151256103,13364459084063584113,524288 --field-trial-handle=2264,i,16127293018271498020,7813721206806743607,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:14
      4⤵
      PID:2820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3344,i,5636377752511696801,1599290061266408352,524288 --field-trial-handle=2264,i,16127293018271498020,7813721206806743607,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3328,i,457838384103292302,14130946206879970401,524288 --field-trial-handle=2264,i,16127293018271498020,7813721206806743607,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:14
      4⤵
      PID:2776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3352,i,17755878410929185963,14446073087590331412,2097152 --field-trial-handle=2264,i,16127293018271498020,7813721206806743607,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
      4⤵
      PID:6248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3372,i,16376240207138151015,8446331463084844302,2097152 --field-trial-handle=2264,i,16127293018271498020,7813721206806743607,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:9
      4⤵
      PID:6256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3404,i,12992617061162795157,11767304030304868871,2097152 --field-trial-handle=2264,i,16127293018271498020,7813721206806743607,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:1
      4⤵
      PID:6264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3440,i,15655059278181613034,18103120596433863138,2097152 --field-trial-handle=2264,i,16127293018271498020,7813721206806743607,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:9
      4⤵
      PID:6272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3460,i,9111250010417242091,5392098916751984935,2097152 --field-trial-handle=2264,i,16127293018271498020,7813721206806743607,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:1
      4⤵
      PID:6280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3476,i,6051607540512164675,8347097310023160541,2097152 --field-trial-handle=2264,i,16127293018271498020,7813721206806743607,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:9
      4⤵
      PID:6288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3496,i,18122126457740040517,11943208803971114027,2097152 --field-trial-handle=2264,i,16127293018271498020,7813721206806743607,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:1
      4⤵
      PID:6296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3172,i,9306113661212764651,12201964557492578175,2097152 --field-trial-handle=2264,i,16127293018271498020,7813721206806743607,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:9
      4⤵
      PID:6304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3520,i,9253115097875517987,14035545651505333242,2097152 --field-trial-handle=2264,i,16127293018271498020,7813721206806743607,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:1
      4⤵
      PID:6312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3524,i,16738465932248284934,7920523091378134542,2097152 --field-trial-handle=2264,i,16127293018271498020,7813721206806743607,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:9
      4⤵
      PID:6320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,8253492134896040667,5426026676308372313,524288 --field-trial-handle=2264,i,16127293018271498020,7813721206806743607,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:14
      4⤵
      PID:6328
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:6192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,5999087691482637340,11329064294899444131,524288 --field-trial-handle=2264,i,16127293018271498020,7813721206806743607,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:14
      4⤵
      PID:3208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,9657925217025758045,17953702954964730650,524288 --field-trial-handle=2264,i,16127293018271498020,7813721206806743607,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:14
      4⤵
      PID:1616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=592
        5⤵
        
        PID:1164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,14573644837795741442,15178911277743667372,524288 --field-trial-handle=2264,i,16127293018271498020,7813721206806743607,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:14
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,113752693380594792,12593741356427216723,524288 --field-trial-handle=2264,i,16127293018271498020,7813721206806743607,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:14
      4⤵
      PID:1976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,17151895434323887284,1636680689406234455,524288 --field-trial-handle=2264,i,16127293018271498020,7813721206806743607,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:14
      4⤵
      PID:2204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,5999087691482637340,11329064294899444131,524288 --field-trial-handle=2264,i,16127293018271498020,7813721206806743607,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:14
      4⤵
      PID:1136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\olaonqem.qir"
    3⤵
    PID:3636
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\olaonqem.qir
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:6692
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1976 -prefsLen 27097 -prefMapHandle 1980 -prefMapSize 270331 -ipcHandle 2056 -initialChannelId {d28206ac-d0b3-4f54-b5f7-9a3469734470} -parentPid 6692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6692" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:2492
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2244 -prefsLen 27133 -prefMapHandle 2232 -prefMapSize 270331 -ipcHandle 2336 -initialChannelId {9718be0a-897b-4a38-ba99-9836dcf19f9e} -parentPid 6692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6692" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:5424
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\889b6003-80c7-4299-8d74-66d5079a33b4.dmp"
        5⤵
        
        PID:2268
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2188 -prefsLen 27133 -prefMapHandle 2756 -prefMapSize 270331 -ipcHandle 2760 -initialChannelId {2728748c-0ccb-4d29-8b01-48f98203d644} -parentPid 6692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6692" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:4548
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\027748c6-b8d4-488e-8958-c617c86e3e30.dmp"
        5⤵
        
        PID:4972
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2760 -prefsLen 27198 -prefMapHandle 3000 -prefMapSize 270331 -ipcHandle 3308 -initialChannelId {9e7b295c-e874-4e5e-9c59-2e43e343259a} -parentPid 6692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6692" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:2320
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3572 -prefsLen 27323 -prefMapHandle 3576 -prefMapSize 270331 -jsInitHandle 3580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1956 -initialChannelId {05bf10af-0ae9-4967-b140-5833027fe741} -parentPid 6692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6692" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:3452
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\18e70651-cddf-4d98-bdea-99d36f1d45c7.dmp"
        5⤵
        
        PID:1984
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3308 -prefsLen 27323 -prefMapHandle 4016 -prefMapSize 270331 -ipcHandle 3736 -initialChannelId {61821478-143b-47d9-9063-c6ba3ed8c23c} -parentPid 6692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6692" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:784
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e1c5a4c6-4a62-46fe-aeee-464be8f0b19c.dmp"
        5⤵
        
        PID:1276
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4228 -prefsLen 27323 -prefMapHandle 4232 -prefMapSize 270331 -ipcHandle 4240 -initialChannelId {b9bb871c-4f51-43c8-b2ec-770446bd348c} -parentPid 6692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6692" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 rdd
        5⤵
        
        PID:2820
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4644 -prefsLen 34822 -prefMapHandle 4648 -prefMapSize 270331 -jsInitHandle 4652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4660 -initialChannelId {9cb64178-f82b-4543-aba2-ff531d16ab9d} -parentPid 6692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6692" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:2128
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2948 -prefsLen 34876 -prefMapHandle 3272 -prefMapSize 270331 -ipcHandle 3160 -initialChannelId {c2a29122-0716-4d65-81ae-bc1ebe9f495d} -parentPid 6692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6692" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        5⤵
        Checks processor information in registry
        
        PID:4684
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3508 -prefsLen 32766 -prefMapHandle 2928 -prefMapSize 270331 -jsInitHandle 3272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4568 -initialChannelId {b1866e9a-bf2e-4154-b398-c734eec5cd7f} -parentPid 6692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6692" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:3800
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5088 -prefsLen 32766 -prefMapHandle 5092 -prefMapSize 270331 -jsInitHandle 5096 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5104 -initialChannelId {1dbacbcd-c2db-4c73-9d0a-927ba1a670e7} -parentPid 6692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6692" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:3492
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5504 -prefsLen 32766 -prefMapHandle 5496 -prefMapSize 270331 -jsInitHandle 5384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5536 -initialChannelId {69af674c-6011-407d-8c6d-072373408c41} -parentPid 6692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6692" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:6844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\us0ojmhm.v1r"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:6884
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\us0ojmhm.v1r /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\us0ojmhm.v1r\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\us0ojmhm.v1r --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff9784bc728,0x7ff9784bc734,0x7ff9784bc740
      4⤵
      PID:6868
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\us0ojmhm.v1r" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1664,i,15119344791493453796,15869165816560722832,262144 --field-trial-handle=2068,i,7397439480527741555,3592950248723725503,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:2
      4⤵
      PID:6240
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\us0ojmhm.v1r" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1816,i,8124808266808077307,2517976067944724407,524288 --field-trial-handle=2068,i,7397439480527741555,3592950248723725503,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:11
      4⤵
      System Time Discovery
      PID:4624
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\us0ojmhm.v1r" --force-high-res-timeticks=disabled --metrics-shmem-handle=2148,i,12104210209694154994,6713908899518119722,524288 --field-trial-handle=2068,i,7397439480527741555,3592950248723725503,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:13
      4⤵
      PID:6812
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\us0ojmhm.v1r" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2700,i,10708044143269677765,18428756335321274105,2097152 --field-trial-handle=2068,i,7397439480527741555,3592950248723725503,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:1
      4⤵
      PID:7080
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\us0ojmhm.v1r" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2736,i,17058050902292461823,12783828255371303617,2097152 --field-trial-handle=2068,i,7397439480527741555,3592950248723725503,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:1
      4⤵
      PID:4484
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\us0ojmhm.v1r" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3316,i,6153780664948029027,12523397825199014632,2097152 --field-trial-handle=2068,i,7397439480527741555,3592950248723725503,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:1
      4⤵
      PID:6248
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\us0ojmhm.v1r" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3344,i,13381870701296147536,3495623719874698969,2097152 --field-trial-handle=2068,i,7397439480527741555,3592950248723725503,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:9
      4⤵
      PID:6800
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\us0ojmhm.v1r" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3848,i,18198955298132878636,5357902748385960767,2097152 --field-trial-handle=2068,i,7397439480527741555,3592950248723725503,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:9
      4⤵
      PID:1536
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\us0ojmhm.v1r" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4196,i,10664479599145992581,6995302010734468433,2097152 --field-trial-handle=2068,i,7397439480527741555,3592950248723725503,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
      4⤵
      PID:1636
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\us0ojmhm.v1r" --force-high-res-timeticks=disabled --metrics-shmem-handle=4220,i,8389328068024204428,7121993043756881276,524288 --field-trial-handle=2068,i,7397439480527741555,3592950248723725503,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:14
      4⤵
      PID:5416

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\3i5ojarrydb.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Roaming\BCuZxCyoAooO.exe
  "C:\Users\Admin\AppData\Roaming\BCuZxCyoAooO.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:1248
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2712

C:\Users\Admin\AppData\Roaming\RegSvcs.exe
C:\Users\Admin\AppData\Roaming\RegSvcs.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qur8qcyx.default-release\activity-stream.contile.json
Size 4KB
SHA256 4ba179ec37c0fb040b7bbd598470c416af1eb28c543a7744eb771eb21de701b4
MD5 77ce765d24c1ce40d2f2e84725186893
SHA1 079df83177765cbd489f378134a753158ee558f4
SHA512 642ac9103b2057b1b6d55c3bb2454724c23e9e6c2cb3f73c3201f93678deec8ae68e952997bb6f0242a292ed70d0a27282989c10c96fc044a68e5e21644b276b
SSDEEP 96:KgHAytWDLLxVsoCToni/8DlSwLZV1tlY3wT+mR0Dl:KmtWDLdiToi8l7LZV1tlGBmR0Dl
TLSH
T16FA11AFB6C3484171731B3F47C4E235DF1177067A9E69A48BA924C01D9D924B81EBA88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qur8qcyx.default-release\activity-stream.discovery_stream.json
Size 76KB
SHA256 65f566b5616d62caa0daff84c5600afbdba3114d7c8191dda3e741e760802aa2
MD5 138e431c9f7086ee2e99ac6c262751d1
SHA1 bc6950ab2f921764a74870917831b19770253301
SHA512 6393c6f2f7e2914be7f202471063c43bd2f7afd736526c68d1ea99d5d2aacf978369f692d5f574e59ce9909f65ffc9e679b20817a59f4e22c4b8637c91bd5b12
SSDEEP 1536:e9Yu29cC9MkkuazGyCD+mlN02m9TwSxLI3SkK1C:eGc1uazGy0N02m9MsIikK1C
TLSH
T121732BA3A7A8F1BB1B9073CB2C4B75AB66D18196E74205CAECDDC50DC1CC750133A6AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qur8qcyx.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 733fff00c783774514d19a72da5262db1578903689b619950ffdb6f563a0682c
MD5 50b3798ee00478439803444c6d009b02
SHA1 024e3666e1085b2d6f9af60d3a3c9c3c4a96cb48
SHA512 c68b4259f8ac75845c58f77b044e4771540e1c85dd4f5a49309dbdb1a0fdd2b36ab2321a44239aabed1c30c985dc2da82117e3603d31186c01173f8af7267fb1
SSDEEP 3072:j3lqo7/ctqkICzEUf41s0Zn4xhONUBFq2bbxEZ:pqoopwUKZn42Nqqm+Z
TLSH
T1F2B3AFF6CBA2CD3C65FFD42C5AC2893EFD266404B3E32019C823675461C6FB86678648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3i5ojarrydb.ps1

Path C:\Users\Admin\AppData\Local\Temp\3i5ojarrydb.ps1
Size 1KB
SHA256 bc20f7c2ae7ec8ca06ff8e8620e7e3d47f5e5fd099b48c65747f11d24594628c
MD5 960b177ff7114437d073225d5cf884e8
SHA1 88c5c34ce3b54b6e8390a2b4f5aae33bf8a348b8
SHA512 dbd8015299531e9ea6f7386fe36328d61c97bde47743a76f1ba7ed427ce2a9030e6d6e55851b1d255da0d1550a4139d7a606140a367fc1e55707fcd89886ef9e
TLSH
T1F011E5578E410BC6402497F0861375CDB12D92C767AF019055ECB9DEB33BD23386ACE8
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_fgwjpvxr.qud.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fgwjpvxr.qud.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk\Crashpad\settings.dat
Size 280B
SHA256 5d25af42e5c1ef8bd5c7d911cd9e54c6d2bd71d4b520c74eed9d2d566b0dfc6e
MD5 3be7cacef13cb54ca08d46e9801873bd
SHA1 11b457e845dfd74c4078937f381eae551c4ca7ed
SHA512 af00a626d47d5dc288c83bb621e81cc15a590be0232569d270f74588239adedc2737ef3840caa52a08c8ab75b210c2443d7f80b23b32b3f0c70128025e6eb46f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk\Crashpad\settings.dat
Size 280B
SHA256 53f50827574b83dad723fd5b4cced7cf26dde407dbd04a9289d0de348b176ff9
MD5 77c0cabf0b6ba09fd621fc8f2f817236
SHA1 f7db074522d5ebbb1e808d4724f08ac7a7b9139d
SHA512 8f6f857cadeedfa39a539e6f98e2bb18e2957d6658a8fdad58b1ce28f3f6587ce734787de99aa4960a045993478caeb0608e690e08e30961c01b91fbe911bfab
TLSH
T121D02280B2238083C32EB8F2A8B00E00F8C2C8F02A0082AEE03300380AC3208000F2F0
MD5 SHA1 SHA512 TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk\Default\Cache\Cache_Data\f_000002
Size 96KB
SHA256 29f31e85536be418b97ec4911920a9954dc14ca18ddc5302c3b015527fd57a9e
MD5 cba62810300825d68a311b82a246de49
SHA1 378c2ea0eb8c9e86f83d323a99d477de070df295
SHA512 f781d4ba4b0a47fc68cd9b6de986635703128c1cfac048310981f4aabdfb5705553f40cf6a8b32d327034e6a14b358d281fbaad17ca8100bf77cc352bd6ee900
SSDEEP 1536:zVJ82fuU1I+KGLAHFHKAYDvxVWSc4KC/lh/c8ODF6ezVUYfeWJNuzBiwrymUrxUO:b8wuU1I+lMFODoDSc8lezbru3kSYGq
TLSH
T15AA3126B97298D90580B7FCC4FD3B2637973B2D2E856E1B5627F02016CEB9291B70316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk\Default\Cache\Cache_Data\f_000003
Size 67KB
SHA256 e7ff4fd8fbe9f4cf43eb0e5a3cb58d39138698f51a93a9e4158bf0cfe8fa7ea4
MD5 7a6eae123fa2364636bbab6833245b58
SHA1 6047b2613241d64b6236d4c914f283ebd235ce87
SHA512 d0850ca03996831989c26f6361d1fe1d9f47deb4cbe6364cb02968aa3b5dd5d34786b5ea8e38727330983a053e3aa96c54ae98e5b8b0aa6bae3623a3760dfad8
SSDEEP 1536:xtDYeWdrm8uosX7CRcf2cqfgLakgNC9n/yNN/3a6tU:x2eWlm8uokWaUI3h/8dFi
TLSH
T1C36301346A3E3EC5A05F43F61A9CDCD1BAC39779179CAA997128F229C0D6DE605114CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk\Default\Cache\Cache_Data\f_000004
Size 402KB
SHA256 a0144656522ab185f6b6d04cbdf050ee23550209ac722653bebcdf09c7cc1279
MD5 3bdc2cf3a60b4c5042cc39f99e61bbf6
SHA1 2bbb397db695ef5c1f955f7ce2e8b780d9bf14fc
SHA512 1e2e30663b276bfb4b3ab46e2ddb1b8a9a2d87e50c2869bfb431452fdfc01d0ed958f9938726e1c68be9b4b6cd8c4e7b360e485ba831f55af71e2f38a275cbef
SSDEEP 12288:8H5CH036tbqV+vrs4Z3NXO8lUKofa7KgO4:8H5pLV+js4ZpO8lGiK4
TLSH
T1E89423890E2FFD33FF18911E3B2560D157B41819E9EBAC0B719E1B6B384DA7D2427246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk\Default\Cache\Cache_Data\f_000009
Size 27KB
SHA256 97b5c3b18d66eefb5c1c8629a0a979875a7334938a121d940ae9eb4d4f14dc9f
MD5 f3c0878adb6e3d757c88acdf6cbcab23
SHA1 1e1fbf12f0f69a382f1c239ac3525b6582733a8c
SHA512 884ba4bf171c912ba7f9422046a2e824afe386a0590d0eb4628314f83e165037cd8b5a88712083caf6164f343a1d0887ff2646d41e3a9313a7527e0761c5ac4b
SSDEEP 768:KU3SHZcK0jhwdklmvg1a9xYHGY2wO47HG:5zlwvlMHnDG
TLSH
T16DD2F150C15DA61BB72D1AE9CF5FC7394DF4EE80224F780656ADF06BDAB00115B8970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk\Default\Cache\Cache_Data\f_00000a
Size 77KB
SHA256 9e39486440a3c89ea544632bc62773caa3c30a69c0d66e998cebedffd798f6e7
MD5 14a782130d5fba11d0d6907167a1acc7
SHA1 a0e93036607920bea09d67d19bc2e5d01a1d763e
SHA512 879ab9e70cb2361f0db1227c607622066276d78df0a0886cbc7cfe17b17e89bd0a2dca9f2edf4dbe4808ff0d3aa6b5ba158c0de3837423f30131b811b4a55032
SSDEEP 1536:A3RdY10tY8B/NnTvtfauvbweOSCk3qunGehtHn1ad1rRD6JM4o:YdM0tlxlrcu0DSYqhV6ZRDuMP
TLSH
T1C97302D5EA9BF9F382C4AAB49C780A64138CC4CDD723B93A837A4DB1D0A418D76353C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk\Default\Cache\Cache_Data\f_00000b
Size 19KB
SHA256 39d2f0b409ea7f5c6741ce06f4e42f63cbf63e14e4e3ae38c88943f78583aa7c
MD5 3d269ce4bbe1983370c1ddd6b4ba569f
SHA1 e6bb57b425d38e05723457fa695156f889868e36
SHA512 91fe40e1d295e11d9e4bb5950061961496a140c2a05b47f97e6a8dad6593be160ffe931c09093a38e7038a4396943257a04d3e18c23fe63cff6a2d153bcf67de
SSDEEP 384:cKQxo4vJfpmhs5iKVCKyBicivJ+c6SMBfA+SVZzoA07CGyCjC4Pv:FUvVpmOk0yQc4OfrOZzHHGy/Yv
TLSH
T16F92E1AC93DD7418C6817721057CEEC65EBBD93E307913033D068A4B67B61396BECA20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk\Default\Cache\Cache_Data\f_00000e
Size 59KB
SHA256 ac2d5e8c0163675d5a39c26423f0be55c323c86628a7d7a76193c06e6b5af4c5
MD5 5c96515bd64ab139a074b7934d221722
SHA1 228a176a0210f7ad03314cf692a2e24355745d78
SHA512 d1379e23b61945daade2bcb94718ed0d101eea2c90b5f549333871764cc585949cfcafa28f9ab2b63f408765a336b9ad6f41949c30d2128b484c805dd470f4cd
SSDEEP 1536:w53Q6PSnPxx8XFUyCuDaYs6hw2wjK7Qg83sICAcv+lnLj:wxb6Zx8XF/CEaAS2wjK5esdt8Lj
TLSH
T130530189925ECA6BC1F8B4C6C9FB82362140D86F5D4F0A7CE9BF6100702E7A5D49C293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk\Default\Cache\Cache_Data\f_000010
Size 72KB
SHA256 ddf3077d8b428fbee82ecb6336d54f25937daaf7dc66afb15e933d58868f5960
MD5 d99440b7711d078d2f12d4b1fb8665b3
SHA1 f68a021ccc260f1c733e1835ba129deefbf46b4a
SHA512 1c0a65ac7b21a00ba9f978cbaa9e69acbda56d8d1b825fabd0f9bd4a82e7d0986722394e0695748ccb421611f85947e5ce990d343b95d51aee1dd9033efd0226
SSDEEP 1536:79YKzsxq8LOJVA2V6+LgrJv8LQoRwXvg0uEgM2q68s:7SKgxGK2orgQoR4o0byj
TLSH
T1C373023588194C781D0C99C7EB1BC28E3155EFE2890DC59696AF488E0BDCE7AEC156FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk\Default\Cache\Cache_Data\f_000016
Size 17KB
SHA256 84199bf92fd6b65ba80ad32b03484aae8272d62d361449d9fe9747f63b745b8d
MD5 6cbe4e49fea69d111aed4ca0f908f8cf
SHA1 2d92c85a82ee0ba493b772cf8bfe3533dea99a88
SHA512 b1e8959d38f3247c4b9a91a6d021cc092d213607ca3aca61bdfbe1861c07a37684bf7e2bee11041e9ab8c9779d7c165acbd590822f2e273f92a6e31b48df9464
SSDEEP 384:HNTMkaT/tyEXNPNaPzMeS4su5npRTPjNAb+2spnjBUem8eFM:HCrQsNkPNS43pv2sZKM
TLSH
T1A272D013D62FBA5FA4AD856BC0A7B051B4D329B04DAB8D235519ACFD722491CFC2007E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk\Default\Cache\Cache_Data\f_000017
Size 36KB
SHA256 1f2687975699221845603893277696a0c1c50970b5c77d1db1af05e8dfbd5b89
MD5 b3dd32a3d3c41e429d7bdc6005de7eaf
SHA1 a0d3e3e0946439ffde8bc35aac02b5b5b7e1a068
SHA512 41d5238708923af187cbce18224158af9e75099e3633984dc8c4304880d7b2db95af6b02dc7fbebe85a2ab03f81e287596c3f7c8712c1768e832bfb1c63c72c5
SSDEEP 768:Oz0SeiaAMNGPXECQ9Sq3UfJ+cJpUyJ11xpoiSm/RhKuJQoib:y0SeaMW0h8AUf0ktFxpQuJEb
TLSH
T1D203F1F6D768C413B65C68940E56E6298F459E34F36E0E9FF2C256F283331ADD1B2884
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk\Default\Cache\Cache_Data\f_000019
Size 16KB
SHA256 5333864ecc3ca714e93deb11b85fd39d5ba952743871852a3c8b99390aee9c1f
MD5 878a1009ca77cb290f78a4321430b354
SHA1 a664c6d43477a601e1aac114188c2ed1aff17776
SHA512 9e72deff07d1385647e6ba5202d5d5dea516923685f5c0d742e37dad89e5a4957f8dc085c9495276ce14eb7c47fb65ff6cd8ec2bd7a289392247430dadcd9aff
SSDEEP 384:g0s9EJmbRs7oY7Px8xf5JbP2xx0wCg+cq6fRFlZ1od:JyV4o2yKHb+cpFlfG
TLSH
T14D72E1812BCFF27F837C3964280817CD12AED65FEA9630D48062D2B6ED7898B6951C14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000024

Path C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk\Default\Cache\Cache_Data\f_000024
Size 16KB
SHA256 5eb167ab94fc6cdceab5df5698a3efef30b280409b3be22f8eb8b7b650f8f11e
MD5 a5e1b4295a190a60e39532f428027e45
SHA1 456a120a6d70d210860d7c54a8ae4a992e69a96c
SHA512 e6856635546e9fcc66708a27881a170f6f1102f320c18fc23bbd43266b595c0658f4c3d351204e40855f9a920a60616db0edd12b28e8bd0fc092938b3018f252
SSDEEP 384:3xjbJlwlmQePANOnGt0S0urySeSni4zhwa/PXd6FJxVq03Jyt:3xjglzAdDSBeQFzbloLIq8
TLSH
T1F972E1A3B61F712A7B163308A771DCEE53F64A01620335A08A2D9BFB59C7C19441DBD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002a

Path C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk\Default\Cache\Cache_Data\f_00002a
Size 42KB
SHA256 4f8779254a469ba9475945b78efc9750a133bdc0e91c52d01f48a52e292eb17e
MD5 ef69441325a6e220b81dcf1f31017e66
SHA1 8f3fd9ccaeb161e5148389acccef8558ac107dd5
SHA512 79820384da961123a77a02e2bdad4827c846ff6191927b356ba34ef30a4f0d84417f68b5d590d89ce8cf9a4f21742f36a63fca6e62066c5e5ea03de13d3f79ce
SSDEEP 768:+beT+IIn04PuvQfyWQJ3mk7MU1Hph6uABl++Wec9oSa91cPwLDre+E3ARJ7OBavh:liI94PuvQfjAHpGXc9yuPw3I3eZ1h
TLSH
T18713F1B67ABA1580C5173C76E1195A93B6CB4AB9C4283A7A7C071FD718B7483232FD14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 763dbe6b4966843ed0330dc1d933246721c99b653f7d9f7d3bba8abfa230d02e
MD5 3ba42290d4f10be0a5541656b045b2b5
SHA1 06fcf50826463ed330a5ee35a3dd56f326b81c5b
SHA512 3d5254eaa6ab83ace4c1f57d8f36d34fc7ad6cf9fd97bfc660374a41132d2b92af5120e02bb4612fbf54735520e839ccca9181b4a82788f635c7a0caa683aa36
TLSH
T119E0C0772EF72C30A92F83D2107194C841153C44C841ACDF5437B2DB10713413897C63
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 c0b4c738e1ba3d585caaee0e8343dac0f986195260de55ed4225a86b170f235e
MD5 522775f492a3d7304765f0ba98530676
SHA1 13cc2525b014a9a9cb45a13d029fd7bdff368bad
SHA512 8abdf99d506d59f1a9a66933fcbcd17586331e9af88a57a866595e32dd34be6e4bea0040c2962e2b5cfd8486043322f165c87d9dfdd367f406f641bdc9d29c30
TLSH
T13ED02BAA1DB528209C6F87D2103150C495167C54CD44ACDE042A729724703527557DA3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58e848.TMP

Path C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe58e848.TMP
Size 153B
SHA256 d2b44f28070bdef566197dcf57fb9ef8080c04d4f4c4b8497bbc7b170bbaa3aa
MD5 b601591b0b73b5c22f5d6afd74a8d749
SHA1 f9ab2a14f53008f8905a536b396111d19a47e5bb
SHA512 7630c1f9292bcd63c66e17452c66dbbfbc581145c75184fc95f7663fd65af1db2797e1c9fd1799b7b5ce106eb245dfc444bf52818c7b75d123caa24ee900387d
TLSH
T127C08CF71E642800CD0682C10032549192222C888940BC8D802EB2DB30702223262D73
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk\Local State
Size 3KB
SHA256 624c508c014209d04ba9c633b0fcfeea6680d9e0c761cfa5687bc8f03bfc7c0e
MD5 da3d570c3ee6452f155791e82f734515
SHA1 37a6df21a05384edb12c4cac516b8e934f0bf60e
SHA512 688380bc8daccee4d4958bece83e110876cc6c0e695f1a8f21fb1e55d9aa4281dc26de274ca66b42f35f002830d2583683671c61e1d816b970028fd2a6653265
TLSH
T10581B8726828EC7349E96944B88B36939E7474B3DD65AF5CE2C8670800E734C3B0EC26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk\Local State
Size 4KB
SHA256 ec38a7190d76077cdb8d1487506c0b39ac65233faf05e6200d32fa1749e74ff6
MD5 e25e4695c4cd5e9075caafb63ee816a5
SHA1 5eb67a3ea2ca2999f8eac4da51f3774fa4835844
SHA512 51747cc9fee32cd49f553751938b73b48c6d432d077e88b647a54463be4fa54592cd1d1498ff475c7821ece52a476f3a54576bb420b79434593d785b03160375
SSDEEP 96:TqGNkcQsFfy7Gq58Frh/cInURoDotov23aDNBjSnvqvmLbj0eUnuvgq4a:2GN037AooDUw7TuYmLbjqu9
TLSH
T1B0A1B7726438EC674DE6A944B8CA26976EB46033EC95BF9CD6DC1F0C00D7388274AC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58d973.TMP

Path C:\Users\Admin\AppData\Local\Temp\b3hwqomq.0zk\Local State~RFe58d973.TMP
Size 1KB
SHA256 08237d9a80215804f105d694d5a09fea44b7f49d35ba98ca579f20e9b61aeeae
MD5 c611cce31bae5832ab97058d2aa5d928
SHA1 e6e4f6aa5e59ec5bb241d7059fedd173301dc763
SHA512 c3e4f6a1f3c58de284eb56a675674d53a7c3f36601de68949acb5af60103d16c31482676fcaa38104889334960200c7a25c3bfd4ff9c80e029e53f0c320bf16d
TLSH
T1633197B16C2C6CB3ACA15646F28EAA9B5E70A431D27A6B4C91DC5A0D01E358C630EC36
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\vmc0pr21.p3n\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\vmc0pr21.p3n\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\vmc0pr21.p3n\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\vmc0pr21.p3n\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\vmc0pr21.p3n\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\vmc0pr21.p3n\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\vmc0pr21.p3n\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd\Crashpad\settings.dat
Size 280B
SHA256 7b4a4108417b515cb20ee9b2d6e0c2191835642b6b884af23acc2915e52b0e6c
MD5 4b7cfa2b4e6370f67a9dd1e28738fb50
SHA1 5415cb8c3ac0722f878bbf3b5b1e42d0e29c6bd6
SHA512 045e691cbfe522705ee13877f348521cd9e2550aa17546654e691d868c2a492dc33e7751a4d9474aa90c2e46a6a54f145192c9eef7a3b2532145514c72caa8a1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd\Crashpad\settings.dat
Size 280B
SHA256 e0807e87af6d54a760635b63dd9ba7f10926e82f64df33411cf65081b5eba392
MD5 091f7d17656215640d93d2f64af67c1e
SHA1 9a610575c35ad893dc8c8edaa0ac7c3e8005acb1
SHA512 4ab74a116adfb83b13146e5d5fb8920c65f540003a0a0f031e4405798a87fdb7c20eefe223e16e4d454010f5ec36949e466854a338c6af9ff238aab669f932a0
TLSH
T165D02223F300C030F00A22B30038C3302A08CF30030F832002AE2C08C8EC0E02ECA8C2
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 53bd0d6eb575b33028fc2ea80c1bc33bb414af2603995f7557dc1d189f1c7d0a
MD5 bd4d44cfd8d598d53a32a3262ee45ac6
SHA1 8cb9c41403d9fcd64b551efe078bbc7c4a8d2f6d
SHA512 0ab6c23a0369e8dee0193c286bce5f6e899a2e90df27b4ac534eff3577975ae539db5504e077e390804fb5b24437fd97d4773b30c1aba65469b94e41cef4b08e
TLSH
T1F2D02BFF38EA14509DFF97E21471509500267D74DA81AC4D153DB6C370B13127426C61
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 153B
SHA256 60eadb1693f1676ef3535dd6b586d1bc5068bf55d88d8ed72ea35f98f7276b01
MD5 3a55537a9028f3b1815bc7cf71a39c98
SHA1 a090b45bfc0feba15f25b3cccb493da80b161857
SHA512 6b5e78f4ac1a838bcd7fc4066cd63372575dfa16512010342649e4ce4e709660d8fda9636c12b234cfaf3f26ab08b24017fa691dd0a95980f6d9f1c00fc40cbb
TLSH
T14BC08CBB2C9A0400CEAB53D2003124A942266C94CA80AC89002DFAC3B0B12223032C21
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 5c65894e1ed035f294c3cf415613d4f547fc6eacea688f049d67cd7cfc6de04d
MD5 fbfcaf687d48cbfc11658197b2c1353c
SHA1 4af6abbbf30d60817942d7fbd8cc7a078b415220
SHA512 9b83a57a5b423f0cd03433f595b525bbe563554a38e7c2d724d287bf5806f487f09ada052f78536e4a0aa557401afe9de6a017ac75222ee6fdaf38eeb8950b40
TLSH
T1D5E068BB3DE71410BDFF87E61471409400267C34C881AC4E553ABAC3A0F2310202AC62
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd\Local State
Size 4KB
SHA256 930234975e856d39a724f5826964e7515fc67671414d8d474cbc84b98a27b3f1
MD5 0675a3edd665f9d023d92fe306f17e52
SHA1 d83040f7ca92f819a8af1420da0ddbd180f113a2
SHA512 38c16197a3ceaacb7d78f449e903208d91012a8e22efa382d8dee7b10e2139d123644bc64a7cd5eed4cc64f4ce4b9870a657e6471ce2170da6f673338e973d19
SSDEEP 96:tqGNkhsFfy7qtQ/21zTEtDRB8PIvQvQxvj0eUnbEqq4a:EGNe37qyIHSnG2xvjqbK
TLSH
T1608198726828ED7699E95554B58A27939E7830B3DD25AF54F2CC171C00E725C3B0D82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd\Local State
Size 5KB
SHA256 28fa8e02654e7d27f9c2b03001777073e947e4a45a43faa9b828c259f6468cb7
MD5 cbcd8d6945ccd87b9d9a8348501bc57c
SHA1 12edee1489c540bc584441dce0232b2cf6d8ac99
SHA512 699e2da582c977167e24aac1095ad653b7cadaedd6720d0317a0923345929b08c4a266576b8728b1f94eb4897056c369198296824c4bae3bfa5bac9dd16dd522
SSDEEP 96:tqGNk2QsFfy7qtQ/258Frh/cInURoDotoveOvtDyB8PIvQvQxvj0eUnbEqq4a:EGN+37qytooDUwNdSG2xvjqbK
TLSH
T1F6B1C9726438EC775DEA6944B5CA27537FA42073E855BF5CE2DC1B0C04E73982B0A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58c3a9.TMP

Path C:\Users\Admin\AppData\Local\Temp\xxhm5gsg.mjd\Local State~RFe58c3a9.TMP
Size 1KB
SHA256 34fb80a18f220847c1a415f5d6b8ecef132aa21b2d917dca369f9117a441eacb
MD5 a97f261133c6ac5bc17757024ad4f47d
SHA1 d1dc70a291dd40a05a7d1d79c687dc469f5e0638
SHA512 23a0408eb5f5c3318b2c0d375fe058c0a157c08c7db6527cf2459ff95dcfd5ae280e428a94183aef29921bb3b9ecc883e7ebd59823cba756a5b89430d5014ff4
TLSH
T177317872BC282DB2ECD51645A34E6B632E34513191265F48D2DC1B1C05F329C661AC3B
MD5 SHA1 SHA512 TLSH

Submit Download

BCuZxCyoAooO.exe

Path C:\Users\Admin\AppData\Roaming\BCuZxCyoAooO.exe
Size 1.5MB
SHA256 55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7
MD5 6be8ddcc17d262e9a648712cac7ff348
SHA1 41d50f868c0a14049c88df57c2c47c4dc859815e
SHA512 5b6cdaab6ca17b2dfa0fed801e86b58bcee4f8bdfde9bf5cd3e3590310159624a896ad9459e447a187e3d74729d030a5781b110cbbd8d8921ab5c686801e2f89
SSDEEP 24576:v14A+J/8aH2qB6jzSqECsw7PoNNnvQFWthRKgE+1qwRb9UQ8QWVUdRi2UhR:dV8fH4WhCswToNZc8PdE8fWVui9
TLSH
T146751219021FDD06E9B7CBB80860E3B406B49E546A35D313CEF6BEEB783279169053D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 c7cbe6b0d0313a642e0f32c0719d13b3c671ea329cb568cedb56981cdd9d6756
MD5 586475714fda10620fac26fe5d96d344
SHA1 4f6fe0c3984dd7348d75b2157bdb2a1b456481c6
SHA512 620244c90ad42fa91081505b44f0a3fd08957cd72850c4c57fc27cff312b84017c78f3af69a6bc7274f3ca44acb8f00cfdafeeaf7b84f29c1cb8cdad8c6404ee
SSDEEP 48:4vXn+dOKhUpUJ9zCNYZeRdLXuHrpiuXn+dOKhUpUJ9zvYZeKgdLXuHm2d:4IJo5nuLIdJv5KIu3
TLSH
T1FB9130015BE51956F3F7FE7295B3BB216B3BF84A8A089E4E008141080C72F149A2DFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 eb9e8529befb2327622e58274f67ce118136ba22fa2c9ac79a3c77112603ecca
MD5 0c57b36ef71fc592257f5f3345b62d19
SHA1 a55e3408917d6c5430055d92e70579231c15ad61
SHA512 afbfad997e2b5c3bfb4aeaca490ec59d5e0c20ecbf28c1dba25857b5ca57307edca17ebbf2ec6d4a852c7b14a4e9597ca2b3846811e35136cd0656845e64c697
SSDEEP 48:LvXn+dOKhUpUJ9zCNY1dLXuHrpNuXn+dOKhUpUJ9zvYOgdLXuHm2d:LIJoquLbdJvRIu3
TLSH
T1B8911F115BE6195AF3F7FA729573A721AF3BF9498E089A4E008141090C72F149A2DFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1c68b15b-792d-4859-ba45-47a34eb158fa.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1c68b15b-792d-4859-ba45-47a34eb158fa.dmp
Size 66KB
SHA256 b92d1502d16ecabd53d6843c5b3e8b33ff6b7de26113da79e946ec463c9718fa
MD5 ba410004077ec0080a653b712d723b42
SHA1 5b269a7c867f497d3f54ed965cf3a864db2d49bc
SHA512 fafdcc6dd151a75588c51cea8f5f51d45179f5b0ec4fc9aa9e42dd2fe7153a6984c458a6dbdc8a46eeab325296b93e25b962c263ff990daa5e0b12815ed7c752
SSDEEP 384:iywLl7IoKVVac7RUXXK9nvL1kQNGTtInBidXSG:iyKJIvnac7mXXKVvL1BNGZIQU
TLSH
T14063FD1663A10D3ED627A6325BE76F443FFEE4A4079343DB1244817A9CAA345ACF0F61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1c68b15b-792d-4859-ba45-47a34eb158fa.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1c68b15b-792d-4859-ba45-47a34eb158fa.extra
Size 1KB
SHA256 c4695015e32436205e2fe6e26c56d95a6c8eef77a907a75579d0eea895362722
MD5 065fa8e14d7e6bd5f6974020310b9ec2
SHA1 4d0df950ec2e49c1858c5dc1551e4ad0669fde95
SHA512 05b5ed77e4a0a8caee73acfbacfe269d2c09e830eaf251258ca9194683c69c5646542f06d4d133fd7ddb8a9f1a7079facc32a1c12323371c4ff7caa6d21cddec
TLSH
T1773176B7C1EC2D6299578998773B1303CA99B72345D36D1D25CD4A4C818E4DCA367AC3
MD5 SHA1 SHA512 TLSH

Submit Download

1c68b15b-792d-4859-ba45-47a34eb158fa.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1c68b15b-792d-4859-ba45-47a34eb158fa.extra
Size 3KB
SHA256 2890e93de64db352e8849c043b6321af02995fb5a2b2819fb0144b58deca9d81
MD5 55b6db356dfb9ff39644f88dea620e43
SHA1 159b03225f3f9a050878b9a0a34929d719d68c4e
SHA512 e067c5eeb2a5f3b9fe4e6dd5472892d551072f2ae30b1d256e20c6615b4c62f9011eb1541403257ae8f1ecd99929f127fa901009122b0a7de5acec55188a1f82
TLSH
T1B9810172005CD9276AEB5D8AB3376D5D89AFB31998622A8C85CEC75C01A9CB47386183
MD5 SHA1 SHA512 TLSH

Submit Download

2eb63e6e-6e96-4332-91d6-32fc86c0acdc.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2eb63e6e-6e96-4332-91d6-32fc86c0acdc.dmp
Size 58KB
SHA256 5f7805b7fdec9cebd2d15f44d729a052a7c49cac0d134e4ea591e02593271b50
MD5 ec7a6201e4bd92613d7cd35a76c0d31e
SHA1 34c7a7df5d98ca293e536095084b5e3e4fde7197
SHA512 bdd2fcbeac50b7e916b3bb9d4827d8d09b7753f1e640f5d647b8868b807a81f8e97a3624b049d3821a7728b02e673b561ed77d8acab37749b24c4090ab05794a
SSDEEP 384:MAmq5E/XzX4zLzl4A7dgDRsdHsGETxgA9k8XSG:MEC/rHy6DRsdHsxTX+J
TLSH
T10F43CA16A792087BDB3387365AE7B3553FF6E8201753836B4256827A9C733646C31F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2eb63e6e-6e96-4332-91d6-32fc86c0acdc.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2eb63e6e-6e96-4332-91d6-32fc86c0acdc.extra
Size 10KB
SHA256 91d24cddedf37fb5801e21547e621834ac2a75098539155cdf5aa6b702378b75
MD5 689f2d076fc11ea82fdb4345291622ee
SHA1 d6eb066dca768e734a7bb73ce68796b015c35431
SHA512 13bc226bdb5e2b314269b33139557ecc5edb02c1eedf4f7deaa676ccda61eb2614f16d4bee69fddce28d9a4d20b13fee160383fd30ae2ca4d3fb002fda7bc059
SSDEEP 96:STWCLTEzY6pw6lFFdtH0Rh7CsevBb1d0tjMLlIrLlhTLlaXv7avtutILfcBCqwvh:S5fEFbG7uvZ8JLtxsP5wlUJfoz
TLSH
T1A7226253878724B7AD5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F41FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2eb63e6e-6e96-4332-91d6-32fc86c0acdc.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2eb63e6e-6e96-4332-91d6-32fc86c0acdc.extra
Size 10KB
SHA256 3360eaa3af5cb09e31db4bde7f9fd9c492a388567e6a67c0b716beee66b6bf2f
MD5 6bbc91f33ee6b2ef11ba8329da41022e
SHA1 92cce5c05a621e106120953eb25531f961579fee
SHA512 4bd7f3b31ec1889c8923b8611aca00571427a1de64d0a92bc6b387fbd085dd44d51f7f67f9e02af6f631c759b597e08c416cfc220d2942cb51d6aca6721c044f
SSDEEP 192:S56cFQiR4p4DnTYapdVxzPjWBHp4T/fKNtalMJfofbL1ChpmB:i6cFQi5Dz1LWBHp4Tma6Af1UQ
TLSH
T1D422E631081CD837E7D7AC8DFB393E3A966D7B1A10E678AC40CCCA49C1A5478A779553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a9095ab-9d9e-4451-811b-eb0ebb33b473.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9a9095ab-9d9e-4451-811b-eb0ebb33b473.dmp
Size 67KB
SHA256 06ce29d5fa18058656198d6572eaf8ee1a7d4b363fdb346441303e2287255c54
MD5 8e5ac668d5c985fe6da757fab227b05a
SHA1 0b5c4df215438ae20282e9647a0401afa94d5e02
SHA512 98cb605fc99775fdc13b0b69e98451dee202c8ff140f5cfb27df939ed77c3ffd05b15fe6d0644c9dcbc89df35e45c5979e9049daed73834024e545799d11a634
SSDEEP 384:SGSw2N/16mVcapO19gfdaO04SaCEaVC7bg5eXSG:SW2XpVcapO1uzYEaj3
TLSH
T11163DA16A782046BD93986356BE767A53FF9E8201763876B0214937FEE67344BC30E31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a9095ab-9d9e-4451-811b-eb0ebb33b473.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9a9095ab-9d9e-4451-811b-eb0ebb33b473.extra
Size 10KB
SHA256 ced0954ca957cbc71a5c6d44b4298a5149384e5a820d7ce151ef1e7ba44dec7c
MD5 6e514e7aed6a481e98c96e62fe577169
SHA1 648e5f569b077ae6370e4a35ef8416a625d5416b
SHA512 b48b0c354478072c5c22a8079395f84e73e0e636a86a9766d8493a04e9d9ece51e983a15d1a7a85e5d2a9eb61814ff5727508ed0ca007c9c73ba04cf8aa4f896
SSDEEP 96:STWC4CTEzY6pw6lFFdtH0Rh7CsevBb1d0tjMLlIrLlhTLlaXv7a+utILfcBCqwv0:S54SEFbG7uvZ8JL0xsP5wlyc8foI
TLSH
T19C227253878724B7AD5194C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a9095ab-9d9e-4451-811b-eb0ebb33b473.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9a9095ab-9d9e-4451-811b-eb0ebb33b473.extra
Size 10KB
SHA256 38d3682d1904ad8a1eedc50818a6481db3b64d9f7e5c40dcfeac9f3666635ea1
MD5 48306051eecf1b6a3a9a38027cb38760
SHA1 d09d428fe15fd307f4adfc9065fa08bdcc22f942
SHA512 8f17fa860be52096b739d173dcb3740036e8454acd3d7369ec5b141bf55db20cd1faf962f50d83518de8d1b8e97c5a31827aed21e6ad1b5396013b97aeb965dd
SSDEEP 192:S54JcFQiR4p4DnTYapdVxzPjWBHU4T/fKNtalqc8fo4bL1ChpmB:iocFQi5Dz1LWBHU4TmaEA41UQ
TLSH
T1D332F731481CD837F7D7AC8DEB393E3A966D7B1A10E278AC40CCCA49C1A5438A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2db5d3a-39a4-49f3-8a98-890c252adf0b.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a2db5d3a-39a4-49f3-8a98-890c252adf0b.dmp
Size 65KB
SHA256 8e357926cf8c06da8052e9702a0399cb5d5efb9f177b0146c8c86e3513230f7b
MD5 4cc0ef760f74251d12b17bd3d30a864b
SHA1 ff5f0f65851e7985ae9542677a10444beb711568
SHA512 604ba2472c8d0b7f33eca648f9f02b55fa7049ddb052ece6b9d9c9df79fa3b917b8750185ab15aca510035ed152e44f9e151cf3c2608915acdb2f9d619f18201
SSDEEP 384:6hIX6MG1eLDJ9rMNy9RdM8fMF2r20vhAUH+UGLptIUywzXSG:6hCZGEd9ryy9RS8fMF2r20vhAwqg
TLSH
T17B63FC06A7820436D9E1CE359AE7F3C93FF9E62057A3536F0254417E9CEA74A6C31E60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2db5d3a-39a4-49f3-8a98-890c252adf0b.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a2db5d3a-39a4-49f3-8a98-890c252adf0b.extra
Size 10KB
SHA256 d4a4c49e0349f0b4778d0e9c2ef090d52130194e0fa152b96b20e7832131f985
MD5 fba214cba696a608bd32b9824859ccb0
SHA1 45092314a37fd2d1185bc90140bedc6ba6a21202
SHA512 88f2ce990a443a67b227893a5876865f14eb88ae5b45e38d049f7fa328e52c707009d11c88d7a249a3e6a77a49f21ddea01cde04fe07d1218af14bcf0c233d65
SSDEEP 96:STWC6TEzY6pw6lFFdtH0Rh7CTvBb1d0tjMLlIrLlhTLlaXv7a/5utILfcBCqwvEY:S5qEFbG7WvZ8JLxxsP5wljsfoj
TLSH
T1FF226253878724B7AD5194C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2db5d3a-39a4-49f3-8a98-890c252adf0b.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a2db5d3a-39a4-49f3-8a98-890c252adf0b.extra
Size 10KB
SHA256 00bdc12310e3cc389f1b72b6ed7e0447363fa99fc28df37754d9dab38affd2e6
MD5 7e2de3e57d77d9ede73a438d365945c8
SHA1 3229f840ebcecf8df808a07c8c6a7aa258435f77
SHA512 930fc1d5ee44a74aa4bef7c7fa363ffc190b4d1fb70c7f60f800f217b5434a8db9085f580a1d38136b3fb081b66d96cbe4dcc9621e5da5d1d0fcfa2794baa502
SSDEEP 192:S5xcFQiR4p4DnTYaVdVxzPjWBHB4T/fKNtalbsfovbL1ChpmB:ixcFQi5D/1LWBHB4TmaqAv1UQ
TLSH
T11C22F731081CD837E7D7AC8DFA392E3AD66D7B1A10E278AC40CCCA49C1A5878A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 7b62ab8f33bf22f9b8823ac5eccbb7a14b3e2f46e62a959c6b8022ce308e8970
MD5 07a8fa2dc5cd965a3c7f4cc835987c38
SHA1 37d6a84900b8d0349197571a4c3eb096ba7ac194
SHA512 d3ab074d87ab800f9d96e323b233bb15ea925751a6749cb7f781570ab23d16c7aea8665fdec4bbf86ea12c5bf612ab64ef26257011de9878b6d7b21365440b48
SSDEEP 192:ROv5zbonbP2yj68s1d66Joz0dzgCl6mc0d:ObonbP2yjWd66JozQzgC1j
TLSH
T109D12064EA28863FD404123BCCA51B404F36355BDC4E3F19369D65082D572DE7B8D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 023edd1ad029a694e33b36849a1644fb339ee98c474ae0be17f8d3d7840dc553
MD5 30494b3b9c65c65053c884fbc9c70e57
SHA1 7d45e4a06fa9c4e8720ade2562d4642b18e21e7b
SHA512 dbc707d3fac85ac4c7ef3cc4937c2f5285b9a8c1750b177fe0587270ac90846f73f996a9066506fbe71ba068651f5618960ee16f44b386409c6b250f7accab9f
SSDEEP 192:Bg1d66Joz0dzgCl6mc0dtOv5zboHmZP2yj682:Bad66JozQzgC1j8boGZP2yj2
TLSH
T107E13064EA29863FD404127BCCA61B404F35399A9C4E3F14369D740C2D572DE7B8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 6f1a989ab3504a487d9ca2d7f96301d708d5e1ce42f6de59e2235d16ef01c0d8
MD5 c751d869221a54083dd8e4f4a6b159cc
SHA1 23f2322a0b0ec973d398ca60a9987333d1f6aac4
SHA512 a929b881e732ee3e97eccbe30be4f4bc44427d6d0364ee5b197e6dd82073901a6c93fe60c9e8d30b26e7b7bc46e95acc6336e258628a1ff078474dd6797473fd
SSDEEP 192:Qw1d66Joz0dzgCl6mc0dvOv5zboybP2yj682:Qqd66JozQzgC1j2boybP2yj2
TLSH
T1E9E12F64EA29863FD408123BCCA61B404F36355BDC4E3F15369D65082D5729E7B8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 6600eadd65ef5d276686c95eae7ec173bc1fb6c3cc25384c962c114c616e0fbc
MD5 6c027ff3925587e4e67534c8727aa37d
SHA1 75d5afde1127eb428ee60b65a8c6a5dad1ddf661
SHA512 c9e92ecc863fadaf947a1ddc8b3f73d407e53cfe794ed8ae3481b49376e791891494c1fd3ee5ee8f9c3fcc024fae271cd6f305efbf3e5487225dd99e8774a984
SSDEEP 192:SOv5zboHmMP2yj68F31d66Joz0dzgCl6mc0dz:RboGMP2yjFFd66JozQzgC1jd
TLSH
T14AE11F64EA28863FD404127BCCA61B404F36359B9C4E3F153A9D65082D572DE7B8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 264e4779c785dd644caf40d904783e62d02d375e17e4192ea87b4988f0ad911c
MD5 fbb82042b417838d2621d51743c78286
SHA1 012a3775eac3c737cca02c46f6711e80eae7d0f6
SHA512 3f0418be76f522a0020643636db90e4bf440a2a0839640d5fcf5694a2aec1184b516036b9609b7d450a6cf72240a2d72a05c56db06484b6f085cc6b6d94dc1fb
SSDEEP 192:7Z1d66Joz0dzgCl6mc0d6Ov5zboH/ZP2yj682:7Xd66JozQzgC1jPbofZP2yj2
TLSH
T121E12F64EA29867FD408127BCCA61B404F35398A9C4E3F14369D640C2D572DE7B8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 17a356d7121404562836dacc804a934f27414a71147da8171af861bcd34fe262
MD5 e1b3b95d3ac8b39c38d6985f481ad42e
SHA1 b61f687e55708a1b1822956a9b21bc1c82964aee
SHA512 bd998716be9b4d3b79aa71f7447dd3874e65ce99884951fd210c289ec5158e558e7eda98088a22db9967c9977371f07ad0e88aad887e02607c318e27ea707392
SSDEEP 192:mOv5zboHmZP2yj68F31d66Joz0dzgCl6mc0dz:dboGZP2yjFFd66JozQzgC1jd
TLSH
T11EE13064EA29867FD404127BCCA21B404F36398A9C4E3F143A9D650C2D572DE7B8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 7fd486656e9c0ab5334e7a36fde3c67db5b6a85ac622ac5265cf4918c4b15665
MD5 cc33d80053f151da133c8ce2db1a3436
SHA1 ca831f2df76a72760f8f1586d2c826ae71b24f66
SHA512 608cbe97d3a790e9d59e4c0efe2760a5094cc61024ac11dbe43e02628a29e325b3cdaaf2045787557c7dc5a72ffb38b1dacbfa60380c44c0982c793e5fc0b100
SSDEEP 192:mOv5zboH/ZP2yj68831d66Joz0dzgCl6mc0dz:dbofZP2yj8Fd66JozQzgC1jd
TLSH
T1AEE12E64EA29867FC408127BCCA21B404F35398ADC4E3F143A9D640C2D572DE7B8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\events\events
Size 1KB
SHA256 4e1f7487e94ed0433c7c3c909e82fca74b6328c1dc666be7074aaf11815fe543
MD5 80d00727fecfc4a6e5b9da6ba6a5269c
SHA1 5743d9138280de4a7b33308d3e7422445a1e13df
SHA512 91bd32d47c8e6dd314eab5c9f8fde123ed6c8d51ae168b326eab29295091c20ca997a3cc848fbf8c226709d520cd6b518107419766359fb64fad76829bb5936e
TLSH
T19A21486D3AF84D2BA9C7E29C744002CE5796CA1604972D434D02EE8DDED16D9327A43D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\events\events
Size 1KB
SHA256 80fe9f0e313fca3e83e232a37ef59c64989d4fd71ff4e5de06ffe5c7fa61f906
MD5 837e3c34b7c1bbef08b6ce36123f91ca
SHA1 89b73865ce56d9212ea4d9c2da26328d0e508e02
SHA512 97b31b97fc1de40fe1a8671c3dbba39823e8d8078b772a0e75f3df6d5bb07ae97336e13020ea0e767a637dbde0aea18c378de9ec41ccac2970060892b98962c6
TLSH
T176216AAD39F84D2AAAC6E25C744102DE5796CE0708972C470D42EE8DCE92AD9337E43C
MD5 SHA1 SHA512 TLSH

Submit Download

0afa68c0-f295-4bec-9665-73c8ace0d282

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\0afa68c0-f295-4bec-9665-73c8ace0d282
Size 3KB
SHA256 621eeb18f187adbc4044177585c03fb98a9a9d83a720bbec3d7d97885292bce7
MD5 a6211c25f16f90b9a3bfcf2d39a32370
SHA1 9578507ac5a6ffaab40b9636d051ba8d32fe1199
SHA512 dd43e989a72b584485c1542d3cf97c6470bd69a65084320b8f64e46a3a3e310d7627bad9af03e78d5e128feb7e5e11d93dd7d466288c457766ed3d8562dc0e7a
TLSH
T1936144714568A9739EE8A005E3776DA48EEF338B58430BCA655ECD2442E842467CB35B
MD5 SHA1 SHA512 TLSH

Submit Download

14cce24f-8664-4924-a0a6-b4138669b7f2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\14cce24f-8664-4924-a0a6-b4138669b7f2
Size 886B
SHA256 1afefc73ce9d3cccc8f25047f7ab955cd304becee4ad642b012386c837c47553
MD5 d49208d56275543dc62f9b9ec1fc1e26
SHA1 1a43f087660d8115009ab7bcf708761839330f5d
SHA512 658f6d3f623f007e4b85da28a2f78871c83e2528b3679c47429575dde56ba5bd9d66b774a5337f4283c115c7434719f9b90972a1a08f8ef052871a92fc5ee723
TLSH
T1D611DC508620F5F2DC68925FD9A177028AA87123C4C949147F951E184D6A60EA767F0B
MD5 SHA1 SHA512 TLSH

Submit Download

4d53bef3-d72c-4ab1-90d2-4d05f1cc811c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\4d53bef3-d72c-4ab1-90d2-4d05f1cc811c
Size 3KB
SHA256 35cfaed42b5b74d794f2394e53bd3917970e3fc2e3fdc87fddd74d18c53c8647
MD5 80775adfe537815a38e8f7513a44a0c1
SHA1 94e379e86ad470679e83ed8da12b2679497e81c3
SHA512 354b32e80318cae5671b3e5ef28ccb4fa8008073026817ad9a123dc421fc6e9c593306787507c446076df494916116b29e8a1dfdbbb305cd5fb152260f805685
TLSH
T1BF6166704514B9738BECA004E3777E94DEDE339B58430BCD655E8D2842F8424578B36B
MD5 SHA1 SHA512 TLSH

Submit Download

4f12719c-d091-4727-9c6f-fcf99c2670ab

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\4f12719c-d091-4727-9c6f-fcf99c2670ab
Size 871B
SHA256 765d055e5c7b182c95cfc53e3ac66cd8364a6b38bbc36c9d531ca80b04bb474c
MD5 c4d264096cba85b621518a072af40df9
SHA1 2b55426043de29645c3ca941d519d3b5ea184898
SHA512 19d9d17c77f45675ba6ccbf81d37e70050c8e378c3324abb94cf207a561f2458d48eac996058760edbf3121db5a471a70956bff7db3171e1e89ed94089699bca
TLSH
T1FA11C0408621F5F2DC78925FC9517702CBF47123C4C648147FA65E144D6A60EEB67B0B
MD5 SHA1 SHA512 TLSH

Submit Download

532222e7-23bb-4d62-a82c-d351b09bdcf0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\532222e7-23bb-4d62-a82c-d351b09bdcf0
Size 235B
SHA256 8e7f360a2720aa2fb789b82de852a642c33bf8cb69baec653a142ae3f57beb0f
MD5 e8c49163291e9af725542df0a2ba3edb
SHA1 405bb93d48ffe2ebc51afe62ae2b4e736339ca31
SHA512 2fd9278b8bbaa9e89ae18310915c433528c649c835e23234ae364940a9fd5de19cb49afbf50855429517b6ee2c2b2d7a850c01e85b28f172b8f4e5d8789078ef
TLSH
T1DAD097845C98275D08100F0AB0A03EC630554C3794A0A820FA92943499FC9C58265C27
MD5 SHA1 SHA512 TLSH

Submit Download

53626261-9b3f-4d88-836b-ad23bf162b97

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\53626261-9b3f-4d88-836b-ad23bf162b97
Size 3KB
SHA256 f51f6cfe7fdacbdec9ba1032a8bec85d5cae7c71f9455e9c88fd2aa164cf70c6
MD5 abd0307f6322bb82536ddefb702a3c5e
SHA1 b9bba525383f03a4b32f5b435eba9470a77a1207
SHA512 bd4098cde0819aaa89e29e76aef2f2161ce837eb3581372094e40a3aa7f82ec3b2f7ae489bcd8a69d634ab3082c3b7ef89a2b8fab1d8e7734837bc1c92450110
TLSH
T1A36164704518B9738BE8A405E3777D98CEDE33CB58430BCE556E8D2842E84646BCB35B
MD5 SHA1 SHA512 TLSH

Submit Download

71d564c4-2ce7-4943-b32b-4f3e455e6d3e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\71d564c4-2ce7-4943-b32b-4f3e455e6d3e
Size 2KB
SHA256 2e5c295f3883a58d24e4cf661295340e26f09fe7faae47ce5a484b737b66d318
MD5 5ee81c7fdf82d3f6f4f4b09869e7af24
SHA1 0c0d14e8ae7b1852cfd8c32d73e14fc69f5fdcf3
SHA512 fe3e4b7072b8255493e7f71756f51343eeee1b4fe67d58a37eb1b14a02d25d08bcfa7d44fa5ac61193d17355c235a46f0ecfc4572fbf1cae0c41b473ac36ab20
TLSH
T18341237C75785CB79CEAF59DD481234D93604A0300C65C832E91DE0DCC9E75A336A93B
MD5 SHA1 SHA512 TLSH

Submit Download

72272245-f6f8-44a3-be51-b310da9df7f1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\72272245-f6f8-44a3-be51-b310da9df7f1
Size 3KB
SHA256 5b8a5c104d2c74d2fee12a8ec391be7ab543b0c8514f2dfe868e3553f87ee0f8
MD5 7e43c716869ae717c89ac1341515413b
SHA1 7772fc1450611a9c65ead7db9a30eec67444326c
SHA512 365c17127a16865b5f039f18a92d582c073c116b4bd34c9bc151de94c7e326a361bded92974446235b5eebee2e099464e396780226d826272525a4bf9368de36
TLSH
T1336165714554A5739EFCA004E377AEA48EEE339B58430BCD659E8D2842F84346B8F35B
MD5 SHA1 SHA512 TLSH

Submit Download

7da17d62-7b29-4b83-aef8-7e5579ac7511

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\7da17d62-7b29-4b83-aef8-7e5579ac7511
Size 3KB
SHA256 16da083c099cbb4d5337ad11c4d7532dceef22e66da5e24a383de3e79f8cf691
MD5 2916769cf941e49d11f7f2b21b60a88e
SHA1 123bb87b5cbf8e603a6c4ff17dd7fd1b74f3ee19
SHA512 39d5f636737a7e57954e3f938febf1e68065f8dae07312e2c0e0073bb3768fdee934ed84945173617c12e957bb17ebaafc9680a30b4b2b2339407aa1d2e7fbc3
TLSH
T1956165714518A5739AE8A445E337BE948EEE33DB18430BCE155F8E2842F84246BCB35B
MD5 SHA1 SHA512 TLSH

Submit Download

831fc63a-73e7-4aec-bec5-fba8a272401c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\831fc63a-73e7-4aec-bec5-fba8a272401c
Size 3KB
SHA256 6f8932875be561f07560dd12ab0fb66892fa2b4a8799e8a3e5ea39e153ae5fa5
MD5 85d7178c5734d383b24cf5b283e05c38
SHA1 16e462ba7193448ddf80dba4bd0093812edacd1b
SHA512 ad3b560b1f2598c4fc725c93f7cb35c4cd81d7ed2bae3f81052d187b91bbe5365eb77247eae793f24ec5c55a01c2eee3d1360020d4f04b7ec80fc91f31f05601
TLSH
T1E26155714518A5738BECA405E377ADA88EDE33CB58430BCE655E9E2442F84345B8B35B
MD5 SHA1 SHA512 TLSH

Submit Download

8c4f8354-8844-457d-ae4a-c3caaad339c7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\8c4f8354-8844-457d-ae4a-c3caaad339c7
Size 235B
SHA256 67d0a1f65877568bb1664188f2fd1f2db035556fc0d2f266c73b6b5a649202ff
MD5 1a8fc41d201f529b044f8b9c23f74a56
SHA1 0b72aa32a479676b160142a8ce51276ab1c93069
SHA512 44bc24b78471fcab8bf34fe45f87f4482add51c3dd0ddc0fa26cfc9143159055111798ecee42ecfd122daceab43e042528e46ef7be21b7896c32d2006c297d20
TLSH
T179D097C0549CAB5C4C140F07F0A029C238844C3724EC6810DA6100748AFFEC9429281A
MD5 SHA1 SHA512 TLSH

Submit Download

b399e0f7-f0d2-43e7-8dc9-be65510eed35

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\b399e0f7-f0d2-43e7-8dc9-be65510eed35
Size 16KB
SHA256 987d36e1019640c9e9edd08ef4a5dd9cb2c8180c33f6b742024f12f2fc84504c
MD5 a7f509cc79ec5c02aeb0ea8cf6abf70e
SHA1 ec0465efddb8b9380cddbd01c303a55966aa46c6
SHA512 070f0f107de0dfe099bce28a3d49b140d7f82eb4b92169889f89eca4d48ee740156c5323c332672733484ee03fe311d460d870d08e02b6ebb9c3c4ec583bcb61
SSDEEP 192:fK4RFR9MARemRmuzWVjGmRBae1VFAnPwNbrdxqUDfCCSMRygsNjm3Xloo:y4RDiARemRHCVXFFAn4tfj8hxo
TLSH
T13672B956682045BAC251E36894FCBFC3E6F538CF4C418FCA9BE4BE086DDA05E512794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c07081b9-e91e-4ffb-94c3-593fce0f944f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\c07081b9-e91e-4ffb-94c3-593fce0f944f
Size 3KB
SHA256 74021fe8e18587584b7c190a0ca15eecabbd09b5e563ab772593636803b79dae
MD5 33849a0021f5f89b6d4af895e89aefb6
SHA1 588a720f97366df25690b15e7ae7a7536ad0653d
SHA512 3a215f8d8246ba93de383928af9f4a66da54cfb5990d59ba1269c8b242b5156031013f60981afe58fe0bc5bf223337707e6dbd6565b28f7c987de21adbab6d08
TLSH
T1206146704558B9738EF8A404E376AD94CEEE33DB5C430BCE559E8D2842E8434678B35B
MD5 SHA1 SHA512 TLSH

Submit Download

ca77b300-987b-4ca8-832d-f9c210e03e37

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\ca77b300-987b-4ca8-832d-f9c210e03e37
Size 3KB
SHA256 4ae6fdda514162ab02f6b006e7c82d656b2acb03bb648fc6cbc6f6755701637b
MD5 d9a5fad8cfed5dfbcd3db435edfb6630
SHA1 0d29c4e35493e8639cd3bbea89f427cc4b0c0fb4
SHA512 95c7f81986eaffc44e5e6c20fe04c999b16ddfd02fe3e7e46e946f1e93f9eedb4b15bb9b69b8b0fa97ae576a75c45a005debe5820ad680011ddeface58f390b7
TLSH
T1536175714518A9739AECA404E376BEA48EDE338B58430BCD565E8D2843F84346B8B35B
MD5 SHA1 SHA512 TLSH

Submit Download

d511f9cc-f7ca-4684-be53-e8c5551d9386

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\d511f9cc-f7ca-4684-be53-e8c5551d9386
Size 886B
SHA256 43cac0bd65f74ab80eaadc8dabeb0f3949aa44f1c96e285fb2d2e05f69bb8866
MD5 d4622a73b2e0c9ebcd37cb267d58b4ef
SHA1 a5b0bd51b27cda48cfe71f3a79a98a4b041aabe9
SHA512 79041018afe2f1fbe4ba88d17bced5b3fffa5cf83bd4e82f8771bb57f80de8a60b5305af6cbe464c80a98f4300beb14d62e38e924878feffcb34c4dc29916961
TLSH
T1D61104408524B5F2DC78925FD891770186E4712384CA0D147F555F144DBB50EBB67B07
MD5 SHA1 SHA512 TLSH

Submit Download

d692d9eb-f096-484f-8847-ad640f7807a3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\d692d9eb-f096-484f-8847-ad640f7807a3
Size 2KB
SHA256 fd01415744bc9a07fb3d30fdb300592d6eaf979a89e917f1f9f399c9b32001cb
MD5 eced00a16fc738f92c8837744f79a5dc
SHA1 020b5bf4c088b97ec8cb644c28f86ce417c32d4a
SHA512 9c0e45ed8b920247dd9231c0e102e56fa8025c49359066433060b87ec12b3a55c20e417d5acdd838271a66ed0b6916c306d03628461fbb9669effdd21511520d
TLSH
T10841636C35B49C769CDAF61D9442329E87A1CB0344C62C432E46EF0CCD96699737F92B
MD5 SHA1 SHA512 TLSH

Submit Download

ef46eb1a-df16-406b-a87d-89e973fc734b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\ef46eb1a-df16-406b-a87d-89e973fc734b
Size 235B
SHA256 25e2e8bea06019403e287d6acff9ba69572c2b28ae4664721be02d92223ed3bc
MD5 3d406f05ecf545c8cb9aa4a3a9d7a92f
SHA1 b0bd8ab1894d5ee26f9cb3ef9dfff1980a43677b
SHA512 764d7a3487fbfc65494623f67836c65c7993b139968438b64bcad67a994391b0997dca3a613e874daee00caf3d4920b2a6851f54bed0a5ebc4ec987f77eae592
TLSH
T1ABD097C02488232E0C040F23F0E429C630888C3320E09820C55100B49EF9AC441A2A0A
MD5 SHA1 SHA512 TLSH

Submit Download

f2cd1750-2ea7-4b34-8ea2-013a482a5bb8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\f2cd1750-2ea7-4b34-8ea2-013a482a5bb8
Size 883B
SHA256 095b3cab7e917451b2f27e791d54604946220014d589f2b2da2f1409c48c14d4
MD5 33ab9d62dcaea332d1ea2c4fc76772cb
SHA1 8233754fc27854eac5857f8d1fb514e6d3e7b8c8
SHA512 97cd160070d233245a3f2c936215d915056d284ef87b59fddf5a30e063de34be9cc88afe2b9a723ca77273ffd5faf18bef71f30a387aa7fe7dd7bfee3b0df530
TLSH
T105112340A520F5F3CC78924FC95577028BE4712384C544243FA54E288D7EA2EF76AB0B
MD5 SHA1 SHA512 TLSH

Submit Download

f475ff78-b4fd-477f-aecb-628475fb9fb9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\f475ff78-b4fd-477f-aecb-628475fb9fb9
Size 235B
SHA256 2afa9c5b85d3269be714dc043ea23537970f77b53dcc942e0ee65044620dd455
MD5 aee0044cdc797a8cbb4f64abb8139a94
SHA1 abce929a7b590ed10f9f9a127eddb6e8672385ee
SHA512 2dc386dbc1bc3a05b4078cecf9b5e6638b824bbf07a6569200453d5455c303a5a3be615ae52a341152d1c99f62efface619691d97b7a97001062abc9abf0be4f
TLSH
T111D097C02488BB2E08040F0AF1E028CA31468C3322647814EAA011F48AF9EC4016680B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\prefs-1.js
Size 6KB
SHA256 0b149b4020f5682773def1a3b7a10f3c1f3195990317d8f9d469f7b7f98495a3
MD5 77adfb97d9e3c22ec1d2108e538a7f5d
SHA1 a4556a4c0635fa3b3c75439a8435d58fed943de9
SHA512 eb2927a96e59d085aa382bf25756dda2fd272f9ac10d9b0438a9b564bf6bbd680e510c430bcb7451856b6f7279bd114b711ce2b9104f7a284e212fd2ffc2f5e9
SSDEEP 96:xHNUTUVqGqznfkoC1zSwWGSSl5dv9j/SnGSRHyuCRBw88H8L4cnHNq:/4RzfkoCdWGSSdS9QBw883
TLSH
T146E11F7894088F7F74B6776CAC6888716AB2413B7BBF68D350B95485050CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\prefs-1.js
Size 6KB
SHA256 aad88f7ea8a4e7c199489a32e75c06ed71844c4d6eab0bd46e2caa30b63675ab
MD5 d47f2ad65371230fe2dbb3d542a80a19
SHA1 fdd51e782796af9799daa636c9aa4c66e80e820a
SHA512 16cf631a7b26d654aa19284e9b1b2c615ddc3b0cbf7fe3ffcebf25db38dabb4cc7fe4bafe5e58aae7df7d1e6693b6b673acaacdd1fe3d69cdddafce9dbdd233f
SSDEEP 96:xHNUTUVqGqznfkoC1zSwKnSSl5dv9jfnGSRHyuCRBw88H8L4cnHqVq:/4RzfkoCdKnSSeS9QBw88s
TLSH
T1FDE1307894088F7F74B6776CAC6888716AB2413B7BBF68C750BA5485050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\prefs.js
Size 6KB
SHA256 94f3c6b350d790063bf429e607a3b1d88e77ddce77909bb7b8873cf152138d08
MD5 4dc55581cd38a8412a5ffc8e83b8416f
SHA1 3538f88f6a34cf4f51e42f0bc1fdcda2042dc46c
SHA512 1053ae2cacc22f903a9fd846a9b451123697597e99d74c586a5b2881b0f5a3d5655c306f232b9fa779ee7ccf9a64fb4d48a439483630620a23763db58b24440b
SSDEEP 96:xHNUTUVqGqznfkWA1zStlSSl5dv9j/SnGSRHyuCRBw88H8L4cnHNq:/4RzfkWA0lSSdS9QBw883
TLSH
T1DCE11F7894088F7F74B677ACAC6888716AB2013B7BBF68C350B55485050CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

RegSvcs.exe

Path C:\Users\Admin\AppData\Roaming\RegSvcs.exe
Size 45KB
SHA256 808aec47f908410c01f820683f1c33198e05525d159863925690fdeb319eac1a
MD5 96c201253a2a277d7e6d40167548991a
SHA1 f3b0e69f65e9a27a5af1d96af75f1a6a23cf77aa
SHA512 8c2af8688802019fd0c18fcd279ac3821caa0923631610589a6c23663d5200038ad7e3cfe698339ee92cf621ef4ffedf11bc5082cb6ed860eb955dfc60fdacc4
SSDEEP 768:gBbSoy+SdIBf0k2ds9pO6Iq8YTcQqWVVQP/Q2:/oOIBf0dds9pdBcQxHQg2
TLSH
T19923D72897F84303F2B74BB099F5C483AC76B6536E74D79D388A534D0A527818A53B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1724-113-0x00000271C32F0000-0x00000271C32FE000-memory.dmp

Download

memory/2156-17-0x0000017CF30E0000-0x0000017CF30F0000-memory.dmp

Download

memory/2156-24-0x0000017CD97B0000-0x0000017CD97D2000-memory.dmp

Download

memory/2340-1802-0x000002C9592B0000-0x000002C9592BE000-memory.dmp

Download

memory/2680-3101-0x0000000006BC0000-0x0000000006BE2000-memory.dmp

Download

memory/2680-16-0x00000000063E0000-0x0000000006446000-memory.dmp

Download

memory/2680-393-0x0000000005700000-0x0000000005710000-memory.dmp

Download

memory/2680-34-0x0000000006550000-0x0000000006602000-memory.dmp

Download

memory/2680-13-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/2680-3102-0x0000000007400000-0x0000000007757000-memory.dmp

Download

memory/2680-15-0x0000000005700000-0x0000000005710000-memory.dmp

Download

memory/2680-41-0x00000000067D0000-0x0000000006992000-memory.dmp

Download

memory/2680-42-0x0000000006680000-0x00000000066F6000-memory.dmp

Download

memory/2680-43-0x0000000006700000-0x0000000006750000-memory.dmp

Download

memory/2680-44-0x0000000006ED0000-0x00000000073FC000-memory.dmp

Download

memory/2680-45-0x0000000006A40000-0x0000000006A5E000-memory.dmp

Download

memory/4936-6-0x0000000008530000-0x000000000854E000-memory.dmp

Download

memory/4936-2-0x0000000005520000-0x00000000055B2000-memory.dmp

Download

memory/4936-3-0x0000000005680000-0x0000000005690000-memory.dmp

Download

memory/4936-4-0x00000000054F0000-0x00000000054FA000-memory.dmp

Download

memory/4936-5-0x0000000005790000-0x000000000582C000-memory.dmp

Download

memory/4936-7-0x0000000005680000-0x0000000005690000-memory.dmp

Download

memory/4936-8-0x0000000008BF0000-0x0000000008D42000-memory.dmp

Download

memory/4936-0-0x00000000008C0000-0x0000000000A4A000-memory.dmp

Download

memory/4936-1-0x0000000005AD0000-0x0000000006076000-memory.dmp

Download

memory/5516-37-0x0000000000A70000-0x0000000000A7E000-memory.dmp

Download

memory/5516-38-0x0000000005340000-0x000000000537C000-memory.dmp

Download

memory/5516-39-0x0000000005300000-0x0000000005321000-memory.dmp

Download

memory/6868-2913-0x0000023AA1C40000-0x0000023AA1C4E000-memory.dmp

Download