phantom_stealer | 09c564be2f8f5bf7b36d789215e94124c85adb340ceae9cf818e2912ed6c8a31

Analysis

max time kernel
149s
max time network
101s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/06/2026, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PURCHASE ORDER DOCUMENT23062026.js
Size 4.4MB
Sample260622-srvawsdy5j
SHA256 09c564be2f8f5bf7b36d789215e94124c85adb340ceae9cf818e2912ed6c8a31
MD5 774ca41497a8c16052553bfcab2d0ceb
SHA1 0b0d6abe4b03e22f3cb30f5d8ec343a1519300ac
SHA512 a743f658f19b6f6dde1ca63ae633ff5f522d0f5ceca0b9e103deb45407510290a7dfa8cddec72b71af93d15352ece2ffb6f906ac7a70ebe1305eaa71fa3de10f
SSDEEP 49152:MzwcPf7rpPll05cNZUiETcqyMU87KFaVKUnel6IrzB:U
TLSH
T10226021189C42FB5CFAC5A1C90FE160EE3E14A8F5416798AEB33FD46AFE7504460B1B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution phantom_stealer persistence stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
mail.factorycolchon.es
Port
587
Username
[email protected]
Password
7@6Blk39d
Email to
[email protected]

Mutex

2EYDBQIH5YANMFSH885N

Attributes

anti_analysis
0
cb_enables_ssl
1
debug
0
keylogger
0
start_delay
0
startup
0

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 1 IoCs

resource	yara_rule
behavioral2/memory/2008-23-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2908	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	icanhazip.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2908 set thread context of 2008	2908	powershell.exe	93

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2368	msedge.exe
3744	chrome.exe

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	aspnet_compiler.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
6556	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2908	powershell.exe
2908	powershell.exe
2908	powershell.exe
2908	powershell.exe
2908	powershell.exe
2908	powershell.exe
2908	powershell.exe
2908	powershell.exe
2908	powershell.exe
2908	powershell.exe
2908	powershell.exe
2908	powershell.exe
2908	powershell.exe
2908	powershell.exe
2908	powershell.exe
2008	aspnet_compiler.exe
2008	aspnet_compiler.exe
5476	chrome.exe
5476	chrome.exe
2008	aspnet_compiler.exe
2008	aspnet_compiler.exe
2008	aspnet_compiler.exe
2008	aspnet_compiler.exe
2008	aspnet_compiler.exe
2008	aspnet_compiler.exe
2008	aspnet_compiler.exe
2008	aspnet_compiler.exe
2008	aspnet_compiler.exe
2860	firefox.exe
2860	firefox.exe
2860	firefox.exe
2860	firefox.exe
2908	powershell.exe
2908	powershell.exe
2860	firefox.exe
2860	firefox.exe
2860	firefox.exe
2860	firefox.exe
2860	firefox.exe
2860	firefox.exe
2860	firefox.exe
2860	firefox.exe
2860	firefox.exe
2860	firefox.exe
2860	firefox.exe
2860	firefox.exe
2860	firefox.exe
2860	firefox.exe
2860	firefox.exe
2860	firefox.exe
2860	firefox.exe
2860	firefox.exe
2860	firefox.exe
2860	firefox.exe
2908	powershell.exe
2008	aspnet_compiler.exe
2008	aspnet_compiler.exe
2008	aspnet_compiler.exe
2008	aspnet_compiler.exe
2008	aspnet_compiler.exe
2008	aspnet_compiler.exe
2008	aspnet_compiler.exe
2908	powershell.exe
2908	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2908	powershell.exe
Token: SeDebugPrivilege	2008	aspnet_compiler.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeShutdownPrivilege	5476	chrome.exe
Token: SeCreatePagefilePrivilege	5476	chrome.exe
Token: SeDebugPrivilege	6556	taskkill.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
5476	chrome.exe
5476	chrome.exe
2860	firefox.exe
2860	firefox.exe
2860	firefox.exe
2860	firefox.exe
2860	firefox.exe
2860	firefox.exe
2860	firefox.exe
2860	firefox.exe
1224	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2860	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2908	2552	wscript.exe	86
PID 2908 wrote to memory of 4228	2908	powershell.exe	88
PID 2908 wrote to memory of 4040	2908	powershell.exe	89
PID 2908 wrote to memory of 824	2908	powershell.exe	90
PID 2908 wrote to memory of 2808	2908	powershell.exe	91
PID 2908 wrote to memory of 2724	2908	powershell.exe	92
PID 2908 wrote to memory of 2008	2908	powershell.exe	93
PID 2908 wrote to memory of 2008	2908	powershell.exe	93
PID 2908 wrote to memory of 2008	2908	powershell.exe	93
PID 2908 wrote to memory of 2008	2908	powershell.exe	93
PID 2908 wrote to memory of 2008	2908	powershell.exe	93
PID 2008 wrote to memory of 5476	2008	aspnet_compiler.exe	95
PID 5476 wrote to memory of 2056	5476	chrome.exe	96
PID 2008 wrote to memory of 2056	2008	aspnet_compiler.exe	96
PID 5476 wrote to memory of 4016	5476	chrome.exe	97
PID 5476 wrote to memory of 3744	5476	chrome.exe	98
PID 5476 wrote to memory of 5488	5476	chrome.exe	99
PID 5476 wrote to memory of 2736	5476	chrome.exe	100
PID 5476 wrote to memory of 4856	5476	chrome.exe	101
PID 5476 wrote to memory of 2256	5476	chrome.exe	102
PID 5476 wrote to memory of 2220	5476	chrome.exe	103
PID 5476 wrote to memory of 2040	5476	chrome.exe	104
PID 2008 wrote to memory of 2056	2008	aspnet_compiler.exe	96
PID 2008 wrote to memory of 5476	2008	aspnet_compiler.exe	95
PID 5476 wrote to memory of 1376	5476	chrome.exe	105
PID 2008 wrote to memory of 5476	2008	aspnet_compiler.exe	95
PID 5476 wrote to memory of 1004	5476	chrome.exe	106
PID 2008 wrote to memory of 5488	2008	aspnet_compiler.exe	99
PID 2008 wrote to memory of 5488	2008	aspnet_compiler.exe	99
PID 2008 wrote to memory of 4856	2008	aspnet_compiler.exe	101
PID 2008 wrote to memory of 4856	2008	aspnet_compiler.exe	101
PID 2008 wrote to memory of 2256	2008	aspnet_compiler.exe	102
PID 2008 wrote to memory of 2256	2008	aspnet_compiler.exe	102
PID 5476 wrote to memory of 2864	5476	chrome.exe	107
PID 2008 wrote to memory of 2056	2008	aspnet_compiler.exe	96
PID 5476 wrote to memory of 6068	5476	chrome.exe	108
PID 2008 wrote to memory of 2056	2008	aspnet_compiler.exe	96
PID 2008 wrote to memory of 2040	2008	aspnet_compiler.exe	104
PID 2008 wrote to memory of 2040	2008	aspnet_compiler.exe	104
PID 2008 wrote to memory of 4016	2008	aspnet_compiler.exe	97
PID 2008 wrote to memory of 4016	2008	aspnet_compiler.exe	97
PID 2008 wrote to memory of 2220	2008	aspnet_compiler.exe	103
PID 2008 wrote to memory of 2220	2008	aspnet_compiler.exe	103
PID 2008 wrote to memory of 5476	2008	aspnet_compiler.exe	95
PID 2008 wrote to memory of 5476	2008	aspnet_compiler.exe	95
PID 2008 wrote to memory of 1376	2008	aspnet_compiler.exe	105
PID 2008 wrote to memory of 1376	2008	aspnet_compiler.exe	105
PID 2008 wrote to memory of 3744	2008	aspnet_compiler.exe	98
PID 2008 wrote to memory of 3744	2008	aspnet_compiler.exe	98
PID 2008 wrote to memory of 5488	2008	aspnet_compiler.exe	99
PID 2008 wrote to memory of 5488	2008	aspnet_compiler.exe	99
PID 2008 wrote to memory of 4856	2008	aspnet_compiler.exe	101
PID 2008 wrote to memory of 4856	2008	aspnet_compiler.exe	101
PID 2008 wrote to memory of 2256	2008	aspnet_compiler.exe	102
PID 2008 wrote to memory of 2256	2008	aspnet_compiler.exe	102
PID 2008 wrote to memory of 2056	2008	aspnet_compiler.exe	96
PID 2008 wrote to memory of 2056	2008	aspnet_compiler.exe	96
PID 2008 wrote to memory of 2040	2008	aspnet_compiler.exe	104
PID 2008 wrote to memory of 2040	2008	aspnet_compiler.exe	104
PID 2008 wrote to memory of 4016	2008	aspnet_compiler.exe	97
PID 2008 wrote to memory of 4016	2008	aspnet_compiler.exe	97
PID 2008 wrote to memory of 2220	2008	aspnet_compiler.exe	103
PID 2008 wrote to memory of 2220	2008	aspnet_compiler.exe	103
PID 2008 wrote to memory of 5476	2008	aspnet_compiler.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER DOCUMENT23062026.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File "C:\Temp\ps_N4DxHcESeT0m_1782141723916.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4228
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4040
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:824
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:2808
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:2724
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:2008
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ys1l22fp.rxd"
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5476
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ys1l22fp.rxd /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\ys1l22fp.rxd\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\ys1l22fp.rxd --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7fff7091c728,0x7fff7091c734,0x7fff7091c740
        5⤵
        
        PID:2056
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ys1l22fp.rxd" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1652,i,16921852791204650543,15975898897046563020,262144 --field-trial-handle=2040,i,10939321766790806740,18123841914381809418,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2
        5⤵
        
        PID:4016
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ys1l22fp.rxd" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1860,i,12804215635229021904,8235998907985331078,524288 --field-trial-handle=2040,i,10939321766790806740,18123841914381809418,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3744
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ys1l22fp.rxd" --force-high-res-timeticks=disabled --metrics-shmem-handle=2084,i,5371745527210042094,6743436082769505269,524288 --field-trial-handle=2040,i,10939321766790806740,18123841914381809418,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:13
        5⤵
        
        PID:5488
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ys1l22fp.rxd" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2956,i,13761343471071766367,18399559600451309124,2097152 --field-trial-handle=2040,i,10939321766790806740,18123841914381809418,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:1
        5⤵
        
        PID:2736
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ys1l22fp.rxd" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2960,i,9990798238336031474,9018482236632661243,2097152 --field-trial-handle=2040,i,10939321766790806740,18123841914381809418,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:1
        5⤵
        
        PID:4856
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ys1l22fp.rxd" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3172,i,11320811353487153885,3906133322700356323,2097152 --field-trial-handle=2040,i,10939321766790806740,18123841914381809418,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
        5⤵
        
        PID:2256
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ys1l22fp.rxd" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3188,i,9682791733058575882,6220605289205713288,2097152 --field-trial-handle=2040,i,10939321766790806740,18123841914381809418,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:9
        5⤵
        
        PID:2220
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ys1l22fp.rxd" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3764,i,13972950220496463350,18112115947243947195,2097152 --field-trial-handle=2040,i,10939321766790806740,18123841914381809418,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:9
        5⤵
        
        PID:2040
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ys1l22fp.rxd" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4256,i,8462409186675775297,16094624951165324859,2097152 --field-trial-handle=2040,i,10939321766790806740,18123841914381809418,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
        5⤵
        
        PID:1376
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ys1l22fp.rxd" --force-high-res-timeticks=disabled --metrics-shmem-handle=4616,i,13817052698295048490,13483995670563104743,524288 --field-trial-handle=2040,i,10939321766790806740,18123841914381809418,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:14
        5⤵
        
        PID:1004
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ys1l22fp.rxd" --force-high-res-timeticks=disabled --metrics-shmem-handle=4664,i,5807404852588676763,17753099833743639909,524288 --field-trial-handle=2040,i,10939321766790806740,18123841914381809418,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:14
        5⤵
        
        PID:2864
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ys1l22fp.rxd" --force-high-res-timeticks=disabled --metrics-shmem-handle=4680,i,17810457638306228560,3546484239153737855,524288 --field-trial-handle=2040,i,10939321766790806740,18123841914381809418,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:14
        5⤵
        
        PID:6068
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nzon4ftw.0sj"
      4⤵
      PID:3820
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\nzon4ftw.0sj
        5⤵
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:2860
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1944 -prefsLen 27097 -prefMapHandle 1948 -prefMapSize 270279 -ipcHandle 2032 -initialChannelId {ab7f15ae-d62a-47b4-9429-ddabf9f4ae57} -parentPid 2860 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2860" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        6⤵
        
        PID:2600
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2208 -prefsLen 27133 -prefMapHandle 2196 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {988b3b8c-87e9-4a1a-9e96-b77af1250850} -parentPid 2860 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2860" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        6⤵
        
        PID:4672
      - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3cc2139e-7d62-4094-b6b0-32dd5ac38826.dmp"
        6⤵
        
        PID:3316
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2628 -prefsLen 27133 -prefMapHandle 2164 -prefMapSize 270279 -ipcHandle 2604 -initialChannelId {f7a6c326-5ad7-4720-bc8e-4f30593b0320} -parentPid 2860 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2860" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        6⤵
        
        PID:4956
      - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e651fe60-cd9b-4aa2-a539-5664d3c70796.dmp"
        6⤵
        
        PID:5384
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2884 -prefsLen 27133 -prefMapHandle 2920 -prefMapSize 270279 -ipcHandle 2632 -initialChannelId {42233030-2962-4883-93b2-0cd18ab12785} -parentPid 2860 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2860" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        6⤵
        
        PID:5092
      - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b1fecae7-926d-4553-a399-920ea19b0671.dmp"
        6⤵
        
        PID:3312
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3292 -prefsLen 27198 -prefMapHandle 2912 -prefMapSize 270279 -ipcHandle 3324 -initialChannelId {34ee0105-5828-4ccb-92be-fee4be360c05} -parentPid 2860 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2860" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        6⤵
        
        PID:480
      - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\593ba339-bc69-4f66-bd77-6fd7b485ea4f.dmp"
        6⤵
        
        PID:1992
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3324 -prefsLen 27247 -prefMapHandle 3868 -prefMapSize 270279 -ipcHandle 2960 -initialChannelId {dcce2245-7e25-410f-bc4c-eab5e12a09c4} -parentPid 2860 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2860" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        6⤵
        
        PID:6024
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2960 -prefsLen 27323 -prefMapHandle 3868 -prefMapSize 270279 -jsInitHandle 3324 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3968 -initialChannelId {6733e2fc-e9b9-46ea-a787-3e1eb3fc7e34} -parentPid 2860 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2860" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        6⤵
        Checks processor information in registry
        
        PID:2296
      - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\7f82c547-77ef-4946-bb11-d6b3b0b28de4.dmp"
        6⤵
        
        PID:5944
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3000 -prefsLen 27323 -prefMapHandle 3056 -prefMapSize 270279 -ipcHandle 3172 -initialChannelId {820f7f29-5a79-41a9-9827-fd853e7ef9e5} -parentPid 2860 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2860" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 gpu
        6⤵
        
        PID:5628
      - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\4bc45e82-0661-4a06-be93-36eef83e83ab.dmp"
        6⤵
        
        PID:1984
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4400 -prefsLen 27323 -prefMapHandle 4404 -prefMapSize 270279 -ipcHandle 4424 -initialChannelId {14d7c923-09eb-43e4-9862-942b5c933cad} -parentPid 2860 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2860" -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 rdd
        6⤵
        
        PID:3324
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4624 -prefsLen 34822 -prefMapHandle 4628 -prefMapSize 270279 -jsInitHandle 4632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4640 -initialChannelId {a7216b9a-e2b7-42da-80ae-6b6d0b6e2791} -parentPid 2860 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2860" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        6⤵
        Checks processor information in registry
        
        PID:2688
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5100 -prefsLen 35010 -prefMapHandle 5112 -prefMapSize 270279 -ipcHandle 5124 -initialChannelId {4cb43474-5333-4127-a1bb-36e72464ef88} -parentPid 2860 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2860" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
        6⤵
        Checks processor information in registry
        
        PID:236
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5100 -prefsLen 32952 -prefMapHandle 5156 -prefMapSize 270279 -jsInitHandle 5144 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5308 -initialChannelId {d514cc4f-49c7-4d41-882c-33fb289a63cb} -parentPid 2860 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2860" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        6⤵
        
        PID:2628
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5324 -prefsLen 32952 -prefMapHandle 5328 -prefMapSize 270279 -jsInitHandle 5332 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5340 -initialChannelId {44347c40-e1b6-4648-a52a-738c47c33e9e} -parentPid 2860 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2860" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        6⤵
        
        PID:1468
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5352 -prefsLen 32952 -prefMapHandle 5356 -prefMapSize 270279 -jsInitHandle 5360 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5368 -initialChannelId {9267c981-5ae9-4101-97c0-c84a899f5c49} -parentPid 2860 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2860" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
        6⤵
        
        PID:6012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts"
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious use of FindShellTrayWindow
      PID:1224
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x224,0x2c8,0x7fff6d97c188,0x7fff6d97c194,0x7fff6d97c1a0
        5⤵
        
        PID:1324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1932,i,10319340380173562552,10148364501790421801,262144 --field-trial-handle=2512,i,17422538511126148099,13480776413895741761,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:2
        5⤵
        
        PID:5696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2068,i,17851910109373038737,15842392944175501739,524288 --field-trial-handle=2512,i,17422538511126148099,13480776413895741761,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2684,i,8224150725680778369,2542096967570484984,524288 --field-trial-handle=2512,i,17422538511126148099,13480776413895741761,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:13
        5⤵
        
        PID:5624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,13609198198109610893,13608933964326161256,2097152 --field-trial-handle=2512,i,17422538511126148099,13480776413895741761,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:1
        5⤵
        
        PID:2972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,17912558257171630259,14924983535447538273,2097152 --field-trial-handle=2512,i,17422538511126148099,13480776413895741761,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
        5⤵
        
        PID:3264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3928,i,1230172000923100049,12812467060040915285,524288 --field-trial-handle=2512,i,17422538511126148099,13480776413895741761,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:14
        5⤵
        
        PID:3676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3936,i,16763924738547193891,7078168001074546776,524288 --field-trial-handle=2512,i,17422538511126148099,13480776413895741761,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:14
        5⤵
        
        PID:3552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3940,i,6105499252354038412,639055594146560022,524288 --field-trial-handle=2512,i,17422538511126148099,13480776413895741761,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:14
        5⤵
        
        PID:2976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3968,i,10664139617066730897,17686316032495258767,2097152 --field-trial-handle=2512,i,17422538511126148099,13480776413895741761,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:1
        5⤵
        
        PID:4072
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4004,i,3168417401236892314,6232022875070341621,2097152 --field-trial-handle=2512,i,17422538511126148099,13480776413895741761,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:9
        5⤵
        
        PID:1268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4016,i,9045894752248212678,12574935818035944680,2097152 --field-trial-handle=2512,i,17422538511126148099,13480776413895741761,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:1
        5⤵
        
        PID:1284
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4068,i,4992098728733405751,15915846290923470081,2097152 --field-trial-handle=2512,i,17422538511126148099,13480776413895741761,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:9
        5⤵
        
        PID:468
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4088,i,686744538448070252,16749972649137980756,2097152 --field-trial-handle=2512,i,17422538511126148099,13480776413895741761,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
        5⤵
        
        PID:4620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4100,i,10668196551849344811,6583291207718062778,2097152 --field-trial-handle=2512,i,17422538511126148099,13480776413895741761,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:9
        5⤵
        
        PID:5328
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4164,i,3897127166729546998,15299093152769366893,2097152 --field-trial-handle=2512,i,17422538511126148099,13480776413895741761,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:1
        5⤵
        
        PID:2568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4156,i,2830344219820917319,12650083263741638657,2097152 --field-trial-handle=2512,i,17422538511126148099,13480776413895741761,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:9
        5⤵
        
        PID:3164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4208,i,9140512912009146594,13014278150988873178,2097152 --field-trial-handle=2512,i,17422538511126148099,13480776413895741761,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:1
        5⤵
        
        PID:5068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4244,i,18057365028902567258,5777636071311174990,2097152 --field-trial-handle=2512,i,17422538511126148099,13480776413895741761,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:9
        5⤵
        
        PID:4632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,6330047828896445035,2843002639282026595,524288 --field-trial-handle=2512,i,17422538511126148099,13480776413895741761,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
        5⤵
        
        PID:3128
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1120
        6⤵
        
        PID:828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,4582139280312741280,16149213046614823290,524288 --field-trial-handle=2512,i,17422538511126148099,13480776413895741761,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:14
        5⤵
        
        PID:2868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,43433374378776771,1100123509616205019,524288 --field-trial-handle=2512,i,17422538511126148099,13480776413895741761,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
        5⤵
        
        PID:3056
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=624
        6⤵
        
        PID:3644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4128,i,5728131522963074573,13679857681705555471,524288 --field-trial-handle=2512,i,17422538511126148099,13480776413895741761,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
        5⤵
        
        PID:3092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,5333402424970676035,3568370057146307387,524288 --field-trial-handle=2512,i,17422538511126148099,13480776413895741761,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
        5⤵
        
        PID:1680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,6957706786922039217,11060554132568367071,524288 --field-trial-handle=2512,i,17422538511126148099,13480776413895741761,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
        5⤵
        
        PID:1952
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im wscript.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ps_N4DxHcESeT0m_1782141723916.ps1

Path C:\Temp\ps_N4DxHcESeT0m_1782141723916.ps1
Size 3.3MB
SHA256 ca1bd89828d704d644cab4ad2ccb2a95de4393e395b2ddf5a356f33f8db0960a
MD5 7bef275f7b7231c2494f8cc08e48b352
SHA1 db2514da3bd9182ee0084eed3a2c6bfd1a1d74af
SHA512 104f70c9535bb2f8f97b38081e92c7bbf709ddc8bf73194ee14a297b053ee017bb1ac7a4582bd356f75cf2b2b24f15bf800cc0440dfe45f380c09e59d79ffeb3
SSDEEP 49152:dnPE7WrAIyOoCSyrIyTv4UkofiMdta4ZIrvnrBzGpZ:J
TLSH
T1F9F533708EB63DEA8598156F70AF2F4C4AE25FB6505EF9DF07AC18C709677024623C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts\Crashpad\settings.dat
Size 280B
SHA256 35b30e3af242deba18a0ca21efccb2f49a4521db23b97921e444a95afff47168
MD5 f43ad8a515dd202c7598fad8c6531409
SHA1 96ae41cdd0be327dd270f3d19bcce07704982201
SHA512 5bb940acc53691e79607d51ae423fae307d5278dd62496661f1afdad05df19db1b88947df50ee83a2a297931d496bc65de6330d6ab84cbde4b2024af2a2dbcfd
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts\Crashpad\settings.dat
Size 280B
SHA256 cbfd3f3ac8f78b0889108e8d2664245039c38bc3f42c9072d49bff8abe0d8434
MD5 945ea2e41ee2dea888419a86158b009f
SHA1 a72d8ad55bae0dee13881b721fcbe88cf1f83742
SHA512 d35e5ccd3f7a8fe27c09792f7bf4fa47aecb64f34f9a7f7b9882052c09001887b2af5e56c732000fc5b24ed311bd68fa965c5d81bbc0ff34def603d2358b17bd
TLSH
T167D02200F388288BE020383B8A0C02003B0A822320003E000838200CEEE0008A0C020A
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 3c41ca2aec1ace72836cbb849ec6c762eb8e5acf9a790a386739fe4ea3e4b7dc
MD5 8f66579b77701827e94fbd8f895d1e28
SHA1 6136c76ddfec80c006c1c05fb214d2b75e2feac4
SHA512 b2bbe811b5297e03c7091b7765dddfeea2d8aad5220b9701f731fa087f5dbf94a34ac575ee18924a741b6ae245ceb985c14e9a34ce552b263f489fd3d1307e77
TLSH
T1EFD02BFB1CA70830DD7F93E25471949004167C984A45DC8E295D73C314712927817C61
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 3bb030e2541291a7645b9ac031c039cc6461e355172524a6953783454aafc370
MD5 9d67363bb82e43623878d82ae5c22a8a
SHA1 9fa7801906e4ae0bed970b4f01608225c19791a6
SHA512 41e92c623d188ee7b1215c5584cb6b63f1a97b80182940c2cd27e94f65ad4219f546065ee2572e699ab9a446790ca9e5e329c9e200e76991b382076aa74d968d
TLSH
T1C7E020B73DF72C20ED6FD3E618716460055A7D588544DC4F295FB7C31472265681BC21
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a5063.TMP

Path C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe5a5063.TMP
Size 153B
SHA256 625b93f3d5cc4256010499152c0778b2f30fc0fcb3b4bfc61c114f52b6634bfa
MD5 27d770629aad082ffcd4df6e61daca2b
SHA1 0351ddfe0197bc373d1ce447a9beaee84b9cf5ce
SHA512 ede7a8843c4088c94a01e4da52c703e7aadc2aaea9c5d00e2f579bcb61567ed2745a3a8a6f83edfba060a0bd9149a48f5b4144816e4adc531b8d809f82c917dc
TLSH
T18AC09BFB1DDA1850DF5A53D6817154E5452B7CD85B48EC8F7E5DB2C330701A27527C21
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts\Local State
Size 3KB
SHA256 a7c6687e4ace0043b12b127c13f0dc14759f057e74a4ccd90d948f73c181f651
MD5 709c2bf25d17a5600a606f75481de791
SHA1 2f71fac3cf9c7fda8075b56b8c0a126fb733a490
SHA512 60e74ae351a4721a1598eb9db82d131051d52a82a57ab656270247ad7779415e5b90f6e7f00869e92a2702e0d82307f251e2d4a9514f1784b369b1dfe3b8fa5d
TLSH
T14181B8B16428EC3359E79949748A27934E7871B3ED41AF98E5DC532800EB64C3B09C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts\Local State
Size 4KB
SHA256 b36b1891c718b9fe803197f9bd92fc163a8168dbefd977c508fb88a53c74f228
MD5 57461c165f8eff3c78ba4f340cd45bf3
SHA1 ffcafefe4e9d5ffb0da2a6c5ff46627274236000
SHA512 57512d1aa28374d820977f5c368f53878c033f123641d41e48cecbb479d9cc0b2cf3e80fa67e60ee085de0afda858d618de7084b83685885955f2545c31fd13e
SSDEEP 96:PqGNkzQsFfja15BB58Frh/cInURoDotovxRD5BE4vLgcc0eUnHrTq4a:SGNz6abyooDUwnfsccqHA
TLSH
T1AFA1B6B26538EC274DE7A945B4CA27936FA43173E885BF9DD6DC162C00EB7882709C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a4102.TMP

Path C:\Users\Admin\AppData\Local\Temp\4oez3oc5.3ts\Local State~RFe5a4102.TMP
Size 1KB
SHA256 a02380255d7f0192baf492adb9847fbd8f3293e2a30d4277eb4083ad085c824d
MD5 84271f070390b3f9ac5385ad5d5c5036
SHA1 562a3ebc5cd2c81bf881e8167a5142d4162e526b
SHA512 99d6dd349a34bd318c1ccec7472193086f1f86ad945c7674b1ab0bc296dc4f3e19fd5d3f712955ef8e598ab539e722b6ec51132270d75865bc0b35d27a5b1f1c
TLSH
T18B3173B1556C2C33A8A2864A728E6B931F347231E1512F8C89EC152981E7ACD6715C37
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\ys1l22fp.rxd\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\ys1l22fp.rxd\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\ys1l22fp.rxd\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\ys1l22fp.rxd\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\ys1l22fp.rxd\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\ys1l22fp.rxd\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\ys1l22fp.rxd\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 b630bdf6c5d2f4314ba88fea8533ec839a24ec240377ca3ddd0340975175fd46
MD5 893a59977f60405a0d795d043fa7bb96
SHA1 f394328e4ef9bf441edaa481cf43f81a123e749e
SHA512 aac5ff220936b403f9e4d98d9abeca659cb3a97de1813db908d00b113f10f128afbd79ee4ad6309e81fc14b058a5dbb02d21d67f69d0814f4e59e4308030ccdd
SSDEEP 48:j4i1VfdOGxtia444J9zCNY3dLXuHCBpY4i8VfdOGxtia444J9zvY8gdLXuHv2E:0i5KJoIuiBBieKJvDIuV
TLSH
T13291FE115BE20A46F3FBAE7194727710BB7BBC494A188E1D01CA52490C32B14C6ADFA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3cc2139e-7d62-4094-b6b0-32dd5ac38826.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3cc2139e-7d62-4094-b6b0-32dd5ac38826.dmp
Size 76KB
SHA256 7199f5e41f894db361968fd86fc2d9f67dd0eda2414aa61b558dde5855cc2362
MD5 4a280c6f8961ef2dc118b453e63c1c8f
SHA1 39a192d3f85fb006244c29eddff1de41ba997920
SHA512 bb9e34e0cf66345c9c641ce4080b7cd9debdd1ed7ce3eda9999e2f370752fa4de2fef4438b214063116c28cd98cf9b92dd0c89ff7349a87af01895cb279ff803
SSDEEP 768:+w8TMSzp9Zr17kmrAexf42bJbzmqsaYI9k1S:tUMc9Zrlkmr/t42bJbzmqsaYIeS
TLSH
T17873DE26F3800AA6D97A537159D7E735B7F6F4240B63437BA28441BE1C57348AE32E23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3cc2139e-7d62-4094-b6b0-32dd5ac38826.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3cc2139e-7d62-4094-b6b0-32dd5ac38826.extra
Size 1KB
SHA256 0e4e9c0ce2f85dfe170d6a25ac656a776e33c852a3abec3614cf243378a29f8c
MD5 fe436d6fd5b264aa1ef622d9724122ff
SHA1 b65158c87e552fba8efabb682cd7c427b02725b2
SHA512 5f616f63301f17515862ac6a04f1733f429ba2e3daada4d5ff00dd320d77bca77dbc7015962b22ce446ca4602cbade6437b151ad05a2cd88e0ae47c9583c37b1
TLSH
T11E3174B7C2EC6E568D478998727F13038999B32705D31D0C35CD4B0C858E0DDA3669C3
MD5 SHA1 SHA512 TLSH

Submit Download

3cc2139e-7d62-4094-b6b0-32dd5ac38826.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3cc2139e-7d62-4094-b6b0-32dd5ac38826.extra
Size 3KB
SHA256 f89ffb02bda5e839e68c7e9657e369758fe6a77763a951edd157eaee2955d116
MD5 f079364f71fd4535ac414fc5ddb44afa
SHA1 3745ff03733cfa87ce22395dd1d3bb0a8daaff3b
SHA512 2f2b2e2b440b406ac9f280ef2d15ddf220e4bd6f430e719db762e05c9c9a4751169a96f020a74b94d1f395ed42158d3b0cbbf9b583722430d7791da8a1a3b226
TLSH
T16D813162409CE9375EEF5CCAB3776D1DD99EB31994722A8C90CEC35C41B88B0638B183
MD5 SHA1 SHA512 TLSH

Submit Download

4bc45e82-0661-4a06-be93-36eef83e83ab.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\4bc45e82-0661-4a06-be93-36eef83e83ab.dmp
Size 77KB
SHA256 01c2965eeed0c23561c7a559920504ed2e9c988a8e264ce043eb3aabcae5bd88
MD5 331fe72d1f5f2459faf93242464337c0
SHA1 7d4932d9fbe37d971f74d7d7e1f5fc58f6e4d752
SHA512 028291b3245b4230ca105f66c7d9d0ba1d425b14db8abcdb4cb090ee7c601791404a89a1aeb15212c7e98e76589d5d3901fec78dde4cdc407f198079c9cbeee9
SSDEEP 1536:fAgi1AJAXIccnrU3jJ1+uJ42bJbzmqsaYIeS:Ni1A1nr4j+AeS
TLSH
T1C673C822F7C109A6D526427568D7E771BBF6F42407A3C38BA72011BA2C57BC89C70E23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4bc45e82-0661-4a06-be93-36eef83e83ab.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\4bc45e82-0661-4a06-be93-36eef83e83ab.extra
Size 10KB
SHA256 9ab78bf31352883c6f9c46761bbcd54bf8de2120812d8d52ad84addd99ac62c9
MD5 feb92d6315ada95e4284c7fe4b9db98e
SHA1 ccdd4dc48c496a18f1f84cbb759b16c73c2ad1c2
SHA512 220967a2d6df81898953e33bdf4860ac674d9eaa4c969c40f777fc3d0253f28e391024dbd0017ec73983e76d19bdf095580343895ecb0652d4bf394c8f07f88a
SSDEEP 96:SEWCu2ThQY6pw6mJFFd8H0Rh7CsevBb1d0LjMLlIrLlhTLlaXv7agOKtILfcBCqN:Saue9LFSG7uvZ8nLTxsPywlhG3fo1
TLSH
T185227253878724B7AD4198D4BC30AE7C45EC6EAA61F958A802CC4D47FA464F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4bc45e82-0661-4a06-be93-36eef83e83ab.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\4bc45e82-0661-4a06-be93-36eef83e83ab.extra
Size 10KB
SHA256 2ba010bcf8f10dbebba617205cbb7a0b11c634f8bc367369124b44196d800a59
MD5 0ffed35e91dec36826abcf6828453ebb
SHA1 36d24a6f3584050a17111f9e3e88448a3a76c78e
SHA512 ba340f23083f2c8582fee74d0aa5a0227a027d56e17b38c0c0d545a2c460d51b194dddf7b6e0472914120b748c3bf6e4cb60998d04ea434d9e128c000f812e22
SSDEEP 192:SaufcFgwiR4pDDnTYapdVxzPJWBHh4T/fKNUalZG3foZbL4E/:hscFgwiGDz1xWBHh4Txay3AZ4w
TLSH
T1FC32F931481CE837E7D7ACCDFA3A2E36D66D7B1A10E6786C40CCCA89C1A94786779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

593ba339-bc69-4f66-bd77-6fd7b485ea4f.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\593ba339-bc69-4f66-bd77-6fd7b485ea4f.dmp
Size 77KB
SHA256 71130f3b7d058ae5e1ce6b060a1984868bbca74be71b98c881c19f68f4c5b244
MD5 9fa0b8cc7c0881fea91ecddf91d5885c
SHA1 f651e5c019f62c7e00ed19555fd9ff77d1c4069d
SHA512 b7a482d53e308bda0a0bcc7e0c273aa63df8159660133ea94e8851494afacfd25a88aa8479551bb1e02186b2ab0707bc1b854ade4f9f14aeccc2f7a69edc1c09
SSDEEP 1536:eCynO/UMR3rKLMPhnYBmx42bJbzmqsaYIeS:qO/FR7KLMPhnYBmLeS
TLSH
T17173BA2EB3800A66D562477568E7EB32F7F6F42487A3B78BE25401AE1C57344AD31E13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

593ba339-bc69-4f66-bd77-6fd7b485ea4f.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\593ba339-bc69-4f66-bd77-6fd7b485ea4f.extra
Size 10KB
SHA256 b40dc7a3930c00801d6f599d0962f0dd649452ab7f87ba85432c755a72ee1783
MD5 fd5cd05c3a50b38243b81b95fa85f055
SHA1 fe742bfcbb2c6ade271b107b62d472c407e6625d
SHA512 5f63233b76e6675e085550eecba8c2fe3c8c772c2f9b74a59e29493c4cbac4ed7eb156a60ba4fe1726293b46b3142e93946cf4b07cbd4189edeebce567e0f535
SSDEEP 96:SEWC/nThQY6pw6mJFFd8H0Rh7CsevBb1d0LjMLlIrLlhTLlaXv7aJOKtILfcBCq7:Sa/T9LFSG7uvZ8nLGxsPywlROfoT
TLSH
T12F227253879724B79D4198C4BC30AE7C45EC6FAA61F958A802CC4D47FA464F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

593ba339-bc69-4f66-bd77-6fd7b485ea4f.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\593ba339-bc69-4f66-bd77-6fd7b485ea4f.extra
Size 10KB
SHA256 2fd8815144a8289c85548e4d2a7bc19149b5839b48973279c97b88f78c23a0fe
MD5 2913f096814ebf205b164d8b7a97fe75
SHA1 0560d7cac17d501bc917ca410b61219d7a2e43d6
SHA512 34acd088292e7ce8f59a265d98476376fad810ff441e5625473d2bf85219a23c5ada64d54408226e4528431d9af96567a123a9b671ad3c9f787cb1121593538f
SSDEEP 192:Sa/kcFgwiR4pDDnTYapdVxzPJWBH64T/fKNUalZOfo/bLFE/:h/kcFgwiGDz1xWBH64TxauA/Fw
TLSH
T19D220921481CEC37E7D7AC8EFA393E3AD66D7B1A10E6786C40CCCA89C1A54786779413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f82c547-77ef-4946-bb11-d6b3b0b28de4.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\7f82c547-77ef-4946-bb11-d6b3b0b28de4.dmp
Size 76KB
SHA256 c5fd14586a12adcabe68f30fe849e52ebbe1b823b598b384d619502be7b756c8
MD5 c73bcfd5dd08a0bc38a765a31298b92d
SHA1 8a553680a70e175e2625897a2a4544029e113e9c
SHA512 df15165a8d2f9073b713424d04b90ed780efc573b79a0b19b219b710ff07c91781e7e2dadd3cc5170b94a12eb8dd96c51c5d73339e3d5bed00b3cd5ca8d48b4b
SSDEEP 768:KwxST3a+7M+2AXwdJQzpn9ef42bJbzmqsaYI9k1S:pET3Q+2AXwXQNq42bJbzmqsaYIeS
TLSH
T16373DAB2F3800562F56E077158D7E731BBF6F8244753838BA64409BE2D57388ACB5A63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f82c547-77ef-4946-bb11-d6b3b0b28de4.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\7f82c547-77ef-4946-bb11-d6b3b0b28de4.extra
Size 10KB
SHA256 1646c54ec3712d4e89f6bb2fa5ff7c6990c60114e81c65f49cd1c5828be9fb46
MD5 41dfe4125d776e2eb6ef7d82cb85d77b
SHA1 a48779ed7ce6368945b138e0043795beb51e4603
SHA512 b25c73d0dbc3b1cb1471c9528837ab5e8d8a635b0db8a428a7db23bda97fbc102f8fea9b0c73ad51d3ea6e5bd3b60b453d47d6202e71137b7d819f741975d6a8
SSDEEP 96:SEWCNThQY6pw6mJFFd8H0Rh7CsevBb1d0LjMLlIrLlhTLlaXv7aLpOKtILfcBCqp:SaV9LFSG7uvZ8nLLmxsPywlS5foL
TLSH
T176227253879724B79D4198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f82c547-77ef-4946-bb11-d6b3b0b28de4.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\7f82c547-77ef-4946-bb11-d6b3b0b28de4.extra
Size 10KB
SHA256 498e560a7fcc11495578c1edebfb85f290eccbf70ed39bf8495b3ab9680c2bee
MD5 2a3ab8daf53cde43a0195b287b954c80
SHA1 d76c0e6b3682d7a21bbff92b5aa88c8bc697c317
SHA512 7bd9aafff3d792ca658de435dbd0bcd815fa04f7a8dcf36a8a4fbe76ef55602827b5cea49272cf680a6c09a4dd428d3c2818c4a17743399dce5a476435ccb2b3
SSDEEP 192:SaacFgwiR4pDDnTYapdVxzPJWBHgx4T/fKNUalK5fonbLVE/:hacFgwiGDz1xWBH+4TxaIAnVw
TLSH
T1D4220921481CD837E7D7ACCEFA392E3AD66D7B1A10E6786C40CCCA89C1A54786779453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1fecae7-926d-4553-a399-920ea19b0671.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b1fecae7-926d-4553-a399-920ea19b0671.dmp
Size 70KB
SHA256 bc27b0de020914b7615113ce2e679162cece076d60846a395f9f2ed81b87dc50
MD5 8db15ccc52332f6d51874ff5c34448f9
SHA1 dd463d2b288cb9babf54fcd6d1b54426b9722282
SHA512 31fd662ab5fcbaeb6b8474bdf2273ca6c3f3151326bcd74c71a0f2115ce760152d1a15e32017c80c3e102b0a169c7ea5b58f41637b0cca4b37473347593fa6c9
SSDEEP 768:Z3wHpB43bvbCgjAlSsWN5Mhf42bJbzmqsaYI9k1S:+f43bvGOA0s05M942bJbzmqsaYIeS
TLSH
T11263CB22B7B10663D56A0BB059F7E731B7F6F8651753439BB24481AE9C63348AC30E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1fecae7-926d-4553-a399-920ea19b0671.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b1fecae7-926d-4553-a399-920ea19b0671.extra
Size 10KB
SHA256 2f9be89a65ff60d9ff7f8f304bd8f5c9b7a0f82396b9afcedcbffa3640899230
MD5 93b3bf69c3a672ab2b16c669a7e17bbe
SHA1 bf36300a9ae1baa1b37b756b2bf7fcf57609527a
SHA512 40540e33698161fe5f2c5ae0cdc5948abcf9b74392cc12133b54862fcc75d015022df5487b356c5e3f10f723b6a6ff59f1906ec0745cbe320afd3b41885a0bb0
SSDEEP 96:SEWC9ThQY6pw6mJFFd8H0Rh7CsevBb1d0LjMLlIrLlhTLlaXv7a5OKtILfcBCqw4:Sal9LFSG7uvZ8nL2xsPywl4ifoo
TLSH
T180227353879724B79D4194C4BC30AE7C45EC6FAA61F958A802CC4D47FA464F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1fecae7-926d-4553-a399-920ea19b0671.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b1fecae7-926d-4553-a399-920ea19b0671.extra
Size 10KB
SHA256 af97c0906975330212a7911c8913d1d3be344b1812d732508c76c810ab4792f2
MD5 697f1d724c7b631f9c6549d9f210e64c
SHA1 0175b7dee500502da687bf0a47333ea9f0d821a3
SHA512 4bfbd0e2cd174ea128c3fbbad2ab20e60677308a64b3f95f78b342b7653e834fb1e720467447074cd6fbe46767011599c7cad0c1b43a06fd7602efaaf9429545
SSDEEP 192:SaqcFgwiR4pDDnTYapdVxzPJWBHm4T/fKNUalAifoYbLK7E/:hqcFgwiGDz1xWBHm4TxaBAYGw
TLSH
T1A4220921481CD837E7D7AC8DFB3A2E3AD76D7B1A10E6786C40CCCA89C1A54786779853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e651fe60-cd9b-4aa2-a539-5664d3c70796.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e651fe60-cd9b-4aa2-a539-5664d3c70796.dmp
Size 70KB
SHA256 d3d80bf63f0e0a311a6263ae1120cbe908c296f354cf62114d3317386635deb5
MD5 0cd1d7f92e5ae36d51b9637b7aaf3fd4
SHA1 a9419545af21dd8038f7d1911f84f6561add27b1
SHA512 2a16f1c104fe89a1d1f156514ad12edbff3731a3705b8add3c02a30503856aa4358ef7f05734c8d12889e0ca3dee926886a172e00c2eb4bed5d691f6a05f8ebf
SSDEEP 768:V3wHsAmYgJ6zH10m+RdDG7f42bJbzmqsaYI9k1S:CBmYHVr+fDGj42bJbzmqsaYIeS
TLSH
T1A163DA22F7F40566D56A077298D7E731BBF6F8211B53439BA24815BE1C53368AE30E23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e651fe60-cd9b-4aa2-a539-5664d3c70796.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e651fe60-cd9b-4aa2-a539-5664d3c70796.extra
Size 10KB
SHA256 69b174f4f714c587b4c77bc5af59080d49b508a9fbd5711daadc021cd001d491
MD5 6996bb56bd96136e0a9eabc3563446ec
SHA1 27bf08e47424c49ba7e293ab75fdbdc30303d199
SHA512 52058ac870d4c6b635a828cb84c82f4b4743fdd1713d54964dbca2a0a0f14c89a0b3fb39879943f129c51bb794a15b3365b96a647512339365e2d776975c2c65
SSDEEP 96:SEWC5ThQY6pw6mJFFd8H0Rh7CTvBb1d0LjMLlIrLlhTLlaXv7aZOKtILfcBCqwvg:SaJ9LFSG7WvZ8nLWxsPywlnzZfoO
TLSH
T1C7227353878724B79D4198D4BC30AE7C45EC6FAA61F958A802CC4D47FA464F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e651fe60-cd9b-4aa2-a539-5664d3c70796.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e651fe60-cd9b-4aa2-a539-5664d3c70796.extra
Size 10KB
SHA256 bacbacbdac1c5b4adb71d9de13842181ab52fe12b3457d5fafe30bd8172423e3
MD5 614a7e95bf2625575966918c6e6e82f0
SHA1 e56589531c99ca494a52d7d71fd5c0ee12c737df
SHA512 8b07ff4a23114b0c7f7dbb2f048bf4d857430f07ce8b26830414c1ffc0d6b4067e46800193d75ac49d9adc4da213ee43f81575b033c144730abadd98fec314fa
SSDEEP 192:SaWcFgwiR4pDDnTYaVdVxzPJWBHI4T/fKNUal/zZfoWbLAE/:hWcFgwiGD/1xWBHI4TxaVZAWAw
TLSH
T15E220A22481CE837E7D7AC8DFB392E3AD66D7B1A10E6786C40CCCB89C1A54786779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

store.json.mozlz4.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\crashes\store.json.mozlz4.tmp
Size 6KB
SHA256 7a1a513606bda0c51f336015fe56faaa71cb7bcf289fac06d5d18105a6581311
MD5 99e8a47c8591dc562ef417d62d402c59
SHA1 b2182cdb93c48d7f3d372a97d0fec4508e1a2923
SHA512 faff05c0937fbfd5ab4c1ddab25777aca3b088d70f2291b4de8112d7096b2a732bfbf42d67ee3d449f0da737008473549a4e5b049f793cb634fdaf18392c4ddd
SSDEEP 192:l5C/SvnkLfSnPvXOIvn+Wd3SN+c+zpsPi+Cdv8SZk3W5rP:HS0pnPv+U+wCN8O52EirP
TLSH
T176D19D33E988BE569A49991072936E4F46A44E1BD1C1C206347E3BB14EF08902E3D7C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 0c7ce61f9977f373b0c4c5eb0366b2cc148984205dd015708609d2876e63b532
MD5 31bfcc6fd8de869dbddb949a07e3daa2
SHA1 540da487f716b1e7689f2201c89bebbbca9be58d
SHA512 e042b625a819daf15505df64730c185c9d1e64067b78c67b5bacf81eac3724c634e2bbc080532f09819c98be08e1620a70184a51584fc1414e40ab7cee8442c8
SSDEEP 768:2KIPAMj1laq5FL9vsGcm+ujGRMAC0bXb1gb3bbbp:Eaq5FLjGg
TLSH
T1BBD21244EB2A953FD42852BBDCA10B042F79BC8959192F673B4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 046d514a821b030220bb380216237a35ccdbfa9f2007e6f2165967fa7a6c309d
MD5 8b9d24fb8457c4be8b63f6baa8d69b02
SHA1 1419f7cbe60b49acab9f350df8224b619a2bc355
SHA512 452cc3e22d133c4a386098960984ca8e7897c9d305de4188ed6cb942ae16e97277ec35991ead1fe64a976b8c5f82579bd509650650ada6abbb2184acd9aefb36
TLSH
T17161BB58F629963FE448413ADC921B405F307456A8AF3F2A35AC608D1E5B3CD3ACD03E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 25e67c3d34f637f873eb0d8481e2a2ad83f8dbf2d22ee20b478f04308f8372fb
MD5 6ae46c62afa40aa4563764e1835fde6f
SHA1 d54196456b7ea8a91a03eda8c1a9191810f9a9f9
SHA512 1e418611dd4c809a2f46cc590c0f58eb3b0d0b837b3d01b24c6b7c1c31e8ca653a89d6e070099dfcef09d7a6e9245cc376728e895f13ea78f02eaf59c4378144
TLSH
T19471B958F629963FD449413ACC921B405F307496A8AF2F2A35AC608D2E5B3CD7ACD17E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 f6a6eb0b57ce4757bbac77af8a1a03c786ce56f2490051315fe15e7dbebdbc58
MD5 c355dc8fb317802bab28c654814a5735
SHA1 b8a9fd6e3fe90a4542f6a149957f45221281059f
SHA512 7b283dd7136588a5b7e415dd70914103d5e7c74b96f059797d1bd8e02fcb0b20408eeead8bfa9233d79a2004ddaf4ee7bd1062a243a46e19800a975c1ca4c9b8
SSDEEP 96:BFAQFMBFWF3F6FS/dd66JoztdzgClKtmc0d/UcSdF95/7bkW6Grc:UI1d66JoztdzgCl6mc0dFOv5zbou
TLSH
T11D81AC58F629963FD409413ACD921B505F307096A8AF3F2635AC644D2E573CD7ACD03E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 da52f231f2e915162d73e476dec73d38c28ebf3897e28fa628ac6186afe47dfc
MD5 01e713b5a438cf42e682eff5bf574500
SHA1 1c1b913dcc350794b07916d957bb10151617ac09
SHA512 83abf95d58f4de398ae670bc74520739d32c257779f648785318f5450621f41f4f97f8a686e1fad3e01e1042c676c8de6be58028866a0d79ca2ef23e58f99619
SSDEEP 96:BFAQFM3XFVF3F6FS/dd66JoztdzgClKtmc0d/UIBgptSdF95/7bkW6GrcEARq0Nn:Uj1d66JoztdzgCl6mc0dnKPOv5zboubk
TLSH
T1EEA1DB58EA399A3ED408513BCC960B901F303497A8AF2F25319D664D1D4B29E7BCD23E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 a8c8cfed1511604284cf5010fbd0807862cb0250a98c6c5a3cd389165891d9b3
MD5 ceddaf5e9dc96a0b828c8c42d1677153
SHA1 edbf97b49a3d8032f7ffebc7e0eb81df98a2304e
SHA512 89ae207cf3f8c96f8be1e7af0693d8610e8ec24b7ea7ca350daf0783bb06eb5700ecd2b0b29e0ff719f6c692c464e59c3412bdb89e76c334c66d0d0548d30c36
SSDEEP 96:cBgptSdF95/7bkW6GrcEARqJyUR6DN9FAQFMqFcF3F6FS/dd66JoztdzgClKtmcM:cKPOv5zboubAR6yjDSv1d66JoztdzgC/
TLSH
T13AC1CC68E629563BC408523BCCA10B901F31389BA85F3F25329C764D2D5769E7A8D23E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 aec6a9186d912bfad02af60fbb494b247f2785874e832fe4f30a2e07c46b60b7
MD5 9115c50ad74831772f631711b2e2e276
SHA1 d52f4b3672b112636e38eb1ae4203a378319f1d7
SHA512 4e21fe1c873e4fe26761dcb1cf23b84cde369ccb94ea9b00018d032928988a4b50bc5d10f02436dcc417265cbaaa0da57cb937e684011306f810cb1cbed0f2a9
SSDEEP 192:pKPOv5zbo8bAR6yjDR+wT1d66JoztdzgCl6mc0d:pKgbo8bAR6yjDxxd66Joz/zgC1j
TLSH
T1D4E11E64EA38463FC408523BCCA10F840F35389B985E7F29359D764C2D5769E7A8D27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 b4f1a14848bba93f2f88db144d6e7b15b987623520ed0d46d82469a85ceebce4
MD5 702f8d060aa7ccf79f690fe524f72cad
SHA1 297bac64c32a34cba7376b9100dfd7fb8bff047d
SHA512 fa6ecefaf7be8604db8cc7f52d6eb1c06537d0f9856e696ce62bf986fb3300e0ed05ec767e72549aaac6aca48a57bb27850e869f4f3d9741758cae34a96cb2d9
SSDEEP 192:v1/66JoztdzgCl6mc0d/KPOv5zbo7vAR6yjDR8r:9/66Joz/zgC1j1KgboLAR6yjDW
TLSH
T164E110A8EA28863BC408537BCCA10B450F35389AD84E3F29319D755C2D576DE768E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\datareporting\glean\db\data.safe.tmp
Size 2KB
SHA256 6865b6f8d6edaf3043bb1da9b1911a637403c022602bb73fdfb037d80a3ab08d
MD5 239a1cdc0ed07deb1b114bb0c80d6ebd
SHA1 26fa675c03e2b4230f3e4c1786f339c16ce78b03
SHA512 cd278763188b23c2466ce1fd0eddb312357b2eed56c99018fef155b4b1c9d65a8c130d76957f6c320cfe622046614fe9f74ff6a2bb9a84363ae6ba8fe36dc254
TLSH
T1B851CC5DF2299A3FD4090139CD860F452E34744798AF2F2A759C608D2E572CD7B8D17E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 cf27b13d57145fee737f21bbfb519e55e51bdc214fb7a98eeaeffbeb62b57091
MD5 93fb1c47442904e9a04afd2dfb886db0
SHA1 f67f7effa211865a2ffdf9887cb2c5f2cecddf5a
SHA512 44ab9a7647748e9d54e864ebd1024e0310ca306b485c0cfa6da2cae8d7be67f9d4dbe2f416bffc5f15380430b04b2e21f600e975d34749e466ab4d9edac967ec
SSDEEP 96:BFAQFMmFZF3F6FS/dd66JoztdzgClKtmc0d/UpSdF95/7bkW6Grcp:Uc1d66JoztdzgCl6mc0dOOv5zbouS
TLSH
T15181BB58F629963FD409013ACD921B905F307096A8AF3F2631AC648D2E5B3CD7ACD13E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 20875641e9f2e09bd2e1839b423137579f9a81796ebd21c1702bd0ef636d3a3a
MD5 473c4d5e53f02f6f1b31c5fac5342d71
SHA1 59f1c089e0cce248762d0b7b03a737dee3850039
SHA512 9acd519dad82ebe9521c94a938b6a96a34b31f5ea7dafd0ac11e28b952a8e51138717a969025b48fe60d4cbf07ebe8640487e1fdda82e56c9c6a65d13233e244
SSDEEP 96:0SdF95/7bkW6GrcYFAQFMmFZF3F6FS/dd66JoztdzgClKtmc0d/U:0Ov5zbouEc1d66JoztdzgCl6mc0d
TLSH
T13581BB58F629963FD409013ACD921B905F307096A8AF3F2631AC648D2E5B3CD7ACD13E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 51755047eae4b9b1db8b1c95bbf9067b65ef9105f93fa1bc362f204a399cc87f
MD5 32e623b18f88cf0d63b5506012d0ddb6
SHA1 2aac4478ba37e4a3e896b6d9a858fa240fd3142b
SHA512 97a86087d8cbfd8a30f5ae965c0a760ffc69616b6aa169da73ded218285bef24dded945068152087aa4c61fcc8afd4a04f31f8597e7086d0bc6f07064385e92e
SSDEEP 96:xfSdF95/7bkW6GrcYFAQFM3XFVF3F6FS/dd66JoztdzgClKtmc0d/UK:xfOv5zbouEj1d66JoztdzgCl6mc0dz
TLSH
T1C291AB58F629963FD409413ACD921B905F307496A8AF3F2631AC644D2E5B3CD7ACD13E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 dd902fed1e11c05a22f4948b789019703bfdf6e9a035734a582a635661eac697
MD5 e093a6f2cc8c3b21604e63ea349361f6
SHA1 9e990b870a9d4de9ec9172e9997ec8e30431f428
SHA512 1eae76b28d4c9fd3302f74393e91ba845050c9c45e834264c163c36075f0655c7a4d91fa471f01bc8c551a48c1641a737a313b5ad4eee63bec9109c2e66a9c62
SSDEEP 96:BFAQFMqFcF3F6FS/dd66JoztdzgClKtmc0d/URBgptSdF95/7bkW6GrcEARq0NWK:Uv1d66JoztdzgCl6mc0d0KPOv5zboubg
TLSH
T13CA1ED54EA34563ED408113BCCA60F801F3074A7986F2F25319D664D1D9B29E7BCD23E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 67f9fa5252c3d58d6b6307c2fa6dc644a4883aadd6d85540616fece660fda7fc
MD5 107533da594567145a20056c443e502e
SHA1 4709e17c5ca42229529d1106f11644e164293c13
SHA512 a57561e32605e6eb2dc445e85b34d276aaa820770a255e7f63ae93c1fc4df81cb51e8d2ff5417acd2547a757519c91b2b458078f08f1870b4f334c56632e5d16
SSDEEP 96:ABgptSdF95/7bkW6GrcEARqoNjFAQFMqFcF3F6FS/dd66JoztdzgClKtmc0d/UK:AKPOv5zboubARlcv1d66JoztdzgCl6m5
TLSH
T194A1CB58EA355A3ED408513BCCA60B801F303496986F2F25319D664D1D5B29E7BCD23E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 9bff2e682be1af25c1a789f3b3e3e8439cbd1f4bf2b81a4b5e3186fa904aea91
MD5 66581eab0aac26d2401db3f151370416
SHA1 b786a4a07653a772c4a3fc95d671b14d1aa7433f
SHA512 fea7bdb6f57d87cc030b315161f9a5c5bbbfb3709ed6d72c1a8a4fd804f28230bcad5459df3ced3a40303d152a215ea374869e5c5f3b2961e8867ee35c6b7429
SSDEEP 192:pKPOv5zbo8bAR6yjDR+JE1d66JoztdzgCl6mc0dz:pKgbo8bAR6yjDOOd66Joz/zgC1jd
TLSH
T14EE11E64EA28863FC408523BCCA10F840F35389B984F3F29319D760C2D5769E7A8D27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 b6780280d94f65b0453d3977718de0b0b867c763b61d1ba89ffccb389d83aa73
MD5 d892a1dfa504d77973a9191105e6e365
SHA1 e4a1bd14171beca94fae3eb1612fa42eecec63a3
SHA512 a9bec41829abfa379db589a1691c734dd02f6c6c984d5199d858522bdbe354963c21015d2b586edeef14753c213b29a761cf43a9fb54dd50f45c22b6abe60ad6
SSDEEP 192:UE1d66JoztdzgCl6mc0dXKPOv5zbo8bAR6yjDR+o:UOd66Joz/zgC1jxKgbo8bAR6yjDz
TLSH
T11CE11E64EA28863FC408523BCCA10F840F35389B984F7F29359D764D2D5769E7A8D27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

04d2359e-9755-40ea-99a4-634d419ae677

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\datareporting\glean\pending_pings\04d2359e-9755-40ea-99a4-634d419ae677
Size 3KB
SHA256 55fa3f4ee9beeb3c4cf7666d9fafd37d4459f90e2e5dd050cb0c97550a569b2b
MD5 c5f7a6e729d5939e24e7cb339286980c
SHA1 0c279d31cea55d20cde29f431752b59a5379b0dc
SHA512 d92fa1623d6991fb7d121031a110abc6e69b0aed0a9a575c99f064ed8a7717a9b9d391fc5643fe12ae3cfb3eb024d46abdb6d516db82e787808bde96a56335a7
TLSH
T1996184229164FA738FFCA480A3BB6E94DADE33DF58170E88226D9D5441F8074178F25B
MD5 SHA1 SHA512 TLSH

Submit Download

46551d6c-3948-4909-a53d-7877400999b2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\datareporting\glean\pending_pings\46551d6c-3948-4909-a53d-7877400999b2
Size 3KB
SHA256 b8df0582863f2875405c4e80001a5fd045ccfbb433eef7340fdd50c5a9d7e940
MD5 2b6b7d3048c62ba6c3d7e91e65e81dbe
SHA1 4c7bf2010829c6d6d55f967a064b64fabba6e8ce
SHA512 e72caea4961ff3ef243c490894d041db93a6ee34d155a2290cc7a7b63ce6c21903e8df197d72ee0fd5b07a91bedf477a234e926d928be7ff7de7c0f226478eef
TLSH
T10F6186618068B9738FFCA444E37B6E64CADE33CFA8570E89616D9D6442F8034178F25B
MD5 SHA1 SHA512 TLSH

Submit Download

62fd3906-6001-4b7c-be3a-96bfa3bb1984

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\datareporting\glean\pending_pings\62fd3906-6001-4b7c-be3a-96bfa3bb1984
Size 3KB
SHA256 30d2c42d347797162646ddc57bf2f870c15e7480666033a41c4ef1b242919543
MD5 6dee60b8924d69be210c5f9e1c4e142a
SHA1 306a6205fc2558445295c005ae1a67b6b95c13cf
SHA512 645c144e894bae2443304ddd17b0c248fa36cfa7fa1fd71bbcda2035f8d0da1dfa394d884ab28743986f00d95f4c65d1472365fbb05b9444db73627e76542004
TLSH
T1A96196619094B5738FFCA040A37B6E45CBDE33CB98570A89716D9E6442E8034178B25B
MD5 SHA1 SHA512 TLSH

Submit Download

7ea1c6dc-a9aa-408f-bdca-068994a1f2f4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\datareporting\glean\pending_pings\7ea1c6dc-a9aa-408f-bdca-068994a1f2f4
Size 2KB
SHA256 e4185346f192ba3860059cf0bbb4fea84ac5672e7af26ea564b6c8b813f31c90
MD5 6edd373b0d9e4e2a483f54877d2b61c1
SHA1 6631c3ab34c45d758996c80101ea586536564a40
SHA512 6f7baaaf935e05e13c7adbe212724613746c8f37b0ff6310e49dc008ae8fbc517154bbbc8eef96c132c66bcc9052b057e2522e68966cd6cc7f17c6d1a891c946
TLSH
T1D841536C39789C7A9C8AF74DD481338E53A48A0708C31C976D52EF0CCDD669D736A61B
MD5 SHA1 SHA512 TLSH

Submit Download

a812aa75-af70-40d7-a4d3-75d129cd47a0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\datareporting\glean\pending_pings\a812aa75-af70-40d7-a4d3-75d129cd47a0
Size 3KB
SHA256 e5e774664a7482aabcd58b48af8150ec2682d844be3948b86dcf2b6124095af3
MD5 23ef7149dff78f1ed5100ff3d36cb12a
SHA1 e6069db11e8916098d7609826ce0b69cb6235ed7
SHA512 ea77827fd151e96ec41e666265d74c447fae4f9b00b97840f41f578f35e8a83f3057e6cb7005d91fbe27d5863d3049f58774f0dac7f6f6cd342754299d75eb69
TLSH
T1486174618464B6738FFCA580D3776E84CADE33CF98470ED925699D6442F8834138F25B
MD5 SHA1 SHA512 TLSH

Submit Download

a924e8c5-4638-4621-ab48-8dee14a5f82c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\datareporting\glean\pending_pings\a924e8c5-4638-4621-ab48-8dee14a5f82c
Size 883B
SHA256 e847a9b659423733618ce91f734301e8b1fef7c22838b878e0782d9b6edd3294
MD5 aad8580a95b79a3f98f35a420b9b2dcc
SHA1 fc3403dfff9cba14432049e778d10442a6078f0a
SHA512 ffabee9142806433c51ca4dae5708c684ad2f1dce8819b104795ea86b6b5bbc35a4af5e6dea93f41fe5c3aa08b2d029a67fa3d99d267d61cb02cc40ae9efbc8a
TLSH
T175110041E530B9B2CC2C930BC8513B4A57E8A823C0D600243DB5AF184D6AA1EA79670B
MD5 SHA1 SHA512 TLSH

Submit Download

ac19e65a-ed8a-4b32-a7a1-622abda8f047

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\datareporting\glean\pending_pings\ac19e65a-ed8a-4b32-a7a1-622abda8f047
Size 235B
SHA256 d0f2e46d70693f4fa89e968d6d9c7d9e2cf126c2f08d2b44e5ee401cff2ef217
MD5 0dd57c220f39747c23b2f01c19f87829
SHA1 9cd8a8b8d9535d4ba8203ebf7f0ae887153ea5f9
SHA512 6ba0442d30af212c7b9aff3ba78aab6aeed35a1508389a811ef8321228ff8672635237dc37731892cd45a911dbb90175836e86cdfe160e845fe0ef2c0cae6f26
TLSH
T147D0A7D02898676D88154F17B1E069C730988C376874A8A0D5614574AAFAEC5516592A
MD5 SHA1 SHA512 TLSH

Submit Download

d5dad0e6-4b25-4322-93e3-150462c98e81

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\datareporting\glean\pending_pings\d5dad0e6-4b25-4322-93e3-150462c98e81
Size 3KB
SHA256 45f945f2c37a58333a4518a08c5d8158a865733b6da104934c5b3565dacc5df3
MD5 adde5080b318d80f281051c178a74114
SHA1 3b30950ac24f4b22dcc7404a004e434c6e386fb0
SHA512 949eb14ced55f282fb8400b24abfa56664644260e3e16febb9d7899b7c0e7f9a65927cc6cd95a9019c2c3e8deca2c0302858aaaf285f316c2ab2914ffaf64005
TLSH
T1AA61B8618458BA73CFFCA481A3776E94CADE33CFA8570E8931698D5442E8434178F25B
MD5 SHA1 SHA512 TLSH

Submit Download

d9130a4d-7e12-4eb2-bce9-682dff5cda80

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\datareporting\glean\pending_pings\d9130a4d-7e12-4eb2-bce9-682dff5cda80
Size 896B
SHA256 3e05475dc8598958f73d4b56963fd9d25a37bb5be09dd3f5c3793e73be4d9053
MD5 7cb13e35bcbccce1faaa5ccd09fc8235
SHA1 de228e7d7f2c50a7a71c7cf95e0a9802b809d830
SHA512 75648a72cd12d55a4c7b34e3ec3783a431e4905ee2070a7e923695110a6ec53a0955de6b6f5a399e40519ac6bcacd8fb5de94272f84803d65af14bdb2f0d1edf
TLSH
T1BE110480C57576B2CD3CD68B88A13B4656E46523C0DB08187E656F184DAB52E9352707
MD5 SHA1 SHA512 TLSH

Submit Download

db4f3183-c47a-405a-9743-23b06ff76bfd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\datareporting\glean\pending_pings\db4f3183-c47a-405a-9743-23b06ff76bfd
Size 3KB
SHA256 b78ed8d4213e9bc9f2cb99f623e377a0bff8aba531b8346bbdad14fd70e4a2f8
MD5 ad7fe7d7f64dc5da4427da481a1a046c
SHA1 697be20fb62a257073d6a890ecc2a599ac9d7d48
SHA512 1f950f37b474b70808ff5b8d0862ba237e2474f88f0512b19e96245bfab4ad429d62bc27f8b82bf1c3c56769c7f91c61ae2358491e45bfdf64beae9e2b2c8e9f
TLSH
T1BC6185618058B9B38BECB441937B2E94DBDE33CBA4570E89216D9D6842F802417CF25B
MD5 SHA1 SHA512 TLSH

Submit Download

df144f7e-d859-4868-a110-d45ca26340ea

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\datareporting\glean\pending_pings\df144f7e-d859-4868-a110-d45ca26340ea
Size 235B
SHA256 aa544e63cc1886d241be91b1d167199cfe5b69ac815d685184ad83f51db3b4bf
MD5 2eb7872bc8845520e2906d57bdc806e8
SHA1 cbece47b7a81956cd9cbf1deccac051bfbc73058
SHA512 185de053187c8d889e73ae0d4d029492677953c0072e628bdfb649cb2ef9fab0804d85f360e05f88c91d7786005da78cf6ecc806b97f17b73987a37467fe884b
TLSH
T1B0D097C4A8A877ED88402F0BB0A028C630548C331478D820C6D18174CDFDEC8029191A
MD5 SHA1 SHA512 TLSH

Submit Download

e1182209-4f4e-46bc-b52d-fed3075873c7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\datareporting\glean\pending_pings\e1182209-4f4e-46bc-b52d-fed3075873c7
Size 16KB
SHA256 24095fd0ba86d766af81cb4300f175a6af4c596df0ca8bd85f6628b93f0f8255
MD5 e71eb9ee4a035643abf802e590c1bff9
SHA1 89edc1e1e5273fa00eb1615025b093a2cc4f1449
SHA512 eef1cf2ccaac26e9135f94bb2cad37bb1f9ac31c3e5e67437a44c79132a9e5c2fe2c3e25d0088d1f35ba6a0774f350cc61bda99f395038dd0c97815594a856e7
SSDEEP 384:jqVyuj+EoZY4ioWTGeGvH7bAliRyKjMZNu4iC:uycEYhfTIvl6iC
TLSH
T1F172DB562460457A8591E36894FC7FC3E2F628CF4C419FCA9BE4BD086EDE06D512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\prefs.js
Size 6KB
SHA256 402a61e980475621acca16275819b805be6d699d605fe8870072e7f0949110f0
MD5 3410ade309ed0224de7e04b0eee69c0c
SHA1 e9d65003048fee9b3342897ff29120321e7ace70
SHA512 837647d44f2ee1fdb39be1d160639e4a4e8dbe9e888f3ae74e8fbb0fc53a38cec62cbf78b9554e488c7180b7f56d57492b6cc395184b9a1252ce47c931347c3b
SSDEEP 96:xHPNUTUSEqGqqfLzMz1zSxSSlNdv9jTnCHP//cXEBw88u8L4cndVQdDq:Pi3RqfL4zASSA0XEBw8876M
TLSH
T117E130789418CB7F74B677AC6C688831AAB2013BBBBF68C650B554C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2008-28-0x0000000005ED0000-0x0000000005F82000-memory.dmp

Download

memory/2008-23-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/2008-1607-0x0000000007BE0000-0x0000000007C72000-memory.dmp

Download

memory/2008-24-0x0000000005610000-0x0000000005BCA000-memory.dmp

Download

memory/2008-25-0x0000000005E00000-0x0000000005E66000-memory.dmp

Download

memory/2008-1604-0x0000000006D80000-0x00000000070DB000-memory.dmp

Download

memory/2008-26-0x0000000074CB2000-0x0000000074CB3000-memory.dmp

Download

memory/2008-1603-0x00000000065F0000-0x0000000006612000-memory.dmp

Download

memory/2008-1608-0x0000000007B40000-0x0000000007B4A000-memory.dmp

Download

memory/2008-363-0x0000000074CB2000-0x0000000074CB3000-memory.dmp

Download

memory/2008-29-0x0000000006150000-0x0000000006312000-memory.dmp

Download

memory/2008-30-0x0000000006000000-0x0000000006076000-memory.dmp

Download

memory/2008-31-0x0000000006080000-0x00000000060D0000-memory.dmp

Download

memory/2008-32-0x0000000006850000-0x0000000006D7C000-memory.dmp

Download

memory/2008-33-0x0000000006480000-0x000000000649E000-memory.dmp

Download

memory/2056-151-0x00000287B4810000-0x00000287B4820000-memory.dmp

Download

memory/2908-1-0x00007FFF7623F000-0x00007FFF76240000-memory.dmp

Download

memory/2908-17-0x00007FFF760B0000-0x00007FFF76A54000-memory.dmp

Download

memory/2908-18-0x00007FFF760B0000-0x00007FFF76A54000-memory.dmp

Download

memory/2908-19-0x00007FFF760B0000-0x00007FFF76A54000-memory.dmp

Download

memory/2908-16-0x00007FFF760B0000-0x00007FFF76A54000-memory.dmp

Download

memory/2908-15-0x00007FFF760B0000-0x00007FFF76A54000-memory.dmp

Download

memory/2908-14-0x00007FFF760B0000-0x00007FFF76A54000-memory.dmp

Download

memory/2908-13-0x00007FFF760B0000-0x00007FFF76A54000-memory.dmp

Download

memory/2908-12-0x00007FFF760B0000-0x00007FFF76A54000-memory.dmp

Download

memory/2908-11-0x00007FFF760B0000-0x00007FFF76A54000-memory.dmp

Download

memory/2908-9-0x00007FFF760B0000-0x00007FFF76A54000-memory.dmp

Download

memory/2908-8-0x00007FFF760B0000-0x00007FFF76A54000-memory.dmp

Download

memory/2908-7-0x00007FFF760B0000-0x00007FFF76A54000-memory.dmp

Download

memory/2908-6-0x00007FFF760B0000-0x00007FFF76A54000-memory.dmp

Download

memory/2908-5-0x0000024552BD0000-0x0000024552BF2000-memory.dmp

Download

memory/2908-2-0x00007FFF760B0000-0x00007FFF76A54000-memory.dmp

Download

memory/2908-20-0x0000024538CB0000-0x0000024538CBC000-memory.dmp

Download

memory/2908-21-0x0000024538CC0000-0x0000024538CC8000-memory.dmp

Download

memory/2908-22-0x00007FFF760B0000-0x00007FFF76A54000-memory.dmp

Download

memory/2908-27-0x00007FFF760B0000-0x00007FFF76A54000-memory.dmp

Download

memory/2908-1611-0x00007FFF760B0000-0x00007FFF76A54000-memory.dmp

Download