6aeb88c1ea36d896e9f3f1d5716d7bf309b089fd4e91b7bfbbc1d9f846d93e28

Analysis

user interaction
yes
max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 00:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
justice-launcher-setup.exe
Size 6.9MB
Sample260816-awtk2swfpc
SHA256 6aeb88c1ea36d896e9f3f1d5716d7bf309b089fd4e91b7bfbbc1d9f846d93e28
MD5 48fb75f5881a038e1d00a49a485304ba
SHA1 438f035426dddb6ecc655d8d7078f28da76084dd
SHA512 d4076501114eb043f5ec0f683c4e044cf65ea03324ee83e1accb54867d44f6c79db77745905157e0e4a8cb2953563448e0e5ebdf839c3f959e28309f5e61131d
SSDEEP 196608:/ccC1MOrN+VsNQN6l3rZHPffqkkFZGrOf/RFsE:/U1MOrsVsCw7v3qyrOfXsE
TLSH
T1687633289177AE5ADF930DB0A23B9A139155F10213232BD5AE10D6FC1D9F192BE0D9F3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
296	4580	firefox.exe
296	4580	firefox.exe

Executes dropped EXE 1 IoCs

pid	Process
1068	justice.exe

Loads dropped DLL 14 IoCs

pid	Process
4748	justice-launcher-setup.exe
4748	justice-launcher-setup.exe
4748	justice-launcher-setup.exe
4748	justice-launcher-setup.exe
4748	justice-launcher-setup.exe
4748	justice-launcher-setup.exe
4748	justice-launcher-setup.exe
4748	justice-launcher-setup.exe
4748	justice-launcher-setup.exe
4748	justice-launcher-setup.exe
4748	justice-launcher-setup.exe
4748	justice-launcher-setup.exe
4748	justice-launcher-setup.exe
4748	justice-launcher-setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	justice.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 58 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-as.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-es.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-af.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-or.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-et.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-te.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-el.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-it.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1661518009\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1661518009\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-da.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1661518009\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-be.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-la.hyb	msedgewebview2.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\MBSetup-1.1.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	justice-launcher-setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5468	msedge.exe
5736	msedge.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 12 IoCs

defense_evasion

pid	Process
2408	taskkill.exe
3236	taskkill.exe
4648	taskkill.exe
1044	taskkill.exe
3160	taskkill.exe
1788	taskkill.exe
4556	taskkill.exe
2996	taskkill.exe
4684	taskkill.exe
1560	taskkill.exe
2412	taskkill.exe
1224	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313141155658755"	msedgewebview2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\MBSetup-1.1.exe:Zone.Identifier	firefox.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4336	msedgewebview2.exe
5192	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	3236	taskkill.exe
Token: SeDebugPrivilege	4648	taskkill.exe
Token: SeDebugPrivilege	1044	taskkill.exe
Token: SeDebugPrivilege	4684	taskkill.exe
Token: SeDebugPrivilege	1560	taskkill.exe
Token: SeDebugPrivilege	2412	taskkill.exe
Token: SeDebugPrivilege	3160	taskkill.exe
Token: SeDebugPrivilege	1788	taskkill.exe
Token: SeDebugPrivilege	1224	taskkill.exe
Token: SeDebugPrivilege	4556	taskkill.exe
Token: SeDebugPrivilege	2996	taskkill.exe
Token: SeDebugPrivilege	2408	taskkill.exe
Token: SeDebugPrivilege	4580	firefox.exe
Token: SeDebugPrivilege	4580	firefox.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
1068	justice.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 3236	4748	justice-launcher-setup.exe	89
PID 4748 wrote to memory of 4648	4748	justice-launcher-setup.exe	92
PID 4748 wrote to memory of 1044	4748	justice-launcher-setup.exe	94
PID 4748 wrote to memory of 4684	4748	justice-launcher-setup.exe	96
PID 4748 wrote to memory of 1560	4748	justice-launcher-setup.exe	100
PID 4748 wrote to memory of 2412	4748	justice-launcher-setup.exe	102
PID 4748 wrote to memory of 3160	4748	justice-launcher-setup.exe	104
PID 4748 wrote to memory of 1788	4748	justice-launcher-setup.exe	106
PID 4748 wrote to memory of 1224	4748	justice-launcher-setup.exe	108
PID 4748 wrote to memory of 4556	4748	justice-launcher-setup.exe	110
PID 4748 wrote to memory of 2996	4748	justice-launcher-setup.exe	112
PID 4748 wrote to memory of 2408	4748	justice-launcher-setup.exe	114
PID 4748 wrote to memory of 1068	4748	justice-launcher-setup.exe	120
PID 1068 wrote to memory of 4336	1068	justice.exe	122
PID 4336 wrote to memory of 2700	4336	msedgewebview2.exe	123
PID 4336 wrote to memory of 4832	4336	msedgewebview2.exe	124
PID 4336 wrote to memory of 4832	4336	msedgewebview2.exe	124
PID 4336 wrote to memory of 4832	4336	msedgewebview2.exe	124
PID 4336 wrote to memory of 3988	4336	msedgewebview2.exe	125
PID 4336 wrote to memory of 1336	4336	msedgewebview2.exe	127
PID 4336 wrote to memory of 1336	4336	msedgewebview2.exe	127
PID 4336 wrote to memory of 3984	4336	msedgewebview2.exe	128
PID 4336 wrote to memory of 3984	4336	msedgewebview2.exe	128
PID 4336 wrote to memory of 3984	4336	msedgewebview2.exe	128
PID 1008 wrote to memory of 5192	1008	msedge.exe	142
PID 5192 wrote to memory of 5224	5192	msedge.exe	143
PID 5192 wrote to memory of 5468	5192	msedge.exe	144
PID 5192 wrote to memory of 5496	5192	msedge.exe	145
PID 5192 wrote to memory of 5496	5192	msedge.exe	145
PID 5192 wrote to memory of 5496	5192	msedge.exe	145
PID 5192 wrote to memory of 5516	5192	msedge.exe	146
PID 5192 wrote to memory of 5516	5192	msedge.exe	146
PID 5192 wrote to memory of 5544	5192	msedge.exe	148
PID 5192 wrote to memory of 5544	5192	msedge.exe	148
PID 5192 wrote to memory of 5544	5192	msedge.exe	148
PID 5304 wrote to memory of 5320	5304	msedge.exe	154
PID 5304 wrote to memory of 5736	5304	msedge.exe	155
PID 5304 wrote to memory of 5776	5304	msedge.exe	157
PID 5304 wrote to memory of 5776	5304	msedge.exe	157
PID 5304 wrote to memory of 5776	5304	msedge.exe	157
PID 5304 wrote to memory of 1072	5304	msedge.exe	158
PID 5304 wrote to memory of 1072	5304	msedge.exe	158
PID 4336 wrote to memory of 5208	4336	msedgewebview2.exe	160
PID 4336 wrote to memory of 5208	4336	msedgewebview2.exe	160
PID 4276 wrote to memory of 4580	4276	firefox.exe	162
PID 4276 wrote to memory of 4580	4276	firefox.exe	162
PID 4580 wrote to memory of 5648	4580	firefox.exe	163
PID 4580 wrote to memory of 5648	4580	firefox.exe	163
PID 4580 wrote to memory of 5648	4580	firefox.exe	163
PID 4580 wrote to memory of 5708	4580	firefox.exe	164
PID 4580 wrote to memory of 5708	4580	firefox.exe	164
PID 4580 wrote to memory of 5708	4580	firefox.exe	164
PID 4580 wrote to memory of 5708	4580	firefox.exe	164
PID 4580 wrote to memory of 4684	4580	firefox.exe	165
PID 4580 wrote to memory of 4684	4580	firefox.exe	165
PID 4580 wrote to memory of 4684	4580	firefox.exe	165
PID 4580 wrote to memory of 4684	4580	firefox.exe	165
PID 4580 wrote to memory of 6112	4580	firefox.exe	166
PID 4580 wrote to memory of 6112	4580	firefox.exe	166
PID 4580 wrote to memory of 6112	4580	firefox.exe	166
PID 4580 wrote to memory of 5236	4580	firefox.exe	167
PID 4580 wrote to memory of 5236	4580	firefox.exe	167
PID 4580 wrote to memory of 5236	4580	firefox.exe	167
PID 4580 wrote to memory of 5236	4580	firefox.exe	167

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\justice-launcher-setup.exe
"C:\Users\Admin\AppData\Local\Temp\justice-launcher-setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM "justice.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3236
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM "JusticeLauncher.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4648
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM "Justice Launcher.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1044
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM "justice-launcher.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4684
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM "justice.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1560
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM "JusticeLauncher.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2412
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM "Justice Launcher.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3160
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM "justice-launcher.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1788
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM "justice.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1224
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM "JusticeLauncher.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4556
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM "Justice Launcher.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2996
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM "justice-launcher.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2408
- C:\Users\Admin\AppData\Local\Programs\Justice Launcher\justice.exe
  "C:\Users\Admin\AppData\Local\Programs\Justice Launcher\justice.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=justice.exe --webview-exe-version=3.0.4 --user-data-dir="C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1068.1484.13242128607174337788
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4336
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ff9badbb078,0x7ff9badbb084,0x7ff9badbb090
      4⤵
      PID:2700
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView" --webview-exe-name=justice.exe --webview-exe-version=3.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1692,i,4162299870515926235,17535172941855226361,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1720 /prefetch:2
      4⤵
      PID:4832
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView" --webview-exe-name=justice.exe --webview-exe-version=3.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2028,i,4162299870515926235,17535172941855226361,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
      4⤵
      PID:3988
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView" --webview-exe-name=justice.exe --webview-exe-version=3.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2384,i,4162299870515926235,17535172941855226361,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:8
      4⤵
      PID:1336
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView" --webview-exe-name=justice.exe --webview-exe-version=3.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3628,i,4162299870515926235,17535172941855226361,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:3984
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView" --webview-exe-name=justice.exe --webview-exe-version=3.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2200,i,4162299870515926235,17535172941855226361,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:8
      4⤵
      PID:5208
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView" --webview-exe-name=justice.exe --webview-exe-version=3.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4592,i,4162299870515926235,17535172941855226361,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:8
      4⤵
      PID:5768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault918dac74hfc94h4083h8799haf547aec7cde
1⤵
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault918dac74hfc94h4083h8799haf547aec7cde --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x208,0x7ff9b6d3c188,0x7ff9b6d3c194,0x7ff9b6d3c1a0
    3⤵
    PID:5224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,17327917549695475936,45853170078057935,524288 --field-trial-handle=2308,i,10658612432302408999,18220670778658540867,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,4949640689028179733,1829899026253181944,262144 --field-trial-handle=2308,i,10658612432302408999,18220670778658540867,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
    3⤵
    PID:5496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1700,i,14301937506347740485,15252535582777936225,524288 --field-trial-handle=2308,i,10658612432302408999,18220670778658540867,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
    3⤵
    PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3260,i,5463118214737412058,16140901503376121458,2097152 --field-trial-handle=2308,i,10658612432302408999,18220670778658540867,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:2
    3⤵
    PID:5544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultd7528513h4fd2h4dech8293hbde5598e5651
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x27c,0x7ff9b6d3c188,0x7ff9b6d3c194,0x7ff9b6d3c1a0
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,9316292862369851271,3474921625062159956,524288 --field-trial-handle=2352,i,15000439079398430086,14817013908295301026,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,10227684501068082386,17873086871953894398,262144 --field-trial-handle=2352,i,15000439079398430086,14817013908295301026,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,14047857573636273243,9283173815340785552,524288 --field-trial-handle=2352,i,15000439079398430086,14817013908295301026,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:1072

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5756

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1976 -prefsLen 27099 -prefMapHandle 1980 -prefMapSize 270279 -ipcHandle 2068 -initialChannelId {bdbe8b58-de81-480b-bbb9-81ed50d606ba} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2444 -prefsLen 27135 -prefMapHandle 2448 -prefMapSize 270279 -ipcHandle 2464 -initialChannelId {629d2a40-f30b-4df6-ad5e-b8194857f962} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3656 -prefsLen 27276 -prefMapHandle 3660 -prefMapSize 270279 -jsInitHandle 3664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3672 -initialChannelId {17ed7d20-da7b-4eca-9f9a-f42368ded331} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3832 -prefsLen 27276 -prefMapHandle 3836 -prefMapSize 270279 -ipcHandle 3916 -initialChannelId {5c5cebe8-f0ef-4431-b18a-ec7913b082da} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:6112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4384 -prefsLen 34775 -prefMapHandle 4388 -prefMapSize 270279 -jsInitHandle 4392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4400 -initialChannelId {75c02de6-7f29-4645-a9ea-04c8a598e608} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4832 -prefsLen 35012 -prefMapHandle 2864 -prefMapSize 270279 -ipcHandle 4900 -initialChannelId {a21f5e88-fe72-45ce-9df5-ccda26efd856} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:7144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5036 -prefsLen 32900 -prefMapHandle 5040 -prefMapSize 270279 -jsInitHandle 5044 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5052 -initialChannelId {f70d6acf-3d8f-495c-9ead-81bc86ac3395} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5280 -prefsLen 32900 -prefMapHandle 5284 -prefMapSize 270279 -jsInitHandle 5288 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5296 -initialChannelId {09d748b0-c8e2-4d87-9da5-d35932ec6f73} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5472 -prefsLen 32900 -prefMapHandle 5476 -prefMapSize 270279 -jsInitHandle 5480 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5488 -initialChannelId {b803b21f-a57c-4735-95fc-f5eed9d95838} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6324 -prefsLen 33071 -prefMapHandle 6328 -prefMapSize 270279 -jsInitHandle 6332 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6300 -initialChannelId {ab24d078-44d4-47b9-8722-585b3de885ce} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:6672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5076 -prefsLen 33071 -prefMapHandle 5100 -prefMapSize 270279 -jsInitHandle 5196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5224 -initialChannelId {20c33c8f-5be6-4bad-aa18-c10875759070} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:7760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7636 -prefsLen 33111 -prefMapHandle 7680 -prefMapSize 270279 -jsInitHandle 7688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7684 -initialChannelId {eeea1787-4b46-4fe0-a4eb-076318947de3} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    PID:7484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crl-set

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1661518009\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1661518009\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-bn.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4336_1903709298\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5a5ff28fe2cf08a091d34a0603c3f83047b0e5a7599a968cc5b481a3d0241bf5
MD5 dad36a532343c89123f7da92c59d7f73
SHA1 90db03c5e1d14f02afd021739a43785211028c61
SHA512 139e1268397c8416174eb230e72565ee8a21fa90ea8066daed283e9d83f2ec66973c1a12f8ed8d8fdd9323e5d0882643cbb964a611eb4226d4f79435fcbe4da7
TLSH
T17F714CFD2A52419FF354C2BA40F2C10479F195E8F41FCECABDA04C302616BA5C269BD8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 b1f23e129c127ad3462e5b6524f49b05776e56d312b1e9020be3e8634ddbdc9c
MD5 8a61a700c094312a50c0cfce52331b6e
SHA1 8e28e025dbad7dcb283e73123d26ff7dcd7ab185
SHA512 c78ec98599e97282e7418fc5174e97697d3dce6410a4ff861127915723349d5a8f3594975c827d586178c40098e50cb263c39439d1c9f8b8d3df554631d48f03
TLSH
T18CE0D89454CBC36D9F9075C39125A70CC3C436C6F7A6FD4327918CC47603002B25F956
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 570B
SHA256 99def1b557f19f04c1affc6f247d0451f33fc10ec42e73792223c3215ac98be6
MD5 d4ba0ae0bb0b9faff3da6f35fdbc3c8a
SHA1 fb3e9dec7f35a9b1d94e54a5659dd0de484055e7
SHA512 86fd07c34b9abd4c52ba19eae291936f92bc6d38a75c021edc1dedbc15617669876180cd99f959c62476d82ec6bb9f5fe4c6cb4d82cb037efb76d99a4d3d9c51
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 d526aba0c49d5c20acce334a18246809eaed842e5a24f1bf5763142e1ce87dd8
MD5 c3c84313fa60b11e8932855d420f0903
SHA1 8c05876d7a8f70667ac995c140419a3dae1dfd20
SHA512 7b851900261259ea257facc605216f0241ef84837d8a4fd0b2130ecb1aecacce691a3d4df075011bc05e48ca80a76815072861fbbaed281bd0644fdfbfd99939
TLSH
T147E020480CCFC61A58646DD3D2B6630C92D03642B38C7941AFE9DCC46101541624B950
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 facfa06ebc46d85cfd01ef5aac3db95e7d21a077a02af75b659a075ab35b91c1
MD5 2dd0da73fe06b090393a1df84e4197cf
SHA1 8bc182fd970c665759606f75af0bf1c1e0386fda
SHA512 a2cfe37e1d51ca4d23513c5ddebeb27cb747c635fb25a96a7aac10ce577889c6f3186ccfbc56aa137edb7a694548a447aa6fdc467858f42fc1859b0b850fdfd5
TLSH
T11BE0D8F045DFC26D5A4421C7D22AB70CC3E0365AE78CBA426BD99CC4B049008A3CF9D1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 85dda372d80ab2a6228cb132162e5b6e488adf23d25889345a556b21472eb84e
MD5 fe848dbb88871bb66ce01fa619b2df14
SHA1 796e829e195495f1c3011859ce5136561d702186
SHA512 5f2bceeda9b28455e78c98162709778baf116595fd544fb053313cab0ef17796c0fabad9b3c54d049de681d898b6a20becf017e1e6c315e443ef9409eafa47fe
SSDEEP 96:sa2viEDWL0scdb9InCfdHWU6W6hfuH9EOx+WVoMfm+uecpYQjc0D67wowUhgNVDB:sxvuwsnY5HW6+WNGYOoxhgF
TLSH
T172E1B7527E28697B8CCBE11DBA267B53E2F9503265C5194CEEFC865C099B6CD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 7115cf6ed6282c0393c0f6634065d39f81fb6de16388a13cb66edd786f0b7217
MD5 12dc5d8906e3343140b2c05d0e255786
SHA1 fd16f660ad502afdcc886cf17e652ac27d33ed81
SHA512 37429b48386322a16917807cfb679a28ff32a5bec7c4093374954b406ad12c8bdea86af5651387e5f2497fbb690ab218770e267bff01c1e1a0e3ba77480265bc
SSDEEP 96:sa2jMaiEDWL0scdbDInAdHW+i046W6hfuH9EOx+WVoMfm+uecpYQjc0D67whwUho:sxDuwsdmrpMHW6+WNGYOhxhgF
TLSH
T1D2F1B7526E28A97B4CCBE11DFA267B53E2F9503275C5194DEEFC8A5C049B6CD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 26KB
SHA256 6fe7f02b3ffa214157798ff1c79f1e99c9cb6549364032098085767ca8f394e5
MD5 70a569854e6e25edde58d199524859e2
SHA1 1a0bc147b05d05097d98d8daac798f983c805984
SHA512 ddd8893d393bd4e9fa27069056c02bac7db85ddac1b7d02a9b396f6c9ae23bd549ea7b6c75cf95499198c58809714b538de05fc4c132e5b7c8510a5c6e5af417
SSDEEP 768:V3qbUj+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKdWroO:V3qbUj+WvSCs6u1jaaZLbWdtO
TLSH
T116C2E93B340CCA7E4F801E9DDD5A6F972EA802C7A7588D4447FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 3f16e0a439551e99e02de300be2667c660da3f16db6dc0ae42a2128746d1e381
MD5 f56225080f80807d936fe950421b2291
SHA1 3bf28525ea1f23acb0d9710f951fec1641146dbd
SHA512 3f8ca98fa3f2161132c0679e5a8d556a5fec0341309c4f51947102860ca00f6660ae44a08e18bd6cb72b9bb85fb7f7cdd9e37014a95fd99451aa7c504df13ab8
TLSH
T138E0DF1046CACA7969AB66C3522AD308A2E4F66BF3C8BDC26FE18C846142504B197992
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 927087a57a5d995eb58b5df74e0fa3541492095aff89d241368cf40916cb09ba
MD5 1cbcda2340324de0b210b768ca9416c3
SHA1 fd84bb4b171e602629f74ad88075a24da8fe17c5
SHA512 101a8a4488a4298d6d523f4d878106bbefb12603ed7d8f61deda5404fe6b3a32b61190bf5ba9d95f3a707bd45c626ee548c88d19ccf0eb4fe5b754ca867c3f75
TLSH
T1D3E0226001CFCB7F249734C7A252E308C2E2B20AFADAEA013F98ECC872022407247940
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 3c2028fdd4c0cd8a3341cf8e13c79654cad49b8bf6988ae8b18d46425212120e
MD5 472444bd0c026f7ac145d0c37a23c028
SHA1 fa8c7f0a2c1cdd8dea8bf055eed515368ebe28a5
SHA512 37753420f00adf82e26678c21f107584bfc54d6a3e5b14c25ca94ada96430fab3b9e16d09361d50dc1fe7a9850c8e196d7489752ed92613d6be4eb935fbdf117
TLSH
T1EFE04F704ADACB39595565C3836AE70C92E0FE46F799BE86EFA84484A101144B2AA990
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 9d78bb231b204afb2664d9597ba9702b5a66b5917643b42f146d6fd82d9c4944
MD5 469dff7f4021f93c22b532f244a71715
SHA1 38e2facf42d9327f8a88c555c63487bd1c30266d
SHA512 5a88bcf9698ebb2fa28494d7895abf4600dcff0287f8c69a222cb754f4caaa9decc99a2bd715b9d775b46f26b62b5e80e669d2bf75794dafd89a2b520803be01
TLSH
T14BE020545CCFC65F686529C76176530C92C03743FB9C7945AFA1C8C86001100764B951
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 0209ad171575d99c295d971ecd2e3385589804ed1a56e6eac024c13f2b046ad7
MD5 c607f36023c88906d7be75ade8d4c456
SHA1 b8d9d734d142f7397b6d4a3915c8e7524f6ec4d9
SHA512 e6677a2b401ed06a039e13558eb134653a311798c793100c45b2af0426711f3e1096e74bd431e17d96d1d566c719fa68f7173da745c0ea252f6f7af846cbf4fb
TLSH
T10321F55AF334C245E649467A143E6B511330D5069FF8EC0F04B620642E72A491D4F2E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 7e636c432f1ff0dd2e6eca34c892f202f08d78508ddd366918ce845515179eac
MD5 651385960cd815a430e308cec4b24801
SHA1 4c9849a74019243402fb14b8652357883f069819
SHA512 a27556f1c323600698d90fcfed2f62f992a17ac52bd95565708717690fd1148daee67433f455ce24e8c33d4d5c092abd5abfd259bd5a8461208d20560e333d30
TLSH
T12BE020546CCFC65F546129C351B6A34C92D13A43FB9C7E41AFE1CDC85101141764F951
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 311cc6d91aac55cb3e7a7ad6b7b9d2181c5bbc77f1dbc83bebf4df42724b902c
MD5 a940c101ff7b8400d1fb1e347098f733
SHA1 2eb79877b3ed9ee59d9baaa7c6d974b24a2cdfb2
SHA512 ec1a2c1e2f059e45d49167c3984d109a7e240b9bd5451a8665424478f8f7e90bb83a777c6689db638d20b9516b7756c24ee692a310692502e1429aa0dcd82660
SSDEEP 192:vONJ6Db6QmiUy4PHBa+joOmw+4sRg0CU6:vONJ6u9HBa+UOH+WbU6
TLSH
T17502E835683C5CB79EA26E49F88B3B279F94203BD9966B95DAD81F0C00D764C2347837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e612a9a39ff5e0741a0941e1db73c210caa80e8a91ba7a637dba0c0909f85f1b
MD5 75acd981451dc73000cb7e381fadb0fe
SHA1 9a357b32147fb0502e15cb15346fe6788cf50b15
SHA512 894093b208d79f12d6f784c752443b6b4f22c9d0d818c28a5e67c1803c33afaf618ba72102d25ed9c1130770d4ab8ac8482b9679e360260dceda51723814b20a
SSDEEP 192:xONM6DbOQmiUynP5Ba+joOmw+4z5FzNzeqol0U6:xONM6Su5Ba+UOH+MHte0U6
TLSH
T11812F635682C9C775DE27545F8C73BA79EA82077DC866F92E6D84F0C04DBA4C270A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 41caab45462f8e5b297bd47676c37373811579e3418b8b9617de708009098e12
MD5 6df13c655f555ed1944d9c2e0a5e344b
SHA1 921594bee9b99c2f1e8a2ca7845bc85d94e01de0
SHA512 87f9cb498ea275223e19f645db83e229dceeeef738f50f7b8dcd5d42206b0d75eff348436ed42a8a4ea35b927b357d185fbad8ab43fbda016cedf923578d330e
SSDEEP 192:zJsN96Dbi/2QmiUy705Ea+joOmw+4z5FzNmNqol0UO:zJsN966/Sh5Ea+UOH+MHsf0UO
TLSH
T19B120735682C9C7759E67545F8C73B679FA82077DC4A6F92E6D84F0C00D764C270A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 9da388ea4967a61b228cef049922ce5dc5b3922ab30a8da67a0b6f26aaa1913a
MD5 ec5a84e4b24defae53240146c87c9e1c
SHA1 005ec2fade18bde26dae5d44219b05a0d732cfa2
SHA512 947866fc2478accf21b2107ad206f0b225a8529abc9afe6f7494e8f66292ab3ed3fab6248347a3d2f1c800164af0b9eef2deca1ce035c70b85d208c7f7c05e77
SSDEEP 192:zJsNB6Dbi/2QmiUy605Ea+joOmw+4z5FzkHOqp5UO:zJsNB66/SU5Ea+UOH+MHCrUO
TLSH
T14412D835693C6CB79EE27E55F8873B279FA4206BD9462A91DAD81F0C00D764C134A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 c1917f1862443ab026f3748668dfa25548b42d3614d0442b35fc3e82f62269d0
MD5 9ed0a43e0ed61f3ac55ff51c6e7cb074
SHA1 aa2ecfa3380aca6270137303372c7ef6367b5869
SHA512 620579f0d67399d957334968a0faddf388da95365465a86f55683de1ac61e7d6471f81d0a646650542bfc88062c20fe0713e4735327c763c66a2c2710618a8f0
SSDEEP 192:zJsN96Dbi/2QmiUyI05Ea+joOmw+4z5FzNmNqol0UO:zJsN966/Sq5Ea+UOH+MHsf0UO
TLSH
T149120735682C9C7759E67545F8873BA39FA82077DC4A6F92EAD84F0C00D764C270A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 5cd2c4d9f13524923046198c92213691539407e04fa520cdae9eade1bad3d91d
MD5 e9e365607374115b92e4abe4b9628101
SHA1 d5054ea9b22317dca83801eb3586017bfcc0e2a8
SHA512 a84d65ed53e43883e5ecb7848fbd48f5305a63e6975e6af480cf85532879720061106be54f2a5888ebc3569f7123081a0e6eb48ccb8d7dba3e1da1c8a3c50401
TLSH
T151A012078473800AE4144051C49C024114A4804A0219D0015060932314A40CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

aeb59b47-720f-4405-bf07-c05b312618a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\aeb59b47-720f-4405-bf07-c05b312618a5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

00A40DDB44CB367C2F6144E4BFC81846CA29D0D1

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6apqb380.default-release\cache2\entries\00A40DDB44CB367C2F6144E4BFC81846CA29D0D1
Size 2.9MB
SHA256 5b802f5dfcafcf60a5045d7cfbe1253b174ec46e6dd2321df1ba07cf20e9448f
MD5 ffd82cca773849685b038995eb4602f5
SHA1 9fda0e226f76cdadde9151b507f33a9961110000
SHA512 ba3ebec5f5f82f11847b8d1ac7de9a48e27fcbc8ca57f4e6e7e82c4da432c718f4e3ceac0072456e9de9e71e81e21bf07aca2cc42d1f2f76d401a695558339b9
SSDEEP 24576:xEYlnZX2iOZh2CAlXGiZMnQv9mNORk6GlQzJzEhekxRVq3qRBCZllg6Bd0LdrfT4:WI9O32C6GiZIYBTF
TLSH
T11ED5086BDEC95F23C9A48274806B27753A34D082BBD3F627A5DF7010AC1A37C5D616AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1BCD2641127606CEDC07830B534B0A32DC19749C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6apqb380.default-release\cache2\entries\1BCD2641127606CEDC07830B534B0A32DC19749C
Size 17KB
SHA256 18fa9391a86ea9f7195c7f23fd639e412bbeabc24d9a4939e840d9a039257520
MD5 a2e457bd40a7e1335d0b961814332ebd
SHA1 ef13fb52813849e173a503ac59db0cc973a4019d
SHA512 62b0e031e0538b41c2a6bd9019b61ca06463aafb0200db13154f46f57ed1210a3267258bf43ec8e73e325c5b039430ca90ba67ccd7a36909bea0dc350aeacc22
SSDEEP 384:uCDeYt6ekiGfJYpKNlGJYyOad9qMtBLkBoJr1rz7IPJMH+IPJMBVf34fUP:lDoddYpKTGq+yMPLTrzkPJMHhPJMBVQ+
TLSH
T16982A0395D8A96086493ED56D9BD9B471D44B6F3CF5AF8BD2B003880A1C237C32E9D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20CB579209A6D442F5B5016D2C0972D7454FDE0B

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6apqb380.default-release\cache2\entries\20CB579209A6D442F5B5016D2C0972D7454FDE0B
Size 468KB
SHA256 0a084fd38bbb079b9046d28a54754dfe7d05839aa54cb79917c99305a8ff6a61
MD5 6f84bd2d23aa20cde500696b9703152e
SHA1 6f4ab6b5ba3a6a984ea91ac607ba69d08dcd2edf
SHA512 854e9cc58cef7611c934425dc86e42500c7b911d33d721c326be6be8b46299d1cc47c648d8b52085453cd9e71ebc8fd59fb2c1edacafff99bc01d0f36c4d2fa5
SSDEEP 6144:nCa1RyERNWLqD32JdSWIWyjhakc1FRiRmEA8o/KAmMLga1Zytfo:loERQqr2JwWIriiIMfo
TLSH
T145A4F7C2F9147FE3C826077144A383753730FA841BEBEA9715CDA655AC8BAB91F4225C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2F0F7E6E4E8C8CDEA9DFDC5CCD39E48164A91E13

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6apqb380.default-release\cache2\entries\2F0F7E6E4E8C8CDEA9DFDC5CCD39E48164A91E13
Size 4.0MB
SHA256 d76e629ca7608b223d4e2ea382ac65b0fe9faa5f63bfcdbb612c21df6ffee6d9
MD5 cc68e6cc44980b6c3c1882e8cdc3b172
SHA1 0f83ea42a0b3fcc89986c64517b446052d55f637
SHA512 4517ad0faf0a9317a2756b97defc4e75609e90de0bc80f8b160cdf41740e8935255983400c192be1ad405a8ba383dc86a9befefedc4e650b2a05e3f05547e48f
SSDEEP 49152:Ip/v8x37Foxwca3HXRl8AxPdH5vWkks0TNRmv1MmQGXZ:IpQrgE
TLSH
T14B16D716DE579F22C82403B145A713313A34D08527EAF32B6ECF7525BC273AB5E925AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

39C05638CF6B36C0A40981380C98C7E47B6C53A6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6apqb380.default-release\cache2\entries\39C05638CF6B36C0A40981380C98C7E47B6C53A6
Size 209KB
SHA256 b54d5b71cceec119abceee7e2e853e053e53b5a920689283868c540f2c51edfd
MD5 f53727f7ceb571e0b9cfcb9afcf717cb
SHA1 63b82774bef0a57104dd1298c1ae3dd329452ebe
SHA512 5bb7ac8e8a99f5ab7937665d7edd5035b782c9b997b5eb5c1814b31275a76bbff2efb966bfd1da8b1ebeef6a4b2abe0f29e0c216abb3c9ca0318d7649e7ad810
SSDEEP 1536:lQgOc3CSum8/miYG0QyFTdOAj1k+GeYEd4sExwTf1ARmkU2GGqi4fvXYmECJtGXV:lTaS4iH6nIx8t+RkjN20u7St24Z
TLSH
T1D8241866AE514F23C9A003B545E357313B34D0862BDBE32BAECE34267C6B7BA1D5116C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

501750420B160FE7596670D576A669B875E41D26

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6apqb380.default-release\cache2\entries\501750420B160FE7596670D576A669B875E41D26
Size 412KB
SHA256 ed9978206826dd5938ccf10762a0eff5f6dc43a9779674a97c6f5511430e038d
MD5 9091717dda3a6c2b66f380b53382c2ba
SHA1 71f371c86cbf440487dbe81b007d76b69db1b371
SHA512 113e7cacdbbb5f47167ee43769dab5f7a2a4e7aff2095e95e586a3cf10d8894ddcbf5d52a6e9f7e690ba31156e18c5c29e59ee82abd6ad6540498db6253af8b1
SSDEEP 6144:3EC1WHWK9VCT8UBQ47GKWG1UUhrQbGmL/n8rhQ66yJX7oX5nPFi:3EC1dK9YAU0m1hkZ/nyCHO
TLSH
T13994F767FE866E23C92502F140B723363B74D4865BD6F3272ACF7526BC2A3690D5189C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5AC3F4FA9AC4103A3E15C13056928DC2EB4524BC

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6apqb380.default-release\cache2\entries\5AC3F4FA9AC4103A3E15C13056928DC2EB4524BC
Size 72KB
SHA256 be2286ee1f8b85e9f433219b18a8f5bb03f25250dee0b319c400a6af338271ab
MD5 e0a7403a6570d2d4524a7fc6ae8e5b9f
SHA1 1a51e453a2332f0623fff8dd63e0143139e9dd1f
SHA512 45ee611db93590540ad66cc9cb5ab225baef7b12bc86edeec1eae30be8e90101af42e162ec55724169c6214c0c68724b5e8baa4232d1eef5c34f24e8ff080fdc
SSDEEP 1536:pmoA+DPUyTepLiR6yQI5zmtuJc68qj6FIUNQ4wBAJ48k:pmoBDMyap+R6yB5rJc68W6FI3Bc4j
TLSH
T187733B7BFF919A22CC200272447707363F32E1455BEBE317AB8E70266C5A3A91D559EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E0529F73E099984738891225006DE0A57B61C0CD

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6apqb380.default-release\cache2\entries\E0529F73E099984738891225006DE0A57B61C0CD
Size 2.5MB
SHA256 d8a275bf6648ec923aa569a4fdc84d7348233d3188689dfe37b9e9a49fa2ad2b
MD5 67075c9993cdb8ac89b62bc7a297af7f
SHA1 fa143dd1fc10a2fecda3b2dbb82787a781c17577
SHA512 703a9f6d86fb173223f960c2430e4a33ed3d8c06e0d739d72cd4d30031979d371c19a6850aa8d2e380be3b9f31e3e0711bc6e59f8103cbf64d3d9077f8df85e8
SSDEEP 24576:w3FN/PA5goqon7zyZS4YfcP1BqcaHzzcH9qkM4kTKC0SucCVcwdn21uWx:gz45goqoniYBAAUcy21uWx
TLSH
T155C5F72BDE895F57C8A4827880AF23753A74E0826FD3F72B659F70207C193798D6256C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2BE2FFD7D5AD80C1D331247681A84C9FA62F3C6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6apqb380.default-release\cache2\entries\E2BE2FFD7D5AD80C1D331247681A84C9FA62F3C6
Size 31KB
SHA256 f3e4b8bbd9a6199e12dda57da86f9d649cea5f4a94136792ecfbe3497b9e264e
MD5 e10f0af1486a7163842ef12174a862bc
SHA1 bd93ed464dc99a1bec0e6970609fb7d059267ec7
SHA512 f3f0045040de4527e2d67ec6ab4d52b61910e69e9ce660ef1ed334670b85a2b277d10c80d8863d3a18eb29b7e2410a6a1c4dd30797faf25e460f316a5ac7658d
SSDEEP 768:cNBGXZPvWTtHLssg5WYuYNhcQYJTkFJJ2IHvPJMHhPJMBVQJ:WBGutHLa9UQEY92U+48J
TLSH
T1FDE2E1365B0D2924F4A277784E5A468A7E0CB7A3CD4AB8BC0A702044E5C53FC75FDA5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EC612F8A6312198537C0137CCF6931251D0DC20E

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6apqb380.default-release\cache2\entries\EC612F8A6312198537C0137CCF6931251D0DC20E
Size 30KB
SHA256 a1cd2980fa52d6dfebcfed7693d1cc42e219770861e8365be452da01be80220a
MD5 711a33c522b4a2642bdd91c7c8982993
SHA1 84c8f48d1301416d39a06d907d08ee9d9dac902c
SHA512 61a1c42d36197f82ab044d13e14b74efe4e5736ee6f297c96bf490a3e21205a98b230e7effe412ecd4f43fbeb91880aaa72b0d3f6b505a7bd44f329b562938ff
SSDEEP 768:ERedKBXiDqZHBX8oNwertokcawzGZSYAXSTbGTfrG3PJMHhPJMBVQr:ERHXimZHZ86wertOISYViTfrR48r
TLSH
T1D5E2E1709B5B6204E81287A1E59FE3466CDCDB83CD11E2AE5F84F88250C3376B4FD09A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

justice-26.1.2.jar

Path C:\Users\Admin\AppData\Local\Programs\Justice Launcher\bundled-mods\justice\justice-26.1.2.jar
Size 827KB
SHA256 6b83466d076ec94ac2c997709e41f9fe0e5f701c6898036e575e69d4e5a1a05d
MD5 1506db95c5f0c51177530864dd776cbd
SHA1 f89a92161c88c4fbbba39dc5e826663260af90f0
SHA512 b735965417abf8b08efebcf34c226fb16e571183bb4f70bf9897b6e4aa74708b1772240300b8b14a8c492e393771d8055e49a490d90867556f60bfa0a969de97
SSDEEP 24576:fOBz1fbeQQFGkjjGbHNNTaghFxEAG4as5dYWVgC:2HeQAGkjCTX+Ri5KUgC
TLSH
T10605122979D6C761D16305B9C321A1E3E1EB02DCE606613F3DA6011BADF8D082B57DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

justice.exe

Path C:\Users\Admin\AppData\Local\Programs\Justice Launcher\justice.exe
Size 8.6MB
SHA256 ba0157202d80fc6f44d712db0104358329c8d7f955c85d3f8f09af4306e05477
MD5 a0d55948cbf98d44216dcd3487101260
SHA1 37bf700a79697648c9f140f1fe361c4109bd601d
SHA512 74bd0248239378483dc31872825a104a87a33f2fa42dd56a167be00daf840d38927d73f9d903099d5d727cd2c286d69e235dac194d9b7d15f5f7b11e53d69811
SSDEEP 98304:h9VA6gh8XHOJgZjOHBzu8aAHcV6KzVD1OtJAUa1IW47Qceyxn+O/X:iJgZjOHBzu6XaOW4YyxH
TLSH
T150961801BE9B59A8D08ACCB0C34B8B678A2134DB1936F4BF55C952292F7D7B45F1831E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nse82AA.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nse82AA.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nse82AA.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nse82AA.tmp\nsExec.dll
Size 7KB
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a6517fe7eac1d66f5de77b7e93d5d2d86e50f0d0221cd280e8cc8d2c7bbe4b97
MD5 33c353488a432bb8f5c92d260dda6933
SHA1 486fe596a52f0add6bf306ccda6cd0f67f0351c8
SHA512 8cc171bca1e022541ed2181ba3ba977e5a69e85a95ccbef3964215388354ab02281cf771a6d24fd68adbf0e92d73679bea39ff32e66f3360b040619db81a2a1a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4d58ccfde493257ae6b3493a853d2f01eed2eddbfbc3ee9f49ce894fd5dc6747
MD5 c8f583c688e26cb4af9493b370a73ae0
SHA1 b5130b20dc4c8954766a01bd5b2766d6921d55dc
SHA512 2d18a53cef86ade64bfe9356476055799fa9ebeb48163afa93cfaed2ee9a457a162068de030ba3e037b23af4ed3e9a36af2234c5fff0cb667a97b57eaab173ea
TLSH
T197D0121232014134C01030B30442610D8580C20F810580455428959E2E044540D03582
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 fbaddb40a3a3afb6dcf4ffc3bbeeefc954d0ad6542c172e88002c5b8d6efc40a
MD5 6743ab917a11460a9eb824a0abcac7ee
SHA1 737d69f13c5a2144b5cc73f0b5ac1d51330cb363
SHA512 4c234377276f12ec8ec75d63adc7efa3a7cfc9617ecef39463650af07e437ccbc1f2faf5d5361105420f08552ccf4d7faf91d830cf25ac2c52269d40ec239025
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 97122bdd6882ab239b7efe019df29b4541b63f0c6caa7c57631251f42497180f
MD5 1b0cb1be621fad4fb617a060a68bfd7c
SHA1 75647594d59df44f0242d361785576be280562ae
SHA512 cdde25e3dde3779a2b6bceb26bd13a6ce8a35389de6457b09c234197394a7d48e1c1b1a9f97a2b2775f49e7cc929bde2e55bca6a5c2a5a34b602b35b553c02d9
TLSH
T1D9B0921048808A30CB3806F0215ED442261D44024205821342AB0CD0A81A6CAE210034
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 8ca979e478813ddaa0dfe544d5c62cf125f7e8b631e50e73bcbef9029c98ea2d
MD5 172660d39d81827b1ac2cd0843c91e6b
SHA1 037f41d562df0d08b10728d0268b1b190534e4c4
SHA512 586218206933942d43c43fc8ee642ff07e1bbf8a37bdc4b981d78734a10cb39b937da2ef8ae93c13e457b01e7ebfa3ed798b1b08c049005976f86fc790cc16fd
SSDEEP 3:LstlNllkll/lSht:LsX3lEt8t
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a1f8f.TMP

Path C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView\Default\Network\Network Persistent State~RFe5a1f8f.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 4c32d3d58a9111accfb7b0be31276ed279bd7d86e8146a6b11c3a54915eef6e0
MD5 27c04a22536e1be88966478e71c951e4
SHA1 48072b7d821ad90a5d9b4d248e0da2b34ae4351c
SHA512 2b5e9e88f0484cc217fc2c84caba734c8a68907338c46dfbab0cc015e3d829dd45366543f211c45f57119502c265663c9ec9c47827964bc9f256920f73555e8c
SSDEEP 96:stW052+3cib9SWffuZ8i0vhEskt2m/7qx+WVHMSm+uecJroMFHdQjuP+gs39e7MC:stW0drfmZ8pavD/S+WiTroqdhPyA7MC
TLSH
T177E1A842AE2879774CC7F6197A35BF12E2F9606221D50E99AFFD861C05E76CC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe598dde.TMP

Path C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView\Default\Preferences~RFe598dde.TMP
Size 6KB
SHA256 337215acf81467af309cc6d359dcdf0b402c7628cc77747a1dd87bac235d78f7
MD5 6b2befd2f66d0dab650de31160611acb
SHA1 fe134acc72e5bf09a806f0ba7054ad69277225e1
SHA512 29a16d30f1437805acc49f22cdb14f41239eca7aa02081c082c66eab3092ebb65a58e95bc5d5ac512868b60ab2a7fc8fc47be4a02da059f8e5c878c163439ef5
SSDEEP 96:stW052+3cib95WffuZ8i0vhEskt2m/7qx+WVHMSm+uecJzQ1idQjuP+gsV7MEB:stW0dMfmZ8pavD/S+WiTzQwdhPy7M8
TLSH
T1A2D195026F2869774CC7F7197A35BF16E3FA206261D50E99AEFD851C08D66CC230B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView\Local State
Size 1KB
SHA256 b4d82436e1ec51807536a414dcc22a8e116c83a3ce992d5c98b0740e6cfa4286
MD5 29a44a6a76b20adeb7288593b27862c4
SHA1 854a3727d3f8600b55937109aaeea1b92732e991
SHA512 e710a318f1377d318bd7606be528d2a5c83cbee792263c2e54572f8d83f72669e3fad35b90d290519bb667389a787724379c837c6450b1cdf337f3b188ee068c
TLSH
T1622165B3E4987E726D9666417201BB967E20505981105F48F6CE4B2C02977DC511AD37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView\Local State
Size 1KB
SHA256 f10ae49215260d36a98a8ee05a2e6345eab3a73973efefd6f01b22cb8c652343
MD5 ff8867fc742a5f5677b31d5a077dc9b1
SHA1 085ed225764f72dd18c293ca88df3579a3f0fa3b
SHA512 5548ceaf7e35f6edcf80852124164242f169b084f75e33cb2d7396dffc36baea4abf9c1ff8bfdcbd992e0d7c686f0fd94d885aaeaafc15aec860e4f0fffa52b6
TLSH
T1A13162F2F4947F726D96A7427241ABA3BE21101AC1505F84AACE4F2C02D77CC511AD27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView\Local State
Size 2KB
SHA256 7129687e7389928e4e0b50c6afe769bb31ceababbfd82e39029df3eea0dcee0c
MD5 d63d4572d5d70639be93ed0c9f4cd1ed
SHA1 a953f2e7474acb5dd6493533c59ceaeb5f0520b8
SHA512 3f1a3373fc70a35a822426fcb39fb92b152ffab0722bc3174820b54929ea0b46ea924331908a068cdf8fcd732d29186d79b37e74e22fce2d9b71de6ec8cfffa0
TLSH
T1FA5196B3F818BB3749E3AB5479453F22EA355055C6512F91AADE0F1C01DB69C2306C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView\Local State
Size 3KB
SHA256 bc9f09af83e3f66bcb5cda25f65d1f4adf5b795d322d0a015fff9ef24528bc7a
MD5 9fea4ef89264e7f10ca4c09d0e088e01
SHA1 cd3630a5a6e134a7834fbbb8d864a93ce5e95d82
SHA512 92ae953e89bab7047d890cc8e512f1559f73ed331d438bbc234a0798ca0cd9ee1f33ead0f1cf4c6d6bb520e763b4901ab5dd7187320f8f90fae69fb1ed23c14e
TLSH
T14B718572F968BA3B4EE3EA04B9852B16B7655027D5903F95DAED0F1C01D73D81302C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView\Local State
Size 16KB
SHA256 4658ae7fad24c8fb62c93a0c623254897c9484970c58ff3c6ab34b1edfea55a1
MD5 c62358a3c62a546657df0013a8418a3e
SHA1 c8dc4514c65a88ef5e2bcc9b884456fbcd8d3bf2
SHA512 901abea4bee9cc426ca1afd4a5b93501399dcaa08fe4f619f6e50108b69ef0f5f0fdef03f6fc6ef6e14b836a223819666f0cfa1ae01c34e334186740792c0e4f
SSDEEP 384:zM+aQikB+z/xvxjg/qhEwNba+d7r+bT9z/:H/UxvxjgC+Gd3+fF/
TLSH
T17E728E2BA5687E3769F3F6057A580B4BDBB594B290C17EA84EEE5F0D06C73D80306D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.justiceclient.launcher\EBWebView\Local State
Size 16KB
SHA256 50863ba1c905ac3f0a184519de18c3628745d968b96ba2933012a1d045198dae
MD5 d255fae6bfbd5b191235ba960cc91380
SHA1 f5ec413860dbd997e73d8682ef4f1898f9097e58
SHA512 9e0379e928da04107bb005d458c64908596305f1883248f4a438910f68b1994dbdca5046517fa187af019809455d437b06875739a56accb88f94bca8c28b0ad7
SSDEEP 384:zx+aQikB+z/xvxjg/qhEWNbD+d7r+bT9z/:I/UxvxjgC+fd3+fF/
TLSH
T1DA729D2BA5687E3765F3FA017A181B4BDBB494B290C16EA84EEE4F0D06C73D81303D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\AlternateServices.bin
Size 10KB
SHA256 b984803bbef3d90ac42f08ab38ae94b7c384aa2d355f230b5d495bea2ce72ea5
MD5 39bda6ddd47a7e3e3e2f08cf97df8ba9
SHA1 dd7ade74b95428995d6824dbdd52497a28dee7c6
SHA512 a20536f660b2679f85de9bacc8e8073c575b827fd4485b2df7c5a848f3ac8bd189e1beec2b1e696e47f8568d770c30978998b5862ec06daa5d0579b23c35fd91
SSDEEP 24:8uhMZn91Fzt9xxzF9BNzk9VvGzA9F6zM9lez/5q9F55A5dz:mHznnzv7zGBGzKYz+8zBI56dz
TLSH
T18B2250E76FB2A472F092CFB48059B16C8C33072559B99584C754D0F702D2A9AD13FFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 1f539d038f1aaa85f3e69e22a0f8abd99e972379f299158db2ed404138a59bd1
MD5 848c21e16fc62816da2f00de8a055833
SHA1 d54859dad0fec0e58e9c473dad893d33ded8b7a3
SHA512 4a6be215ae98d8d646d50822f27a34110cf81e14ba94bec651f591e2c62e5560ebbd62aa9bc74cf3ea24d2e2c5f0f9c1da213a145832085d481b440589d0decc
SSDEEP 768:6E0fwlZxpxQkBGcmhuI/iqRZL5pyWjbkbDb1bHbx:RlZxpxQBqqW
TLSH
T141D22244EB2E953FD41812BBDCA54B002F79B88A98092F573A4D646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 1de75b580bec2712caf1b502d1129c051ccd923d98b0c6383dc0bbcd35820433
MD5 b1bf17cd8661e6f4ca3976145ae37194
SHA1 ede994bb5c3bc5130b6504ec76f1c80dc6c3b42c
SHA512 187820c3df0f0e7827167c34110c9231b5c8b6af97007819e979897adf6d91c94fd396a44a62422657da6582277916a6915e2d4be874b953bec897cd113448df
SSDEEP 768:6EDfwlZxpxQkBGcmhuI/iqRZL5pyWjbkbDb1bHbx:klZxpxQBqqW
TLSH
T160D22244EB2E953FD41812BBDCA50B002F79B88A98092F573A4D646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\events\events
Size 1KB
SHA256 1c4175a72bdf01e9a23f306241c070bbb05de8ea24a17273060cc02a856e30cd
MD5 d11be3a15af296fb1e899c3d56e51324
SHA1 2a621b10c8f35023e6bb91077c876219d45e9780
SHA512 79ebd69e84b9a1c58794a047d4ca22d0d26e4966af564f8bf372a03e549a1c587ee3728f9f9e7442e1ec78bcb36c2f70a6cf407f872c591f8f79efd31e0696d1
TLSH
T110216A9C3EBA4D3EA9C7E79C7451028E57954E0A05C71C434E22FF8DCE91AD9326A438
MD5 SHA1 SHA512 TLSH

Submit Download

02343e55-e644-4786-b229-ab759b2ae57f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\02343e55-e644-4786-b229-ab759b2ae57f
Size 2KB
SHA256 b509323cbe633c8667324d9cafb86f0ea090ec01455c93dc66aa8e04a8c430c1
MD5 7deedca85a1b664c0de8a8e360e68d9c
SHA1 01cd0faef404d4292e713a6b2e4cd8e0abad9124
SHA512 4334ad9bd2336cb1c61f681dee8a7de685e33d92d40914e866516f027f6561a065d12acf9de1385b879f2ba86acc5662a468f4bd93388adafe8e3be2701067fc
TLSH
T1E741452939784C768CDAE19DD852378E13A04A4340C65D436E52DF088E97E99237A47B
MD5 SHA1 SHA512 TLSH

Submit Download

39a3a488-6a97-478d-a1be-c29fed81134f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\39a3a488-6a97-478d-a1be-c29fed81134f
Size 235B
SHA256 792c643f04941efaa03a96bf4c9c445a92372a6e47245a7bc6b32ffd3e0736ec
MD5 23fd20cf9149110bb0760715b7fd65fa
SHA1 e879c7cb032355a5554b32e6e0d5a0f64b4682b4
SHA512 215ab2428193705845b99b12b5faeb2cc0c1e10cceadba46be6cc96ce2c7f9c857226c3ea6a5cb4791ca93925dd9175436ec27e30f55e30141d2955d40eab1a0
TLSH
T197D097845888E75C48000F0BB0E029C63194EC3318796820C9A080389AFD9C801A280A
MD5 SHA1 SHA512 TLSH

Submit Download

3e5cf1d1-32a4-44a1-967b-7bac0b87a070

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\3e5cf1d1-32a4-44a1-967b-7bac0b87a070
Size 871B
SHA256 da85333e8be02592024224a596c54320c14dfa71aa9a2e65ed7b3f95bc0ca809
MD5 58a11167ef77ad3fee8dada5dbddc1ed
SHA1 1ac104d3e6753db6c08f1bda4433076b4f93cd7d
SHA512 9ba99ffeb0cd3291e4b538e9c8c933f93af50c5929cbe42754247f5437968cae20f165eb887b9601465a3670b973ef150e215ca33a3d8286e59d75888b968e5b
TLSH
T16C112381993875B2CC68D34B89657B425BF47A2380C654047DA14A240D7FA2FE7A635B
MD5 SHA1 SHA512 TLSH

Submit Download

9c220bff-b07f-4a2b-bb74-fe8c0da3e13a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\9c220bff-b07f-4a2b-bb74-fe8c0da3e13a
Size 886B
SHA256 ba4edb171c7ead4aad5fe386c68231135153dd01c74bc6588c42cc6697277894
MD5 6396fa5b15ec9d1e846f80adb5318cba
SHA1 f56079c827360754ed89dac382041e8195b48921
SHA512 84c682944ba85f8d6a5ccb0cffa05e44db65b83ca64b1d59a876724012b55a4b4f8979d266389d1d5a1f939d16d11a35956ee541745f7e090c561bca3c912ecf
TLSH
T10E1144419E7C75B1CC69D28BC4A17B4207F43523C0C50904BE915A144DBA61EA367227
MD5 SHA1 SHA512 TLSH

Submit Download

ba6a8e7f-e848-4bd7-9f32-105f351a1f17

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\ba6a8e7f-e848-4bd7-9f32-105f351a1f17
Size 235B
SHA256 f9afac91c05909fb843f6d82a979344de426683be60d7780e75239d8bbb9bbc5
MD5 5f6cff12f684ceb8bafd90b0e8e3331a
SHA1 8e233bf9d86d14f75356e95f205af8648a0aec12
SHA512 431d14eecef0c2a5d727ba2e8220f69b13946a155658206c08b71cda3dc0f1c5a4c71b2306e190287edb9aa4357395b5cb8502a925ea625f4b14a09e002177b8
TLSH
T176D09795188CB36C0C584F0BF0E039C230944C3324B59810C7910134CBF8EC5029181A
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs-1.js
Size 6KB
SHA256 02cd8d565e8860fd4b8c2c5d2ced8e994d484b3205aa3129857f516f07d5c358
MD5 68d0eefa428fd5c18984b392a675d312
SHA1 35b619d9559b0057a02e1fe1ee6accf7ef6b767f
SHA512 0ea79eee00dec39c87a32a9ba8d26484bdca1cc2e6c831a4fb88d34c7924c3e96d46e4c582cca48783207764cdb3034f88f05ad937388883f285a091d42bd3bd
SSDEEP 96:xH07wUTUzqGqvf82U/u1zSPmSSladv9jgn/5H1Bw88n8L4cnDOaGS:acORvf82U/uomSSx1Bw88M
TLSH
T1BBE12F7895088B7F64B677ACAC6889316AB2013BB7BF28C750B654C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs.js
Size 6KB
SHA256 02b7e8d08501ba81c8cc07ff9086f9890256259a86c930bdd0d3d963ceb987ab
MD5 e62afc3746c0b976b8da96ac0d6aff27
SHA1 a141c8ff2e6b54b31f0471a106cd731c659a67fa
SHA512 046cd7e043b0df049c998d932387f5ceb53de4d5f65e5b728f16f9e44713e83d54e2e4f0a6830b3b92bb4b7f6188193d9e0e3bc71a8879374f500bd3476d4c62
SSDEEP 96:xH07wUTUzqGqvf8nm1zSeSSladv9j7n/5H1Bw88n8L4cnDOT:acORvf8nmPSSO1Bw88L
TLSH
T1CBE11F7894088B7F64B676ACAC6888716AB2013B77BF28C750B654C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{b0fca0e7-cdb9-4361-b5db-54ba05077d1d}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\storage\default\https+++platform.malwarebytes.com\cache\morgue\29\{b0fca0e7-cdb9-4361-b5db-54ba05077d1d}.final
Size 4KB
SHA256 6558fffb215e304b735bd9f2fd4d767326a3479d577b13790f1848e5e304887e
MD5 270c0f868cffe40cb496341bd53495f3
SHA1 5a94548564f35efcd68646b2e34faf3ad61252e5
SHA512 0f24542d7ccdcff0a96494f78955a3b0855e2f2fa7aee68336dafa4d05e23a8d14b62eeb6aeb7db0c6ab88efc906a7b799ad50ccb240baa3fb0d7ed7a43457eb
SSDEEP 96:dQUJVAynDYuPwl0BujU6/d31b34UyyVb8iZEerXP/YW6P0iO:dpNDYqw2BuL/R1b3/yGEy3FiO
TLSH
T14BA18D21866EF6BB37A11AF89208CBC6F1746B1A8CEBCC36A0D06D26067574113F554A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.2MB
SHA256 ab0e89a7b1bba09b238d2f683ed076b6adf4b45f19968f35e8b0f5830a4278b6
MD5 5eaead3f1eebdc3e91f1e4e025b2ff20
SHA1 05ea333a80fae0bb598347415b6be8a59500de8a
SHA512 a88fd333000d1c929b803d057ccb3099ad7275d1bfea68ea8be6bcab5d9af23f0a2bbe4eaea914a39d10d273be835cdeb94bb000ddf400740f475ee3a2fc888d
SSDEEP 49152:rDmgkugQA5lUT2lANcNUazvgiRBb4CYXgN:XmpugF56T2yOUazvgirN
TLSH
T14D1639F820D1A257F3818037668563EB21AFD00C6477DD444BE966F994B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBSetup-1.1.exe

Path C:\Users\Admin\Downloads\MBSetup-1.1.exe
Size 2.8MB
SHA256 918a02c8513e819b011ea79ffb5f0a87ddcf1ab108a37efd5959c350fe0e68e4
MD5 fd8c36692bc17fd3e19e9a6c841395ac
SHA1 0127245fd627f9f1e2ef222675a9c77ee6366be5
SHA512 63c0fe6a3d384e7817871a9ff7f06170c9e7573970263d95c419da26eab08a3d4f49c05db340be93dfa22c37229ff67cff7985f52feec63174d7f18053ae1353
SSDEEP 49152:DixAMxent7Lv7ywAeyfvE0Z3R0vnxn1o2d5PF0xu:GGMxentvnAeKtEnW2XF
TLSH
T18DD59E3172918120D5B3D270297EABEB5B79BC256F76408F32DCB6390B725C09D74B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1336-215-0x00007FF9D6730000-0x00007FF9D6731000-memory.dmp

Download

memory/1336-216-0x00007FF9D69F0000-0x00007FF9D69F1000-memory.dmp

Download

memory/3984-267-0x00007FF9D77D0000-0x00007FF9D77D1000-memory.dmp

Download

memory/4832-165-0x00007FF9D77D0000-0x00007FF9D77D1000-memory.dmp

Download

memory/4832-372-0x0000022E8C110000-0x0000022E8C23A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads