Overview

overview

9

Static

static

1

URLScan

urlscan

1

http://biographyer.c...

windows11-ltsc_2024-x64

9

Analysis

  • user interaction
    yes
  • max time kernel
    299s
  • max time network
    303s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 00:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    http://biographyer.com
  • Sample260810-a3jdnagk5x
Score
9/10
persistence

Malware Config

Signatures

  • .NET loader stage by imphash + section/import shape 7 IoCs
  • CLR-hosted .NET infostealer assembly: GDI screen capture + AES CryptoStream + raw TcpClient exfil + 8 IoCs
  • CLR-hosted .NET infostealer: reflective assembly + browser cred theft + AES socket exfil 7 IoCs
  • CLR-hosting MZER loader (student_s.bin, /std/ branch); boots .NET/Donut infostealer via mscoree. 7 IoCs
  • CLR-hosting MZER loader stage (my_sss.bin / student_s.bin), ~276KB 7 IoCs
  • ClickFix v8 — MZER custom loader stub with x64 PIC bootstrapper 9 IoCs
  • ClickFix v8 — Suspicious named pipes: CPFATP_ (CLR profiler abuse) / Sessions 11 IoCs
  • Complete MZER GetPC stub as a code-anchor (immediate wildcarded) 9 IoCs
  • Donut .NET loader by imphash — stable across all waves/branches despite per-lure SHA-256 churn 7 IoCs
  • Embedded RSA-1024 C2 handshake public key (CAPI RSA1 blob, e=65537). Client RSA-wraps the AES sessio 29 IoCs
  • Fires on any WP-002 chain component 10 IoCs
  • Injected CLR-hosted .NET infostealer (memory scan): AES-over-raw-TCP + screen capture + WMI recon 8 IoCs
  • MZER polyglot header + complete GetPC self-locating x64 stub (branch immediate wildcarded) 9 IoCs
  • MZER polyglot header: position-independent Donut shellcode masquerading as PE (cross-version cluster 9 IoCs
  • MZER polyglot: MZ-lookalike header that is also a GetPC self-locating x64 stub 9 IoCs
  • MZER polyglot: MZ-lookalike header that is also a GetPC self-locating x64 stub (offset 0). Durable c 9 IoCs
  • MZER-polyglot Donut loader family: header + GetPC bootstrap prologue at offset 0 9 IoCs
  • NEW in V12.1: native MinGW-w64/GCC-15 WinHTTP downloader stage fetching enterprise/student_s.bin 2 IoCs
  • Native PE32+ loader: process-enum + remote-thread injection + WinHTTP stage fetch 2 IoCs
  • Network IOCs for the WP-002 stage host and C2 gate 10 IoCs
  • V12.1 infra: new stage-2 IP, recycled V11 C2 domain, TDS, lure host, EtherHiding contract 2 IoCs
  • WinHTTP downloader by imphash — durable cross-wave-cluster pivot 2 IoCs
  • WinHTTP downloader/injector MZER stage (std_enterprise ~50KB). 2 IoCs
  • WinHTTP downloader/injector MZER stage, ~50KB 2 IoCs
  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file 1 IoCs
  • Checks processor information in registry 2 TTPs 33 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
    1⤵
      PID:2508
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://biographyer.com"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1216
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://biographyer.com
        2⤵
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5800
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {46e99109-5da0-4b07-93c0-c855c84900bd} -parentPid 5800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5800" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
          3⤵
            PID:4636
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2448 -initialChannelId {55acae33-e56b-4eb0-b80a-9733a6c4c04d} -parentPid 5800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
            3⤵
              PID:856
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3860 -prefsLen 25164 -prefMapHandle 3864 -prefMapSize 270279 -jsInitHandle 3868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3876 -initialChannelId {86a2a511-7aa2-453e-9de7-3e8218a542b9} -parentPid 5800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
              3⤵
              • Checks processor information in registry
              PID:3764
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4036 -prefsLen 27274 -prefMapHandle 4040 -prefMapSize 270279 -ipcHandle 4116 -initialChannelId {77324bf6-e24d-4f2e-a820-a471ef16386c} -parentPid 5800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5800" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
              3⤵
                PID:4588
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1596 -prefsLen 34773 -prefMapHandle 2632 -prefMapSize 270279 -jsInitHandle 2796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3136 -initialChannelId {a2110184-3eb8-4cbe-bbbf-a0cc7b90eecb} -parentPid 5800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                3⤵
                • Checks processor information in registry
                PID:1232
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4464 -prefsLen 35010 -prefMapHandle 3196 -prefMapSize 270279 -ipcHandle 4512 -initialChannelId {c574e92b-95ea-4250-8925-cdedc1c4efdc} -parentPid 5800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                3⤵
                • Checks processor information in registry
                PID:2660
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5416 -prefsLen 32952 -prefMapHandle 5420 -prefMapSize 270279 -jsInitHandle 5424 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5400 -initialChannelId {38f55a1b-7e6f-44e3-8e7e-7d189af0de4e} -parentPid 5800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                3⤵
                • Checks processor information in registry
                PID:2796
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3188 -prefsLen 32952 -prefMapHandle 2624 -prefMapSize 270279 -jsInitHandle 2772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5636 -initialChannelId {7e24dba2-57ed-4f5b-ad22-29a713a18702} -parentPid 5800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                3⤵
                • Checks processor information in registry
                PID:1112
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5844 -prefsLen 32952 -prefMapHandle 5848 -prefMapSize 270279 -jsInitHandle 5852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5860 -initialChannelId {90b1337d-5f69-44eb-adb5-327ca140b93d} -parentPid 5800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                3⤵
                • Checks processor information in registry
                PID:1188
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6036 -prefsLen 32952 -prefMapHandle 6040 -prefMapSize 270279 -jsInitHandle 6044 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6052 -initialChannelId {5e214bea-05c6-4ad8-bbee-1e48ff348782} -parentPid 5800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                3⤵
                • Checks processor information in registry
                PID:2544
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3168 -prefsLen 36766 -prefMapHandle 6544 -prefMapSize 270279 -jsInitHandle 2656 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6560 -initialChannelId {d3cff84b-c4a7-450f-bd99-785ddfcf5edb} -parentPid 5800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
                3⤵
                • Checks processor information in registry
                PID:6104
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6580 -prefsLen 36766 -prefMapHandle 6380 -prefMapSize 270279 -jsInitHandle 6500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6488 -initialChannelId {16cd8bda-7386-4752-b2de-c038963717be} -parentPid 5800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
                3⤵
                • Checks processor information in registry
                PID:6012
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6396 -prefsLen 36766 -prefMapHandle 6040 -prefMapSize 270279 -jsInitHandle 4920 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2968 -initialChannelId {1bd2d6df-eea9-48f4-bdc1-84be2284e694} -parentPid 5800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
                3⤵
                • Checks processor information in registry
                PID:2652
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6088 -prefsLen 36845 -prefMapHandle 6056 -prefMapSize 270279 -jsInitHandle 6052 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5884 -initialChannelId {b15bc811-2e1e-4fa6-8716-d5c6037c1ec4} -parentPid 5800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
                3⤵
                • Checks processor information in registry
                PID:4604
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6824 -prefsLen 37553 -prefMapHandle 7232 -prefMapSize 270279 -jsInitHandle 7196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6808 -initialChannelId {1df506eb-70a6-46ee-bdb9-2aede72ff65a} -parentPid 5800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
                3⤵
                • Checks processor information in registry
                PID:5508
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6864 -prefsLen 37553 -prefMapHandle 5936 -prefMapSize 270279 -jsInitHandle 5440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1636 -initialChannelId {214d057d-737d-4be2-af72-a1268019fdc1} -parentPid 5800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
                3⤵
                • Checks processor information in registry
                PID:4348
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
            1⤵
            • Badlisted process makes network request
            • Downloads MZ/PE file
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2560
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qg12gurm\qg12gurm.cmdline"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4560
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF4F5.tmp" "c:\Users\Admin\AppData\Local\Temp\qg12gurm\CSC5EBBF434DE4042228C4C64A4B52AA838.TMP"
                3⤵
                  PID:3420
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
              1⤵
                PID:6024

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                    • Size 16KB
                    • SHA256 cd5df0ae7112b5c6782e68e1b837cc6034ee39b7e5e31c8fc9cdcd77c67e7ad0
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
                    • Size 16KB
                    • SHA256 5ad3cbc36b497ed8e144f01d793ae6ae057cc3c89e664833a23d271a28a443dc
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    7945f801b2cf874ec3cb3a1919b93edd.png
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\thumbnails\7945f801b2cf874ec3cb3a1919b93edd.png
                    • Size 3KB
                    • SHA256 0707258e7a9c4e6aededdca5fb3142227952362ac704f8050e702eeb53d3acc5
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    RESF4F5.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\RESF4F5.tmp
                    • Size 1KB
                    • SHA256 a70560b37932129c32ce671d133e5dcb1c7bd602bfa056436578b38c5473e4fb
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    qg12gurm.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\qg12gurm\qg12gurm.dll
                    • Size 3KB
                    • SHA256 0befc23f696b51b3be5aabe88806cc47d20a1bed5d3eed3bf45871c8d2ff85a6
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    tmpaddon
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                    • Size 11KB
                    • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    tmpaddon
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                    • Size 502KB
                    • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    6824f4a902c78fbd.customDestinations-ms
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                    • Size 9KB
                    • SHA256 42c9c146d41ffa171df0da303d15245e2121824236786ba0f72c5f6f6c09a954
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    6824f4a902c78fbd.customDestinations-ms
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                    • Size 14KB
                    • SHA256 403239b147b1016f5b5490333958569ccf695cca34a006454484d116bb6c9a7b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    AlternateServices.bin
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\AlternateServices.bin
                    • Size 8KB
                    • SHA256 e2b2ec99d512f3b51bacc07f99f1906cb99aa5a3b49cbbd91939afc365414a84
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 29KB
                    • SHA256 ff9f0daf0d4aadd937a440c11f105bea43e5cdb94eb821cfb777e118f1fd740d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 29KB
                    • SHA256 bac71aaa39f266da3d1c356502fdc1ed3324e25c0823ee19ae1df76cb96b17bc
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    events
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\events\events
                    • Size 5KB
                    • SHA256 fe839403938b78121dfeef164f7259c8005d09ade6c7d094904161114801aedb
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    events
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\events\events
                    • Size 1KB
                    • SHA256 f48d33a4cb5b22827d3503bbad2ef491ea6e100369590fa349578fd87b8be187
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    07ec4e83-6036-4d33-a889-df3cfba61ca2
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\07ec4e83-6036-4d33-a889-df3cfba61ca2
                    • Size 871B
                    • SHA256 73b71ee7859ca46000f08b64841c03da44747877ccd82fd60ef2160e9c311c76
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    147ded73-3200-4bfe-81dd-ce638fe15983
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\147ded73-3200-4bfe-81dd-ce638fe15983
                    • Size 2KB
                    • SHA256 1de381dc038401de0e0f8ba205035462d91001cd27eb87598d8b23408e3647e2
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    89e591bf-4250-45ac-b651-6fd9ca49aff1
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\89e591bf-4250-45ac-b651-6fd9ca49aff1
                    • Size 886B
                    • SHA256 cec53e1567adeb8b2774e3ea79ea256b1ea5be49b462ea5f7951b854a3e3a844
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    99c5ca25-2de0-4f55-a62a-ebeb86e1cbfc
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\99c5ca25-2de0-4f55-a62a-ebeb86e1cbfc
                    • Size 235B
                    • SHA256 29bc7696c45d1a06b787e68f43ea45805a1f366aa02f1c05a39d2fe96e647d6e
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    aa5e9db5-2f55-45f1-8e82-6710b8f7200a
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\aa5e9db5-2f55-45f1-8e82-6710b8f7200a
                    • Size 235B
                    • SHA256 ab9e6e46f3b78babb472bc39a02867cdeaa6556a115438552efb594691008135
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    extensions.json
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\extensions.json
                    • Size 16KB
                    • SHA256 084a8eb76fe720711138a5376f72a7b2c8c27f70a9b04f8fecbb40a12ae1d2ce
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    gmpopenh264.dll
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                    • Size 1.1MB
                    • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    gmpopenh264.info
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                    • Size 116B
                    • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    manifest.json
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                    • Size 1002B
                    • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    widevinecdm.dll
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                    • Size 21.6MB
                    • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs-1.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\prefs-1.js
                    • Size 12KB
                    • SHA256 2dd280c368c3ec53e1d7bf693f5d87045a512bfc74e62de52ed1a3c129529f1b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs-1.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\prefs-1.js
                    • Size 6KB
                    • SHA256 862ed234fa5ad22fcda6c362aa3c7e7ade2769fbba92a296575ef5ffeb692431
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs-1.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\prefs-1.js
                    • Size 8KB
                    • SHA256 99a8972f032f6321d856eb819ed513a2976bc02fcbcd61ebcb09e98eabc0c457
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\prefs.js
                    • Size 6KB
                    • SHA256 e77778200bd021111dd66f3cebc223eef0fbdaad840e1164b86acb65b6cc5530
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\prefs.js
                    • Size 6KB
                    • SHA256 95b1dd54ddde9b00fc1807c73c1b0aef724645980493263e5712dc91de4c57ab
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    recovery.baklz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\sessionstore-backups\recovery.baklz4
                    • Size 1KB
                    • SHA256 a286a0451354d4a4b3d9ac433d1e408da43b7ee1e3a7941db9c63ee59b1880df
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    recovery.baklz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\sessionstore-backups\recovery.baklz4
                    • Size 1KB
                    • SHA256 fa450829bc44429ff74de0abc2c81a75b8896f3e8e7e23b5b34df7dd282b7089
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    recovery.baklz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\sessionstore-backups\recovery.baklz4
                    • Size 1KB
                    • SHA256 cc1280477bae24d7c5ac28fb9ea67f5855d63e474eda76cf95a04998eb6b98e6
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    recovery.baklz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\sessionstore-backups\recovery.baklz4
                    • Size 3KB
                    • SHA256 2e40a1f30922ae329260a3318b811d73b7f9ab9c8630cf6fb136644195132de5
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    recovery.baklz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\sessionstore-backups\recovery.baklz4
                    • Size 3KB
                    • SHA256 75d6b3e73dda6e9b8aacd5285ac253c841b512bfa2ba5a744215f407053c59bf
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    recovery.baklz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\sessionstore-backups\recovery.baklz4
                    • Size 3KB
                    • SHA256 122444c95cc275702a8b397c76fd0715a2253c338483897d82158e2ed45d3606
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    recovery.baklz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\sessionstore-backups\recovery.baklz4
                    • Size 6KB
                    • SHA256 bb5cc1f4321f483d9cea0d0994bb256e71ce799ccafdcda888c648620cf53f99
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    recovery.baklz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\sessionstore-backups\recovery.baklz4
                    • Size 7KB
                    • SHA256 d6b4aa9853054cdcc30ab24809e9c6985e5dabde4e5301e548f08e76e7b1e3ce
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    3870112724rsegmnoittet-es.sqlite
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                    • Size 7.2MB
                    • SHA256 0f9f396337dd8c4f4ae0690fd75b94700fc224945d7f8263425e6eb82e4194dd
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    CSC5EBBF434DE4042228C4C64A4B52AA838.TMP
                    • Path \??\c:\Users\Admin\AppData\Local\Temp\qg12gurm\CSC5EBBF434DE4042228C4C64A4B52AA838.TMP
                    • Size 652B
                    • SHA256 9696bae0d384c78a0ad9fdde3d2de82b526e6c7fde180f02e5432351745886e7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    qg12gurm.0.cs
                    • Path \??\c:\Users\Admin\AppData\Local\Temp\qg12gurm\qg12gurm.0.cs
                    • Size 599B
                    • SHA256 df64b1ff6efb6d4af78ecce7f1bf36808d715c83b8e2e949d717f9c5988eed28
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    qg12gurm.cmdline
                    • Path \??\c:\Users\Admin\AppData\Local\Temp\qg12gurm\qg12gurm.cmdline
                    • Size 369B
                    • SHA256 9405ebc2cf0c5fa2364635226e58230d29f121eaa0c1df9f732e6006af37575f
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    memory/2508-716-0x0000026FFAB00000-0x0000026FFAB30000-memory.dmp
                    Download

                    memory/2508-719-0x0000000000640000-0x0000000000659000-memory.dmp
                    Download

                    memory/2508-708-0x0000026FF7FA0000-0x0000026FF7FED000-memory.dmp
                    Download

                    memory/2508-714-0x0000026FF7FA0000-0x0000026FF7FED000-memory.dmp
                    Download

                    memory/2508-713-0x0000026FF7FA0000-0x0000026FF7FED000-memory.dmp
                    Download

                    memory/2508-712-0x0000026FF7FA0000-0x0000026FF7FED000-memory.dmp
                    Download

                    memory/2508-711-0x0000026FF7FA0000-0x0000026FF7FED000-memory.dmp
                    Download

                    memory/2508-710-0x0000026FF7FA0000-0x0000026FF7FED000-memory.dmp
                    Download

                    memory/2508-715-0x00007FF872E4A000-0x00007FF872E4B000-memory.dmp
                    Download

                    memory/2508-734-0x0000026FF7FA0000-0x0000026FF7FED000-memory.dmp
                    Download

                    memory/2508-717-0x00007FF872B50000-0x00007FF873588000-memory.dmp
                    Download

                    memory/2508-718-0x00007FF872B50000-0x00007FF873588000-memory.dmp
                    Download

                    memory/2508-720-0x00007FF872B50000-0x00007FF873588000-memory.dmp
                    Download

                    memory/2508-735-0x00007FF872B50000-0x00007FF873588000-memory.dmp
                    Download

                    memory/2508-721-0x00007FF872B50000-0x00007FF873588000-memory.dmp
                    Download

                    memory/2508-722-0x00007FF872B50000-0x00007FF873588000-memory.dmp
                    Download

                    memory/2508-723-0x00007FF872B50000-0x00007FF873588000-memory.dmp
                    Download

                    memory/2508-724-0x00007FF872B50000-0x00007FF873588000-memory.dmp
                    Download

                    memory/2508-725-0x00007FF872B50000-0x00007FF873588000-memory.dmp
                    Download

                    memory/2508-726-0x00007FF872B50000-0x00007FF873588000-memory.dmp
                    Download

                    memory/2508-727-0x00007FF872B50000-0x00007FF873588000-memory.dmp
                    Download

                    memory/2508-728-0x00007FF872B50000-0x00007FF873588000-memory.dmp
                    Download

                    memory/2508-729-0x00007FF872B50000-0x00007FF873588000-memory.dmp
                    Download

                    memory/2508-730-0x00007FF872B50000-0x00007FF873588000-memory.dmp
                    Download

                    memory/2508-731-0x00007FF872B50000-0x00007FF873588000-memory.dmp
                    Download

                    memory/2508-732-0x00007FF872B50000-0x00007FF873588000-memory.dmp
                    Download

                    memory/2508-733-0x00007FF872B50000-0x00007FF873588000-memory.dmp
                    Download

                    memory/2560-633-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
                    Download

                    memory/2560-707-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
                    Download

                    memory/2560-737-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
                    Download

                    memory/2560-736-0x0000021FE0900000-0x0000021FE090D000-memory.dmp
                    Download

                    memory/2560-706-0x0000021FE0900000-0x0000021FE090D000-memory.dmp
                    Download

                    memory/2560-705-0x0000021FE08F0000-0x0000021FE08F8000-memory.dmp
                    Download

                    memory/2560-691-0x0000021FE0C50000-0x0000021FE0E12000-memory.dmp
                    Download

                    memory/2560-680-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
                    Download

                    memory/2560-679-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
                    Download

                    memory/2560-640-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
                    Download

                    memory/2560-639-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
                    Download

                    memory/2560-638-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
                    Download

                    memory/2560-637-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
                    Download

                    memory/2560-635-0x0000021FE0930000-0x0000021FE0978000-memory.dmp
                    Download

                    memory/2560-636-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
                    Download

                    memory/2560-634-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
                    Download

                    memory/2560-632-0x0000021FE0560000-0x0000021FE0582000-memory.dmp
                    Download

                    memory/2560-629-0x00007FF87E26F000-0x00007FF87E270000-memory.dmp
                    Download