phantom_stealer | 49c7caba0e93c51ed5fb1f246fc884b944d95a5ee19a3c7e9bbb43f7eed5255d

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/02/2026, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Sales Order Invoice Reconfirm bank details.exe
Size 890KB
Sample260211-fpsm3ag16g
SHA256 49c7caba0e93c51ed5fb1f246fc884b944d95a5ee19a3c7e9bbb43f7eed5255d
MD5 2b6a04fe17efacaac9cef9f251590d77
SHA1 80f276e9d632a38c8f95788c9d36bbfcb0134abf
SHA512 cf645c2f08dcc1e0471d7a3d65100ede428f15fb4fafd3694bba5bcc185fae4797702a05736c18061974cb2321f21dcfb1a578a7c60304989aad2af61198a560
SSDEEP 24576:mHO/MdQiqo48IIqWdBz6kqd43jbz1HVkMIwSqLbBYNGA:mHO/ueIqWdBGzKb0wSqp9A
TLSH
T1CA1512605752944EE0530874ACE23776E7D8AE6637AEC38277C0B59C7D2B75A4F283C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery phantom_stealer persistence spyware stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

https://api.telegram.org/bot7970721019:AAHM9KxJJMDOIuY8HXauYe-y3wAZg5o25yI/sendMessage?chat_id=7822650362

Mutex

2AJQEUI0V2DHH2TGOVIU

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
0
start_delay
1
startup
1

Signatures

Detects PhantomStealer payload 2 IoCs

resource	yara_rule
behavioral2/memory/4252-65-0x0000000000480000-0x0000000001797000-memory.dmp	family_phantomstealer
behavioral2/memory/4252-68-0x0000000000480000-0x000000000053E000-memory.dmp	family_phantomstealer

PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer
Phantom_stealer family
phantom_stealer

Executes dropped EXE 3 IoCs

pid	Process
4576	Sales Order Invoice Reconfirm bank details.exe
5380	Sales Order Invoice Reconfirm bank details.exe
5760	Sales Order Invoice Reconfirm bank details.exe

Loads dropped DLL 3 IoCs

pid	Process
4768	Sales Order Invoice Reconfirm bank details.exe
4576	Sales Order Invoice Reconfirm bank details.exe
2404	Sales Order Invoice Reconfirm bank details.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Sales Order Invoice Reconfirm bank details.exe
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Sales Order Invoice Reconfirm bank details.exe
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Sales Order Invoice Reconfirm bank details.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sales Order Invoice Reconfirm bank details = "C:\\Users\\Admin\\AppData\\Roaming\\Sales Order Invoice Reconfirm bank details.exe"	Sales Order Invoice Reconfirm bank details.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	drive.google.com
48	drive.google.com
1	drive.google.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	icanhazip.com

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
4252	Sales Order Invoice Reconfirm bank details.exe
2404	Sales Order Invoice Reconfirm bank details.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
4768	Sales Order Invoice Reconfirm bank details.exe
4252	Sales Order Invoice Reconfirm bank details.exe
4576	Sales Order Invoice Reconfirm bank details.exe
2404	Sales Order Invoice Reconfirm bank details.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sales Order Invoice Reconfirm bank details.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sales Order Invoice Reconfirm bank details.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sales Order Invoice Reconfirm bank details.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sales Order Invoice Reconfirm bank details.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3356	msedge.exe
2716	chrome.exe
2448	chrome.exe
1664	msedge.exe

Checks processor information in registry 2 TTPs 38 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Sales Order Invoice Reconfirm bank details.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Sales Order Invoice Reconfirm bank details.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134152598293845339"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-600123060-2148212387-2211176695-1000\{3A9385C8-324C-4D43-9860-F79390B981B2}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4252	Sales Order Invoice Reconfirm bank details.exe
4252	Sales Order Invoice Reconfirm bank details.exe
5924	chrome.exe
5924	chrome.exe
4252	Sales Order Invoice Reconfirm bank details.exe
4252	Sales Order Invoice Reconfirm bank details.exe
4252	Sales Order Invoice Reconfirm bank details.exe
4252	Sales Order Invoice Reconfirm bank details.exe
4252	Sales Order Invoice Reconfirm bank details.exe
4252	Sales Order Invoice Reconfirm bank details.exe
4252	Sales Order Invoice Reconfirm bank details.exe
4252	Sales Order Invoice Reconfirm bank details.exe
4252	Sales Order Invoice Reconfirm bank details.exe
3260	firefox.exe
3260	firefox.exe
3260	firefox.exe
3260	firefox.exe
3260	firefox.exe
3260	firefox.exe
3260	firefox.exe
3260	firefox.exe
3260	firefox.exe
3260	firefox.exe
3260	firefox.exe
3260	firefox.exe
3260	firefox.exe
3260	firefox.exe
3260	firefox.exe
3260	firefox.exe
4252	Sales Order Invoice Reconfirm bank details.exe
4252	Sales Order Invoice Reconfirm bank details.exe
4252	Sales Order Invoice Reconfirm bank details.exe
4252	Sales Order Invoice Reconfirm bank details.exe
4252	Sales Order Invoice Reconfirm bank details.exe
4252	Sales Order Invoice Reconfirm bank details.exe
4252	Sales Order Invoice Reconfirm bank details.exe
4252	Sales Order Invoice Reconfirm bank details.exe
4252	Sales Order Invoice Reconfirm bank details.exe
4252	Sales Order Invoice Reconfirm bank details.exe
4252	Sales Order Invoice Reconfirm bank details.exe
4252	Sales Order Invoice Reconfirm bank details.exe
4252	Sales Order Invoice Reconfirm bank details.exe
4252	Sales Order Invoice Reconfirm bank details.exe
4252	Sales Order Invoice Reconfirm bank details.exe
4252	Sales Order Invoice Reconfirm bank details.exe
4252	Sales Order Invoice Reconfirm bank details.exe
4252	Sales Order Invoice Reconfirm bank details.exe
4252	Sales Order Invoice Reconfirm bank details.exe
3248	firefox.exe
3248	firefox.exe
3248	firefox.exe
3248	firefox.exe
3248	firefox.exe
3248	firefox.exe
3248	firefox.exe
3248	firefox.exe
3248	firefox.exe
3248	firefox.exe
3248	firefox.exe
3248	firefox.exe
3248	firefox.exe
3248	firefox.exe
3248	firefox.exe
3248	firefox.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4768	Sales Order Invoice Reconfirm bank details.exe
4576	Sales Order Invoice Reconfirm bank details.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	4252	Sales Order Invoice Reconfirm bank details.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeDebugPrivilege	2404	Sales Order Invoice Reconfirm bank details.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe

Suspicious use of FindShellTrayWindow 24 IoCs

pid	Process
5924	chrome.exe
5924	chrome.exe
3992	chrmstp.exe
3260	firefox.exe
3260	firefox.exe
3260	firefox.exe
3260	firefox.exe
3260	firefox.exe
3260	firefox.exe
3260	firefox.exe
3260	firefox.exe
3332	msedge.exe
5144	msedge.exe
3248	firefox.exe
3248	firefox.exe
3248	firefox.exe
3248	firefox.exe
3248	firefox.exe
3248	firefox.exe
3248	firefox.exe
3248	firefox.exe
4716	chrome.exe
4716	chrome.exe
6392	chrmstp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3260	firefox.exe
3248	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4176	4768	Sales Order Invoice Reconfirm bank details.exe	80
PID 4768 wrote to memory of 4252	4768	Sales Order Invoice Reconfirm bank details.exe	81
PID 4768 wrote to memory of 4252	4768	Sales Order Invoice Reconfirm bank details.exe	81
PID 4252 wrote to memory of 4352	4252	Sales Order Invoice Reconfirm bank details.exe	82
PID 4252 wrote to memory of 5924	4252	Sales Order Invoice Reconfirm bank details.exe	86
PID 5924 wrote to memory of 2844	5924	chrome.exe	87
PID 5924 wrote to memory of 3648	5924	chrome.exe	88
PID 5924 wrote to memory of 2448	5924	chrome.exe	89
PID 5924 wrote to memory of 3452	5924	chrome.exe	90
PID 5924 wrote to memory of 5432	5924	chrome.exe	91
PID 5924 wrote to memory of 3980	5924	chrome.exe	92
PID 5924 wrote to memory of 2212	5924	chrome.exe	93
PID 5924 wrote to memory of 5192	5924	chrome.exe	94
PID 5924 wrote to memory of 724	5924	chrome.exe	95
PID 5924 wrote to memory of 1528	5924	chrome.exe	96
PID 4252 wrote to memory of 2844	4252	Sales Order Invoice Reconfirm bank details.exe	87
PID 4252 wrote to memory of 2844	4252	Sales Order Invoice Reconfirm bank details.exe	87
PID 4252 wrote to memory of 5924	4252	Sales Order Invoice Reconfirm bank details.exe	86
PID 4252 wrote to memory of 5924	4252	Sales Order Invoice Reconfirm bank details.exe	86
PID 5924 wrote to memory of 2772	5924	chrome.exe	97
PID 5924 wrote to memory of 5540	5924	chrome.exe	98
PID 5924 wrote to memory of 4836	5924	chrome.exe	99
PID 4252 wrote to memory of 2844	4252	Sales Order Invoice Reconfirm bank details.exe	87
PID 4252 wrote to memory of 2844	4252	Sales Order Invoice Reconfirm bank details.exe	87
PID 4252 wrote to memory of 2772	4252	Sales Order Invoice Reconfirm bank details.exe	97
PID 4252 wrote to memory of 2772	4252	Sales Order Invoice Reconfirm bank details.exe	97
PID 4252 wrote to memory of 5192	4252	Sales Order Invoice Reconfirm bank details.exe	94
PID 4252 wrote to memory of 5192	4252	Sales Order Invoice Reconfirm bank details.exe	94
PID 4252 wrote to memory of 1528	4252	Sales Order Invoice Reconfirm bank details.exe	96
PID 4252 wrote to memory of 724	4252	Sales Order Invoice Reconfirm bank details.exe	95
PID 4252 wrote to memory of 724	4252	Sales Order Invoice Reconfirm bank details.exe	95
PID 4252 wrote to memory of 4836	4252	Sales Order Invoice Reconfirm bank details.exe	99
PID 4252 wrote to memory of 4836	4252	Sales Order Invoice Reconfirm bank details.exe	99
PID 4252 wrote to memory of 3452	4252	Sales Order Invoice Reconfirm bank details.exe	90
PID 4252 wrote to memory of 3452	4252	Sales Order Invoice Reconfirm bank details.exe	90
PID 4252 wrote to memory of 2448	4252	Sales Order Invoice Reconfirm bank details.exe	89
PID 4252 wrote to memory of 2448	4252	Sales Order Invoice Reconfirm bank details.exe	89
PID 4252 wrote to memory of 3980	4252	Sales Order Invoice Reconfirm bank details.exe	92
PID 4252 wrote to memory of 3980	4252	Sales Order Invoice Reconfirm bank details.exe	92
PID 4252 wrote to memory of 3648	4252	Sales Order Invoice Reconfirm bank details.exe	88
PID 4252 wrote to memory of 3648	4252	Sales Order Invoice Reconfirm bank details.exe	88
PID 4252 wrote to memory of 5540	4252	Sales Order Invoice Reconfirm bank details.exe	98
PID 4252 wrote to memory of 5540	4252	Sales Order Invoice Reconfirm bank details.exe	98
PID 4252 wrote to memory of 2212	4252	Sales Order Invoice Reconfirm bank details.exe	93
PID 4252 wrote to memory of 2212	4252	Sales Order Invoice Reconfirm bank details.exe	93
PID 4252 wrote to memory of 5924	4252	Sales Order Invoice Reconfirm bank details.exe	86
PID 4252 wrote to memory of 5924	4252	Sales Order Invoice Reconfirm bank details.exe	86
PID 4252 wrote to memory of 2844	4252	Sales Order Invoice Reconfirm bank details.exe	87
PID 4252 wrote to memory of 2844	4252	Sales Order Invoice Reconfirm bank details.exe	87
PID 4252 wrote to memory of 2772	4252	Sales Order Invoice Reconfirm bank details.exe	97
PID 4252 wrote to memory of 2772	4252	Sales Order Invoice Reconfirm bank details.exe	97
PID 4252 wrote to memory of 5192	4252	Sales Order Invoice Reconfirm bank details.exe	94
PID 4252 wrote to memory of 5192	4252	Sales Order Invoice Reconfirm bank details.exe	94
PID 4252 wrote to memory of 1528	4252	Sales Order Invoice Reconfirm bank details.exe	96
PID 4252 wrote to memory of 1528	4252	Sales Order Invoice Reconfirm bank details.exe	96
PID 4252 wrote to memory of 724	4252	Sales Order Invoice Reconfirm bank details.exe	95
PID 4252 wrote to memory of 724	4252	Sales Order Invoice Reconfirm bank details.exe	95
PID 4252 wrote to memory of 3452	4252	Sales Order Invoice Reconfirm bank details.exe	90
PID 4252 wrote to memory of 3452	4252	Sales Order Invoice Reconfirm bank details.exe	90
PID 4252 wrote to memory of 2448	4252	Sales Order Invoice Reconfirm bank details.exe	89
PID 4252 wrote to memory of 2448	4252	Sales Order Invoice Reconfirm bank details.exe	89
PID 4252 wrote to memory of 3980	4252	Sales Order Invoice Reconfirm bank details.exe	92
PID 4252 wrote to memory of 3980	4252	Sales Order Invoice Reconfirm bank details.exe	92
PID 4252 wrote to memory of 3648	4252	Sales Order Invoice Reconfirm bank details.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Sales Order Invoice Reconfirm bank details.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Sales Order Invoice Reconfirm bank details.exe

C:\Users\Admin\AppData\Local\Temp\Sales Order Invoice Reconfirm bank details.exe
"C:\Users\Admin\AppData\Local\Temp\Sales Order Invoice Reconfirm bank details.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Users\Admin\AppData\Local\Temp\Sales Order Invoice Reconfirm bank details.exe
  "C:\Users\Admin\AppData\Local\Temp\Sales Order Invoice Reconfirm bank details.exe"
  2⤵
  PID:4176
- C:\Users\Admin\AppData\Local\Temp\Sales Order Invoice Reconfirm bank details.exe
  "C:\Users\Admin\AppData\Local\Temp\Sales Order Invoice Reconfirm bank details.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4252
- - C:\Users\Admin\AppData\Local\Temp\Sales Order Invoice Reconfirm bank details.exe
    "C:\Users\Admin\AppData\Local\Temp\Sales Order Invoice Reconfirm bank details.exe"
    3⤵
    PID:4352
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5924
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffb587bc728,0x7ffb587bc734,0x7ffb587bc740
      4⤵
      PID:2844
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1604,i,18428714716348892649,2269938681620246993,262144 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
      4⤵
      PID:3648
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --force-high-res-timeticks=disabled --metrics-shmem-handle=1912,i,11730453772636020096,16033726047340735852,524288 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:11
      4⤵
      System Time Discovery
      PID:2448
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --force-high-res-timeticks=disabled --metrics-shmem-handle=2100,i,9272242926351581510,18013676611644800454,524288 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:13
      4⤵
      PID:3452
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2916,i,4891710316439828726,3466107331274319269,2097152 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:1
      4⤵
      PID:5432
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2928,i,13929978199407241395,14037110548081748908,2097152 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:1
      4⤵
      PID:3980
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3188,i,1272595023969446574,13598346659457590427,2097152 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:1
      4⤵
      PID:2212
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3200,i,6056870124295209607,14219884439282663657,2097152 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:9
      4⤵
      PID:5192
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3832,i,12351136114120730281,15320554485006711801,2097152 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
      4⤵
      PID:724
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4128,i,8241553763446996769,369610903258709978,2097152 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:9
      4⤵
      PID:1528
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --force-high-res-timeticks=disabled --metrics-shmem-handle=4232,i,10396468735772737785,11794150608312119725,524288 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:14
      4⤵
      PID:2772
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --force-high-res-timeticks=disabled --metrics-shmem-handle=4248,i,8052544436224211912,12648380863520592727,524288 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14
      4⤵
      PID:5540
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --force-high-res-timeticks=disabled --metrics-shmem-handle=4344,i,18430251678340661405,15752018095455561069,524288 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:14
      4⤵
      PID:4836
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --force-high-res-timeticks=disabled --metrics-shmem-handle=4332,i,11338445929894117638,2632455398741285796,524288 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14
      4⤵
      PID:5876
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5212,i,5000263785021267290,2729566479129984398,2097152 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
      4⤵
      PID:5664
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5216,i,14198294789821157050,18242795465524783406,2097152 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
      4⤵
      PID:2696
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      PID:6056
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff79f1555a0,0x7ff79f1555ac,0x7ff79f1555b8
        5⤵
        Drops file in Windows directory
        
        PID:5912
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:3992
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff79f1555a0,0x7ff79f1555ac,0x7ff79f1555b8
        6⤵
        Drops file in Windows directory
        
        PID:5292
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5244,i,11322889053792592406,3332504268339941852,2097152 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
      4⤵
      PID:3068
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,2217095659268580587,13466985260383179699,524288 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
      4⤵
      PID:3172
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,5206596593631795791,2683931242441347716,524288 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
      4⤵
      PID:5656
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5540,i,15140590495755845081,492177662003773202,2097152 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:1
      4⤵
      PID:5220
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5240,i,12310038511735269572,14639947994357432940,2097152 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:1
      4⤵
      PID:2968
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,4388242994626691926,1661125887989053913,524288 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
      4⤵
      PID:2512
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,14222213398994016311,4328640582133681722,524288 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
      4⤵
      PID:5940
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5260,i,3891940877963693710,14199336433453250573,2097152 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
      4⤵
      PID:3524
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4596,i,18269896924073188403,13852648149921883959,2097152 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
      4⤵
      PID:2772
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,9816154640242086890,10377547211644173057,524288 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
      4⤵
      PID:5088
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,12943676495406270380,4008553348642390519,524288 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14
      4⤵
      PID:5848
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5596,i,10868967926140501569,15990092763438262027,2097152 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
      4⤵
      PID:4828
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=3320,i,9122725966979001229,3638544294014719653,2097152 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
      4⤵
      PID:3880
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5672,i,15316724763635593721,18059717439607974573,2097152 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:9
      4⤵
      PID:3476
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5332,i,9837908434997280958,5794736685041216281,2097152 --field-trial-handle=1908,i,8472546903716876540,1452203146725184383,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:9
      4⤵
      PID:5256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\szq2zks3.0c0"
    3⤵
    PID:4584
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\szq2zks3.0c0
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:3260
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1908 -prefsLen 27097 -prefMapHandle 1912 -prefMapSize 270279 -ipcHandle 1992 -initialChannelId {0f173b89-d43f-4453-b53a-0238cbe9ea8b} -parentPid 3260 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3260" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:4372
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2160 -prefsLen 27133 -prefMapHandle 2132 -prefMapSize 270279 -ipcHandle 2420 -initialChannelId {7a503f1d-0b14-4ae6-bc81-7c717b4aa957} -parentPid 3260 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3260" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:3032
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\46a3e8dc-5e26-4e12-aee9-b25b22618890.dmp"
        5⤵
        
        PID:4896
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2192 -prefsLen 27133 -prefMapHandle 936 -prefMapSize 270279 -ipcHandle 2668 -initialChannelId {e8dd87ac-e381-4ed4-9cdc-1d06aa08cbae} -parentPid 3260 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3260" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:1540
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\5ebfa355-ebc8-4620-9a1c-abc857f42d4f.dmp"
        5⤵
        
        PID:1452
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2668 -prefsLen 27133 -prefMapHandle 3080 -prefMapSize 270279 -ipcHandle 3352 -initialChannelId {60fd0e9a-9f45-487f-9e6c-0ee0c02270c5} -parentPid 3260 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3260" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:5644
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3872 -prefsLen 27323 -prefMapHandle 3876 -prefMapSize 270279 -jsInitHandle 3880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3888 -initialChannelId {bcabde5a-7d31-4382-8668-a855973c704e} -parentPid 3260 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3260" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:1560
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\49ef3f7e-270c-460e-a4ed-b7ef79880b42.dmp"
        5⤵
        
        PID:3884
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3448 -prefsLen 27323 -prefMapHandle 3452 -prefMapSize 270279 -ipcHandle 3440 -initialChannelId {37d6bfb2-133f-4f3e-982a-7209eb2ee924} -parentPid 3260 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3260" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:5032
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d977888d-1cc0-486e-ad9f-6dd62055dde1.dmp"
        5⤵
        
        PID:3396
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4332 -prefsLen 27323 -prefMapHandle 4336 -prefMapSize 270279 -ipcHandle 4356 -initialChannelId {38daa91a-d20c-4681-a160-22692dcb1ab5} -parentPid 3260 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3260" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 rdd
        5⤵
        
        PID:1308
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3464 -prefsLen 34822 -prefMapHandle 4560 -prefMapSize 270279 -jsInitHandle 4608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1880 -initialChannelId {435aa5de-9867-4ad5-9287-8a7608d0177e} -parentPid 3260 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3260" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:3480
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2248 -prefsLen 35010 -prefMapHandle 3872 -prefMapSize 270279 -ipcHandle 1396 -initialChannelId {3cf24141-7d3e-446e-84d4-44c300883611} -parentPid 3260 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3260" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        5⤵
        Checks processor information in registry
        
        PID:5092
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2964 -prefsLen 32900 -prefMapHandle 1880 -prefMapSize 270279 -jsInitHandle 3508 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5144 -initialChannelId {779adb9b-da39-4803-8b72-fb0291081977} -parentPid 3260 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3260" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:700
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3872 -prefsLen 32900 -prefMapHandle 2248 -prefMapSize 270279 -jsInitHandle 4328 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5168 -initialChannelId {e526229a-26e4-49de-9600-61c3d737c291} -parentPid 3260 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3260" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:3080
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5556 -prefsLen 32900 -prefMapHandle 5560 -prefMapSize 270279 -jsInitHandle 5564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5572 -initialChannelId {6a101ec3-3b55-4918-9fa7-7a336df973dc} -parentPid 3260 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3260" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:3332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ec,0x7ffb5412c188,0x7ffb5412c194,0x7ffb5412c1a0
      4⤵
      PID:3748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1560,i,5318442635779897403,9394955882805309940,262144 --field-trial-handle=2456,i,7697297722657871067,5557820659512412433,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:2
      4⤵
      PID:3152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,2390839903694917494,594485629057813296,524288 --field-trial-handle=2456,i,7697297722657871067,5557820659512412433,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:11
      4⤵
      System Time Discovery
      PID:1664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2020,i,8163650504262706907,845053757578949194,524288 --field-trial-handle=2456,i,7697297722657871067,5557820659512412433,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:13
      4⤵
      PID:2540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=2976,i,5200519273185140935,12826962008206025131,2097152 --field-trial-handle=2456,i,7697297722657871067,5557820659512412433,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:1
      4⤵
      PID:772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=2988,i,8371560261148413897,15510019057993981020,2097152 --field-trial-handle=2456,i,7697297722657871067,5557820659512412433,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:1
      4⤵
      PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,517493355040950564,16906400021390929320,524288 --field-trial-handle=2456,i,7697297722657871067,5557820659512412433,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:14
      4⤵
      PID:1028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,12387697268092676552,6810807427222412528,524288 --field-trial-handle=2456,i,7697297722657871067,5557820659512412433,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14
      4⤵
      PID:2744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,9773453571601088983,13056429511774180233,524288 --field-trial-handle=2456,i,7697297722657871067,5557820659512412433,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
      4⤵
      PID:1316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3592,i,7674436749973401416,3080013658627753653,2097152 --field-trial-handle=2456,i,7697297722657871067,5557820659512412433,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
      4⤵
      PID:488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3604,i,13607108451448468476,3399580668073637315,2097152 --field-trial-handle=2456,i,7697297722657871067,5557820659512412433,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:9
      4⤵
      PID:2452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3600,i,4184830515443755313,3579576575122339367,2097152 --field-trial-handle=2456,i,7697297722657871067,5557820659512412433,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:5072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3656,i,4996910554233694321,1090849874332266809,2097152 --field-trial-handle=2456,i,7697297722657871067,5557820659512412433,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:9
      4⤵
      PID:3140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3664,i,14956875037157610654,6350157293032462599,2097152 --field-trial-handle=2456,i,7697297722657871067,5557820659512412433,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:1
      4⤵
      PID:5112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3704,i,3346427661877734654,6663623828025348999,2097152 --field-trial-handle=2456,i,7697297722657871067,5557820659512412433,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:9
      4⤵
      PID:1660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3744,i,78219588437820263,12766991905902970617,2097152 --field-trial-handle=2456,i,7697297722657871067,5557820659512412433,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:1
      4⤵
      PID:4756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3756,i,4990594414340321492,3617069657678609159,2097152 --field-trial-handle=2456,i,7697297722657871067,5557820659512412433,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:9
      4⤵
      PID:2628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3844,i,4987949700005028369,9145897454995374503,2097152 --field-trial-handle=2456,i,7697297722657871067,5557820659512412433,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
      4⤵
      PID:232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3896,i,10939407180351285250,15460365420976782061,2097152 --field-trial-handle=2456,i,7697297722657871067,5557820659512412433,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:9
      4⤵
      PID:5976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,594876805676101931,814367495465408255,524288 --field-trial-handle=2456,i,7697297722657871067,5557820659512412433,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:14
      4⤵
      PID:3776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1052
        5⤵
        
        PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,6590598052513897177,15312843926105095912,524288 --field-trial-handle=2456,i,7697297722657871067,5557820659512412433,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
      4⤵
      PID:5456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=596
        5⤵
        
        PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,7318477012922892713,10831559249166438866,524288 --field-trial-handle=2456,i,7697297722657871067,5557820659512412433,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
      4⤵
      PID:4048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,9248420037615319927,15410144254608776221,524288 --field-trial-handle=2456,i,7697297722657871067,5557820659512412433,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
      4⤵
      PID:2252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,13809252346164100115,6098041461397280028,524288 --field-trial-handle=2456,i,7697297722657871067,5557820659512412433,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:14
      4⤵
      PID:5444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,11182755121951763607,9067127081946272355,524288 --field-trial-handle=2456,i,7697297722657871067,5557820659512412433,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
      4⤵
      PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffb5412c188,0x7ffb5412c194,0x7ffb5412c1a0
      4⤵
      PID:4372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1604,i,7477089349967288272,10705220389370014220,262144 --field-trial-handle=2380,i,14580034476148846247,7926056248580701237,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
      4⤵
      PID:660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,14946096862975948951,10986524331134057179,524288 --field-trial-handle=2380,i,14580034476148846247,7926056248580701237,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:11
      4⤵
      System Time Discovery
      PID:3356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2144,i,4031695574603369402,13369528747732616467,524288 --field-trial-handle=2380,i,14580034476148846247,7926056248580701237,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:13
      4⤵
      PID:4792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3120,i,14514595284307530188,8295491105006540491,2097152 --field-trial-handle=2380,i,14580034476148846247,7926056248580701237,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
      4⤵
      PID:5352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3124,i,15538774179489176304,9967365633491669669,2097152 --field-trial-handle=2380,i,14580034476148846247,7926056248580701237,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:1
      4⤵
      PID:5708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,6857535069536484380,1697685549697758936,524288 --field-trial-handle=2380,i,14580034476148846247,7926056248580701237,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:14
      4⤵
      PID:1648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,1806616406354795910,128880969014980973,524288 --field-trial-handle=2380,i,14580034476148846247,7926056248580701237,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14
      4⤵
      PID:5920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,17735183535375935653,9576800045393980643,524288 --field-trial-handle=2380,i,14580034476148846247,7926056248580701237,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:14
      4⤵
      PID:5964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3636,i,11134235685155483470,7015761523300259688,2097152 --field-trial-handle=2380,i,14580034476148846247,7926056248580701237,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:1
      4⤵
      PID:5040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3656,i,7161999369998306451,12299400906147573750,2097152 --field-trial-handle=2380,i,14580034476148846247,7926056248580701237,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:9
      4⤵
      PID:5296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3696,i,2890337163979305671,10131303012235654632,2097152 --field-trial-handle=2380,i,14580034476148846247,7926056248580701237,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:1
      4⤵
      PID:5748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3756,i,10009040614197852787,17315862077941110051,2097152 --field-trial-handle=2380,i,14580034476148846247,7926056248580701237,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:9
      4⤵
      PID:5508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3784,i,8665719068046710633,10068166704236588832,2097152 --field-trial-handle=2380,i,14580034476148846247,7926056248580701237,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:1
      4⤵
      PID:3760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3764,i,5204518419828291747,4551623769322943384,2097152 --field-trial-handle=2380,i,14580034476148846247,7926056248580701237,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:9
      4⤵
      PID:5372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3820,i,1173669274537385436,3385548675415413512,2097152 --field-trial-handle=2380,i,14580034476148846247,7926056248580701237,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:1
      4⤵
      PID:3312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3824,i,3195912834252233410,7794535676366110967,2097152 --field-trial-handle=2380,i,14580034476148846247,7926056248580701237,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:9
      4⤵
      PID:3280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3856,i,5287752613775208531,16755856109310917174,2097152 --field-trial-handle=2380,i,14580034476148846247,7926056248580701237,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:1
      4⤵
      PID:4632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3916,i,16296299485142980693,15215508198573563183,2097152 --field-trial-handle=2380,i,14580034476148846247,7926056248580701237,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:9
      4⤵
      PID:4604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,9945997491804314371,8624198256196406291,524288 --field-trial-handle=2380,i,14580034476148846247,7926056248580701237,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:14
      4⤵
      PID:228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1100
        5⤵
        
        PID:4524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,9353435276274114115,1725124609716783405,524288 --field-trial-handle=2380,i,14580034476148846247,7926056248580701237,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
      4⤵
      PID:4652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=592
        5⤵
        
        PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,7044143286098385209,12567511212293438401,524288 --field-trial-handle=2380,i,14580034476148846247,7926056248580701237,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
      4⤵
      PID:3312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,7578000199690439019,198004598351939058,524288 --field-trial-handle=2380,i,14580034476148846247,7926056248580701237,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14
      4⤵
      PID:3788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,6326755374089333764,9443484004735278739,524288 --field-trial-handle=2380,i,14580034476148846247,7926056248580701237,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
      4⤵
      PID:2820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,10863921494061800626,3350129209373154328,524288 --field-trial-handle=2380,i,14580034476148846247,7926056248580701237,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:14
      4⤵
      PID:1824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,10472764087805114882,12222000801909534915,524288 --field-trial-handle=2380,i,14580034476148846247,7926056248580701237,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
      4⤵
      PID:3448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,10472764087805114882,12222000801909534915,524288 --field-trial-handle=2380,i,14580034476148846247,7926056248580701237,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
      4⤵
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,13913830039732640852,10272439030866619329,524288 --field-trial-handle=2380,i,14580034476148846247,7926056248580701237,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
      4⤵
      PID:4976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,11574524447915404384,6490386212705872559,524288 --field-trial-handle=2380,i,14580034476148846247,7926056248580701237,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      PID:3880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x228,0x22c,0x230,0x224,0x234,0x7ff70d6104c8,0x7ff70d6104d4,0x7ff70d6104e0
        5⤵
        Drops file in Windows directory
        
        PID:4036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ya2pkwzj.yjq"
    3⤵
    PID:3224
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ya2pkwzj.yjq
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:3248
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270331 -ipcHandle 2024 -initialChannelId {acf2f29c-c462-4470-970f-a5cf64ee8b0f} -parentPid 3248 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3248" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:1648
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2104 -prefsLen 27133 -prefMapHandle 2020 -prefMapSize 270331 -ipcHandle 2328 -initialChannelId {2249f745-be6f-4938-98e2-be5273a58532} -parentPid 3248 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3248" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:652
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\901ba774-9a03-44c8-bbc5-9057aeceb00b.dmp"
        5⤵
        
        PID:3924
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2228 -prefsLen 27133 -prefMapHandle 2708 -prefMapSize 270331 -ipcHandle 2716 -initialChannelId {5d854fe8-936b-42b4-835d-a1de8afdc83f} -parentPid 3248 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3248" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:1604
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\df595844-2a7a-46d0-98ab-76d64db494ee.dmp"
        5⤵
        
        PID:5760
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2228 -prefsLen 27133 -prefMapHandle 2932 -prefMapSize 270331 -ipcHandle 2884 -initialChannelId {e1f6ee97-c0b3-4503-9ef4-5bc212a596e8} -parentPid 3248 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3248" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:5996
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\16c70e4c-d5e3-4807-a793-ad82a01bcb48.dmp"
        5⤵
        
        PID:2940
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2928 -prefsLen 27198 -prefMapHandle 3416 -prefMapSize 270331 -ipcHandle 3104 -initialChannelId {1a6694c7-8c2a-4024-b1d2-31c71f9c3e2d} -parentPid 3248 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3248" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:5336
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3628 -prefsLen 27274 -prefMapHandle 3632 -prefMapSize 270331 -jsInitHandle 3636 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2744 -initialChannelId {b5adba3e-c2c6-4a06-b3ff-84961ec5e389} -parentPid 3248 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3248" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:4052
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0df6c8f4-7b41-47f4-9c36-d66766645e30.dmp"
        5⤵
        
        PID:3500
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3468 -prefsLen 27274 -prefMapHandle 3964 -prefMapSize 270331 -ipcHandle 3848 -initialChannelId {902a661e-18a3-4d4c-864b-02654c844574} -parentPid 3248 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3248" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:4760
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\44e09542-1ac8-4110-867a-bdfad9e21058.dmp"
        5⤵
        
        PID:1072
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4132 -prefsLen 27274 -prefMapHandle 4136 -prefMapSize 270331 -ipcHandle 3624 -initialChannelId {5bf1d0cf-d15b-42cd-8d5e-ba57d57e859e} -parentPid 3248 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3248" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:5460
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2104 -prefsLen 34827 -prefMapHandle 2588 -prefMapSize 270331 -jsInitHandle 2632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3224 -initialChannelId {3b932cc4-3431-476b-bc4e-82e7b124c175} -parentPid 3248 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3248" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:5312
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 892 -prefsLen 34876 -prefMapHandle 3408 -prefMapSize 270331 -ipcHandle 2612 -initialChannelId {676d743f-1f18-4535-b030-f821cb97a17d} -parentPid 3248 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3248" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:6668
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4992 -prefsLen 32766 -prefMapHandle 4996 -prefMapSize 270331 -jsInitHandle 5000 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4840 -initialChannelId {3fabcde1-591c-4608-b761-6372b1ba7805} -parentPid 3248 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3248" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:6716
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5232 -prefsLen 32766 -prefMapHandle 5236 -prefMapSize 270331 -jsInitHandle 5240 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5248 -initialChannelId {1bd038da-8412-48bd-b3b2-72e91b17e584} -parentPid 3248 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3248" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:6724
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5264 -prefsLen 32766 -prefMapHandle 5268 -prefMapSize 270331 -jsInitHandle 5272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5280 -initialChannelId {c80f4fe5-d5f3-4758-9c1e-9be909cddd86} -parentPid 3248 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3248" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:6732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gleeemtv.rgt"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:4716
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\gleeemtv.rgt /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\gleeemtv.rgt\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\gleeemtv.rgt --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffb5414c728,0x7ffb5414c734,0x7ffb5414c740
      4⤵
      PID:4968
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gleeemtv.rgt" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1616,i,8951138057079510834,11004697877677543545,262144 --field-trial-handle=2448,i,16964495954085760495,3993031786788088158,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:2
      4⤵
      PID:2180
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gleeemtv.rgt" --force-high-res-timeticks=disabled --metrics-shmem-handle=1808,i,15344331781298047944,12019320890996636594,524288 --field-trial-handle=2448,i,16964495954085760495,3993031786788088158,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:11
      4⤵
      System Time Discovery
      PID:2716
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gleeemtv.rgt" --force-high-res-timeticks=disabled --metrics-shmem-handle=2060,i,7109697920746120230,3891084183538646205,524288 --field-trial-handle=2448,i,16964495954085760495,3993031786788088158,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:13
      4⤵
      PID:4864
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gleeemtv.rgt" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2896,i,10099777436460708175,11672383904023442049,2097152 --field-trial-handle=2448,i,16964495954085760495,3993031786788088158,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:1
      4⤵
      PID:1632
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gleeemtv.rgt" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2900,i,17151934841537782398,6677025902419747370,2097152 --field-trial-handle=2448,i,16964495954085760495,3993031786788088158,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:1
      4⤵
      PID:2568
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gleeemtv.rgt" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3092,i,7634286646648540455,3165514393606285146,2097152 --field-trial-handle=2448,i,16964495954085760495,3993031786788088158,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:1
      4⤵
      PID:1264
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gleeemtv.rgt" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3120,i,13275001486733678880,582374837513293651,2097152 --field-trial-handle=2448,i,16964495954085760495,3993031786788088158,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:9
      4⤵
      PID:2340
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gleeemtv.rgt" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3988,i,1800487876029065260,3926338252248386433,2097152 --field-trial-handle=2448,i,16964495954085760495,3993031786788088158,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:1
      4⤵
      PID:6348
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gleeemtv.rgt" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4100,i,18123422516770290582,17820725783309005051,2097152 --field-trial-handle=2448,i,16964495954085760495,3993031786788088158,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:9
      4⤵
      PID:6496
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gleeemtv.rgt" --force-high-res-timeticks=disabled --metrics-shmem-handle=4480,i,2372215967906187749,15953899501934424561,524288 --field-trial-handle=2448,i,16964495954085760495,3993031786788088158,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:14
      4⤵
      PID:6992
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gleeemtv.rgt" --force-high-res-timeticks=disabled --metrics-shmem-handle=4516,i,13941083324852635165,17445084432287310318,524288 --field-trial-handle=2448,i,16964495954085760495,3993031786788088158,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14
      4⤵
      PID:7164
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gleeemtv.rgt" --force-high-res-timeticks=disabled --metrics-shmem-handle=4588,i,12249225992254392743,17749434169647953260,524288 --field-trial-handle=2448,i,16964495954085760495,3993031786788088158,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:14
      4⤵
      PID:6828
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gleeemtv.rgt" --force-high-res-timeticks=disabled --metrics-shmem-handle=4516,i,15506520969639393224,17753989090671975404,524288 --field-trial-handle=2448,i,16964495954085760495,3993031786788088158,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:14
      4⤵
      PID:3268
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gleeemtv.rgt" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4084,i,8836748473080182526,7806785954393365440,2097152 --field-trial-handle=2448,i,16964495954085760495,3993031786788088158,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
      4⤵
      PID:648
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gleeemtv.rgt" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4580,i,7738609935195845119,2810019496411581128,2097152 --field-trial-handle=2448,i,16964495954085760495,3993031786788088158,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
      4⤵
      PID:6856
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      PID:1736
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff79f1555a0,0x7ff79f1555ac,0x7ff79f1555b8
        5⤵
        Drops file in Windows directory
        
        PID:6324
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:6392
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x248,0x24c,0x250,0x220,0x254,0x7ff79f1555a0,0x7ff79f1555ac,0x7ff79f1555b8
        6⤵
        Drops file in Windows directory
        
        PID:6412

C:\Users\Admin\AppData\Roaming\Sales Order Invoice Reconfirm bank details.exe
"C:\Users\Admin\AppData\Roaming\Sales Order Invoice Reconfirm bank details.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
PID:4576
- C:\Users\Admin\AppData\Roaming\Sales Order Invoice Reconfirm bank details.exe
  "C:\Users\Admin\AppData\Roaming\Sales Order Invoice Reconfirm bank details.exe"
  2⤵
  - Executes dropped EXE
  PID:5380
- C:\Users\Admin\AppData\Roaming\Sales Order Invoice Reconfirm bank details.exe
  "C:\Users\Admin\AppData\Roaming\Sales Order Invoice Reconfirm bank details.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2404
- - C:\Users\Admin\AppData\Roaming\Sales Order Invoice Reconfirm bank details.exe
    "C:\Users\Admin\AppData\Roaming\Sales Order Invoice Reconfirm bank details.exe"
    3⤵
    - Executes dropped EXE
    PID:5760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\activity-stream.contile.json
Size 5KB
SHA256 656f8f050c1808c3b48c5542d62e8cb18afb55ced3c18894e55e9bad6586aa2b
MD5 2e7b5d7a7457fc2aad5150fc70a378e4
SHA1 42022b7170f0bafda59365721b34851a54cdcbe6
SHA512 c4f1ef049f10e158646293bdefe2c7164e69389f7d6d95dd7d303f210153f897db3016048b12dbbd8d02c994c62ea7251f01a3212772fbb5f9f483aceae05580
SSDEEP 96:KUCt8t+JQh+IrVws8d9Poa718DlgydjE+bmpy1ganBl:KxCt+JQhUdCqilNdjrYy1ganBl
TLSH
T1E0B118EFDCA690971B2397E1784F339DB14365E3DDE9CA4DAA898C00F6A6152C1DF240
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 fc9bca0d0da727d0a026e5617f728a6a9fbc87328a1fcaee5b17aab568e8ac2f
MD5 162f1e0115de21b61c42803a61a4b4bf
SHA1 28c438debddaa6ebb4fdcc7f3cd0a98946dff33b
SHA512 89a70320f9d7df4b8385f81c2a0c24cefb26d1e1fe62a1d194956d570556d973d05727ebf4cca14df22a1eb02ca0b8d9fbcfb993286dc42069f6104279029e27
SSDEEP 1536:qBkrLfZJ6269Rg6NKW2peA9ldD9MymzRuxWBNYs:qEJ6267zNKW2peK/D6ymcxWBNT
TLSH
T1A173F8A3A7E9B1BB1F9126CB2C4B755B12E20196E38605CCECECC95C91CD794123E5EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 8619c6bd4c159e0cae0dfc009286f9db9cf780650bc5683eed0b7af9866faee6
MD5 c3ee978b18b39961c43567962692f91f
SHA1 d9aac10f65006b117561d97d56df9e0fbde0541f
SHA512 422f8fec0493146b377fa4979402e94a0b946717c79b399cdda53d77d20bb0ce346d2cc402cc96f1753551d248f349a6fb0d0652ef98350389bcf92a94efaadc
SSDEEP 3072:j3lB6D/tTg5ANwPK/h5DOxZUdpPsqdJX+HQOx5:p49g+6YDOqPTOP
TLSH
T198A3BFFADFA38E3C55FFD02D5A82893EFD262400B3A72019C963671061C6FB467B5649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4\Crashpad\settings.dat
Size 280B
SHA256 40dbb9cb615679ff23f86885af6bfdabc312f357f73e73bb365097d971c089e3
MD5 c978ae860a597658331af6abac0c7a85
SHA1 4fd4838895f04558a852ff31592cb1e8b4125def
SHA512 7227b41e5a1c06e7b56d1baaad04c799115b1fb72b0af4781d84c15773c826c83ba3e8e9af383e7fa9ebabd48fb6cb9d76c99254d041eeff91eef1c8c7fb64ab
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4\Default\Cache\Cache_Data\f_000001
Size 34KB
SHA256 8c97e1a3437f857eb8a346a360274ea339a09eda1b965ee1445d870c09b066ca
MD5 4227139d34ecd3be139bf6c7d75fce5b
SHA1 0e984113aa96daf31d002392523ad0dfc9cc3870
SHA512 bdb38f430aa623a17b26044288841a07c82691ee858325b158423839fad99a75b192fe0df269898cd76e22a7e54250611f852ccb763ce82db2f7d1c4eb6fcb52
SSDEEP 768:iFPCuSWxAknP3gQlE3brX+48360GKKAC4FZ8ELh/SAE9gnmlV:iFPCuSonPJErr18ZGKK1oLQH95
TLSH
T108F2F19E3208478D3E6CC638A9C912E24EAB58D8CE3DC702B21DC24FA25C5590D9ACCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4\Default\Cache\Cache_Data\f_000002
Size 99KB
SHA256 cad25cfcc108f11e81cf1a339916e956b5ccd3ab3da38a3bd7a3a7a01adcd3f4
MD5 86e9c0ad8befdb46f1ecda1d3f2c70ad
SHA1 cf9520c235db04ac02e98a7f7c9f3d5d631d4199
SHA512 30a1265891f03df0c46d4f310d97ffa312b84d485a214d895a1c5e260474260d6637592b20d9cf4efa507c131694f63253577fdb352e8e0c46505e02183e0ab4
SSDEEP 1536:GAqrSnLU5BxYE4bP9zel9rbvjJvNCLtY25wJ0qPKldrT6LTMyT2ItH3RHTZ:GAqrSLSvYEwsVbrTfUPdqL4S2iTZ
TLSH
T1AFA312D04BFD43FAB569BAC3256ED48352C0B330AF12B835501ACD9F61D0FBAAC65265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4\Default\Cache\Cache_Data\f_000003
Size 398KB
SHA256 fd76862c97b705fb707e399403bec74908611962725a9fdd045ced791d52b451
MD5 16edb0d500887b483158ecc23e18c5b9
SHA1 84bc63ee7d48299e990d1750fbb81c48d12e75d8
SHA512 86b7df8e1dfa334da138bbcdf8b6b09772baf1d4d68e1cb9d2ecf96bd0ce824dbae59fcc12329034174023aa67de1ebb5cf10897fe8851add4adf9dc81284179
SSDEEP 12288:SEn1A90rWRLMU02ho39as/B/17BtfRLtoDRr1tfPM:SkoaSLT02ho7117Bt5L6Z8
TLSH
T1A59423B5FF2B8AAEB8247D5640B7529BB6814896343FD145869FE481093DC633F0D0BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4\Default\Cache\Cache_Data\f_000004
Size 65KB
SHA256 592138220d7cca92f5e65162f1ea2153b4ad6e76358f1d7744cb2aa1e7fe057c
MD5 8b3bb000f5a5a3d6ac4afd891c8e85ee
SHA1 8f74662d1067d8258bd875a515fb682aa956192b
SHA512 2c00b47f8fa22779cd259b1f4e3c5f8d957715b9cfe080e79364b54a972401bf07c60e7602655cca3d012d8b4206223228007a2bdca557a0c557dd588ff24f55
SSDEEP 1536:jN/ltBpUEEgeWdv7ayaxw7Pot33zW4zR+omVsbEK38CJhIm:jN/lPpUEEGz4tTvbVxqm
TLSH
T1BF63026053514AB4102632A2E39D93E7E5FCFF25BC5AA3E077590130D2BE353D9692E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4\Default\Cache\Cache_Data\f_00000a
Size 16KB
SHA256 b5670eb14c87ca5f37cfebb76973c2b2c2d8178ad281743c9668f611f484da2f
MD5 4d95a85e51068dc16de34e66e28ce5fa
SHA1 cd8cfb75bf9ecdc54dd5b9a3b3b220cf8de43598
SHA512 9eec3ea5c1011787b74107595a552a902b3f2cc795c507695e83aa46c51bb8619acefbc656aa4ef42e8d5bb79530442d9b329f02044d612ff1ff9992b4ca0ecd
SSDEEP 384:h2yryxUrrjoMfpALcXkhl1EvBbqZmeTRShK9O5M/gnlT:jWx++LAkhl1KFuks9p4n5
TLSH
T18072E1EA7A51AD55718F543F1FD278B95636848CE0F80C4F10CBA3AD297B14BB8E450E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4\Default\Cache\Cache_Data\f_00000b
Size 28KB
SHA256 b421c05a340e40d4d4bd1831521268b6f0afd0461ec3991cfa8d5314bf3207b4
MD5 57f9a7c7e2be49102533a2ceb7a05e51
SHA1 850ab0a80577b7f7effe196cba037899e71594c5
SHA512 66406d54a1d1a44f30e19a9bff1242b50fdcfbf66c33e4c23daaa756c06f50a2e39c991e7a8dfd9a81184cc37c2062d0406070be132e28a22307896e63b55447
SSDEEP 768:dT+CJ4QL+F8S4bApn9Ua0ndjCaixJ/fVW2/AGYnS:TJ45F8SgjXnNCa4fVWVnS
TLSH
T19BD2F1FF1E208D43082F37459DDE71D688A00325635BAE3964A09F59DD9BCBC8D90B38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4\Default\Cache\Cache_Data\f_00000c
Size 76KB
SHA256 656eba7785e941d6b94f244ae3aa3424e0d0f91b40f086ff5066bef4ad1b25e5
MD5 7477a1f7bcd49e503f3f8444a85be49b
SHA1 59741f34c3bb0053a23e1cec1a977c5600a4a99e
SHA512 abad2ec901fcac1708c4dabfcf23af6baaee7691159bb3282fd1df73722c55f62ed645c57cd75c98de9bfe9f48da65e630ff041530dffba4e14c221d5e994e1b
SSDEEP 1536:/Fj767HugBqjhE7XswQ4T1DjQ1kaslpdYXVDpcMazp+oAaA:/6Lc+hQ45STslD6Mp+XaA
TLSH
T11F7302222EB72294E1978CD958DB4CEE252B9C4471DBA3DB9FF1761C3B482B2A25105C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4\Default\Cache\Cache_Data\f_00000e
Size 18KB
SHA256 de075146129de8c15359b736cbd0ba784f85444f371cb847bba940fb29be059a
MD5 46012c4ff2173da4f28054c2d8737193
SHA1 c4e6769423aab7cd509b19c997e6bd7f07ae82b9
SHA512 75de30a72192237722376b5e0a6019e13d9d72277071b46465e8e3ad1965244abde88f31d3b4177f980d382f68f1cdf82017904310ec18b8fdc73d1935d3bdae
SSDEEP 384:86fXLuEUxff3cM2WxLo2n9Nb/iUa8FcEts23MpPNuN8Z0U2iBtV:vbrUxfYWxZ+UcU7Mu6ZiiDV
TLSH
T1C182E11F2A6C675DF7041C1BFABCE5198E699B22C9CB58F54C07D76CF01138AD986384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4\Default\Cache\Cache_Data\f_00000f
Size 56KB
SHA256 d18ff28d3b8ef4b09db0a9114bc5405d125533f0dfb34ccc8e66adb6b243a9bf
MD5 6d1e0ed99d449bead1a182620afc923d
SHA1 329a32659325c4e276a4544f5f758967a40558f5
SHA512 885a9cd777619e7edda41f56b41906745479d4dc3a9b40dfcac02b99ce8885259a4ef7e8fd1d6941b9a57d01e5de4c4da8915f6917fc0dd4d3dd38d09a0d69cc
SSDEEP 768:aFhjCnrN2ax+lBhi4dagMi78jEvJCBvHZaFxIOwixuRDjJv7ZfMONOVVJsr/ZFvs:drwaA7gti75M47txkJ1UjTKrTBhHpc9d
TLSH
T1074302F89BD4519E0B18BA39FBD46CF15EAD0C94085FF9F5893A8658828F1A04C2E147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4\Default\Cache\Cache_Data\f_000015
Size 70KB
SHA256 5aa5077bee1af4ae42f8db34de59c3bc3d055ec042567dd258c47b09a7f2e182
MD5 4b2e957186f9509e157dc4585e7cd3a8
SHA1 050d2a621e15e4b217640814695d67a47504e582
SHA512 8c2cb16a5f0aa7e29e6c76bf1eefeeb34d7bffcfe198ae8dc9057dcffae80f4ab3c634131b0405ca89daceb63f2298659ce9e81364a80735496737cb8f442064
SSDEEP 1536:OLLeANJOzz6WHPUziIwJySA38Nu7pSbyI6ruF0:BgJozHhy+oSbyIBF0
TLSH
T1CD6312604389FAB382FDD7DCD5BE36032D684371615C26F6F1F310A6F1A85693CA05A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4\Default\Cache\Cache_Data\f_00001a
Size 20KB
SHA256 1f30f6e4a04bf06e44652e6097f61f0b88306065d997071d4b1371714e74f750
MD5 7034b4d3fc6dff0f256905153284db86
SHA1 a3040579ca770fa918ad4a001083eae0cff39922
SHA512 d708070ad0d1213eb4fc23c9e3a5dd39d33194ce85ed8bba7a24f769b77c25b4183806442a8232341bce5ddb077d52952b3d626f1935378023fe052f3126254e
SSDEEP 384:s9yLgGfxPqJUV0R1Myjp+oY6TDlHZEZTb7Ip+cl5FlhafZaPKilumtA1gOxBqbI:s9yHPqJUV2oT68F3IpZFlhmZ8TtAXcbI
TLSH
T10992E16673DCEACFF53EEEB1C754B624421DC96A742D488906C3DC436B5CA0AC60AC97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4\Default\Cache\Cache_Data\f_00001d
Size 34KB
SHA256 94f2c2cd4460be396d0305eb10d9759436653327d98ab98b087e50111689d887
MD5 3efb218913f6c023178e50eb90ef712e
SHA1 38f2f22c7b029dcc284c6490c2297d6e2356045e
SHA512 b9d44b51f1cad3d47b5cf856a444d9925bc9cd8e3d9f20620927c36f4f7a99c59f2b6bc832f85d12b90e0a4b509a2b8dbb3029515cca693f737077ac66643874
SSDEEP 768:4muGOkl9oqvcsu4/g8xbB4bXiNykr3S1x/JpzV8MPpOr:4mXdoacI/PKIySGJV14r
TLSH
T122F2F18F70732C8C52CA9DA689A9F6E99F2D4D4EE1CD439F27D25536D20305CCA6F081
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001f

Path C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4\Default\Cache\Cache_Data\f_00001f
Size 16KB
SHA256 ea5b658e470a98a8628375ec4a700938330e9c0cb45d08e4b89e5698b200f2df
MD5 9628ed30a3cb6f6ca5ec1faa75b3d9be
SHA1 696611cb9d9cfa5f2ccccfb6f4cdc1a816bfc908
SHA512 8fa833b989f417cd0c780963e01e1db654c03adcca85ce0231857c07042052db3fc563f9abdf3047ec7b2fef099b2e70e699464041bda55ca0778ce4ed9c28bf
SSDEEP 384:FfktxDpLOpGRWSVKzyxNl31A0vH/56J8L52FRTL+2QC:9ktZp6wRpKkl3fpeiyR/+y
TLSH
T1A272D0429E1B0F29D3607209C36574DF15F99A6B0AD9A0B4CF6DC43C8807AB76D7B239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002e

Path C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4\Default\Cache\Cache_Data\f_00002e
Size 42KB
SHA256 b25770a70102c1a0b37ff3faf085c06694cb4d8dead7a8127aa3f0ebd8b73c47
MD5 7ae14f90c7657455368f7c6e122ed293
SHA1 89de73e25c3ae6e7b1e459af05072ceadfad49ac
SHA512 6ebb9f9edd5033b522e8b807dd5f38a77408d306e8e3247d8634cc54c3912b1f32c90d13636709a3de3a2e0c10a40f93efba0fffdac8247d5873fcd4a3fd7db5
SSDEEP 768:j3mqTjm/J3TSIQzKJIS9Kmy09ixbY3t+5Fmw86CwT7lvxrAM068G:j3/HGJ3VQzKWTKNt+5NPzR1AH68G
TLSH
T14813F1B01AD718B64048FBC1E21D968CEDE78EBCCD6758420D6C5507B48EE6FC9A18B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000035

Path C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4\Default\Cache\Cache_Data\f_000035
Size 18KB
SHA256 5b9504241f5a0610adbea9f4db60cf5325fe512acf4487815b578e22b2c20da5
MD5 8ab57b7f9443aeb71e79850e4dc0bc3f
SHA1 d4ade2081092668623aa45704d0f549402cb0c52
SHA512 cbe4d47d1db0486950866efb120fed73f0da0892fcda8b45e3080f63c532058bfffc29528945044112009ec8e84878d7794f2a520f4f890b464e844d6ad2e8bd
SSDEEP 384:l4sp+IwX2m1v2Stn1FH9QhUg/3DAhlmyh/GWaM5pmN97Zyeisi:l3p+IwvhtnnH9L8GJbXDmN97ZyD
TLSH
T17B82D00B84745D0D4457D7F8ECCF519AD398BE10BA99704A2C0D5C463209FFAAB2AEBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 233bd7893dba41e0e0f593fa8686bc9116c309972e983eaaa2b7396a1d3b55b8
MD5 1f7579a58713048fb37bffa5a1576336
SHA1 c8b2590b58533b739c43cad20c683d154ea48043
SHA512 4ce5292cc5844878cb29d5540672218023f217f068ebfebe445b28080da7f8e75ffe555624f90efc7d0055af67111672783f9d3e24ebd76739b90e832326ae3d
TLSH
T19ED02BE71CDF04209DBF47E7543145D140227C689F45EC8A101D758B64702257566CA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 ba26df15e59f20a4a116d94de2310272ec83598f1b5e1bcb8d298dc429e35daa
MD5 d65836b60613f98785628d1ba7a9a6d7
SHA1 a4088f7c6edb65c841c0ac88742e43e247f22b29
SHA512 f0c68ced4c740dffe4d44fe515462c09881d0f9ddd923c03533559395545d290e26e4d361cc4ce3f9e0425763296d4d885a42bf6b6f21fe786da0718995cedeb
TLSH
T110E0D8B61EEB1814ED7F87D7647154950015BC988904AC8E146AB2876571315615ACB2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58bb8b.TMP

Path C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe58bb8b.TMP
Size 153B
SHA256 ed8226cb15a4b4feb42bcc5a8bf3e5031baafc1a253b33edce0a25c8893dc4c8
MD5 bee1d62194f348dd8cae1d1a80cd21c8
SHA1 5abc0281542ebb20875d531543cc5c9e06fd8087
SHA512 cf5dcaaec97f474011d9d507189d0cbefc97673369fd726077474d365e3b24d31c84c4edbb8878ff64842c731189704d25cd874a74cfc95959416981e61b9fad
TLSH
T1E5C08CB70D9A08008EAA12C7003196E181262C984A48EDCA001E708370302223212C61
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 114692b3477c97a2c612c8aafce678e68fbcf435f3a3b7023177a0fb01596a1c
MD5 bf70f03e95e7ccbe22a8b2db148b2b4f
SHA1 190e89122ebf5a1a177d1afdf1c7d62f7e56284e
SHA512 d2690f6210ed20b16e4a62558e4940df7aab583dd12fdaaeb545290348ecf48dbeea9f3be30a6771e1e35d2600f0d34c0838a1aec87ce3eda6e5e8c123e23184
TLSH
T109214C226F3E82002C7D358ACAF4875746427163B114A63A7FB88166DA66F406DFE8C9
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4\Local State
Size 4KB
SHA256 53b08739d56e9eb94d4388f007d17de086a52a5cc4503f0a81ba573fb2efcc76
MD5 58cea7ba4dfb59eb68b8a91752b4ad88
SHA1 2224d01245e097a0026ff03cc96bbf8d4c013f8b
SHA512 e9974210e12fc083705d79c36877c2b4743d03e864824f11be7489f3dd7f21165c1e1671a9edce10d325e6f21b847afbf83b7ffc3d0f5ca72efcd7566a90eaac
SSDEEP 96:LqGNkKsFfSa8tPA1gbTDSBQPQvGjybN0eUnxzCq4a:OGNJLa8sUyCDybNqxL
TLSH
T19381B672A924EC7359E56644789E3AD35E7871B3DC51EF4CE6D8930800EB78D2B0DC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4\Local State
Size 5KB
SHA256 723a25e310021b141858fc0a5119825c5a5a0658bbf5f1c40a79f690e7aa3449
MD5 edda76d7bc83bc64688d370ca91e7db2
SHA1 813a059bf8c8956720fc7ee007236ac57d7348ed
SHA512 2821f319e6e5a0c447d638f746c00366d0fa654df8fbd019066f9cec064c4cd40968b96d70161dec0b618f12d6ad2b9b6e5ba659f45b00c8a9cdab9126d8073a
SSDEEP 96:LqGNkRQsFfSa8tPA58Frh/cInURoDotovn66DZBQPQvGjybN0eUnxzCq4a:OGNxLa85ooDUw5/CDybNqxL
TLSH
T1B9B1B6726934EC631DE1A90478CA37926EA83177EC95BF8CE6E84A0C00E73C9270DC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58af75.TMP

Path C:\Users\Admin\AppData\Local\Temp\1qpwitka.br4\Local State~RFe58af75.TMP
Size 1KB
SHA256 da243b5426bc5dd426b8867d2231e3f92d87b43db0648376618aefe34285c938
MD5 2646749886a2b5a0f59ec0b43cd40199
SHA1 9625475fe6f259aa0f7d94d1e1d9573dd8bc9838
SHA512 714d357fa7555b61aeacf7dd8a60ccbc533e7285465c66106d29cca0958d8af814ac1f630660eb577f55176f6a9363b97ad1c7a5759bb1a5ed126e388f18e0df
TLSH
T1F1318873BD646CB3BCE16205654D7BD72E38717590659D4C66EC890C00E7ACD620DC3A
MD5 SHA1 SHA512 TLSH

Submit Download

57fd1057-4c96-4227-9464-63e037310d85.tmp

Path C:\Users\Admin\AppData\Local\Temp\57fd1057-4c96-4227-9464-63e037310d85.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

9b1bea69-9095-4869-9492-fd3de53a673f.tmp

Path C:\Users\Admin\AppData\Local\Temp\9b1bea69-9095-4869-9492-fd3de53a673f.tmp
Size 145KB
SHA256 88fd3339202fdf79ed79bfe483fcc57f322156f40cd75c47ee78efc5b203893a
MD5 fabbe8fb069e32ff7d1048cdd8871e5e
SHA1 d065636701c0c71037f44df340f4fa10c32e5ace
SHA512 8e0dc40c6afdf5bf250da1d401d9abcaf06db0577e0ad3b0ba15adc1600433dd5c354fcf54806554cfde8c1872d6a066c17313cc6da273c7b6e6b1d9d7e6d270
SSDEEP 3072:f1/GuTrhcnKXFmnvTtb44wLWklhluSMCRqVph3Wvlf9XXo:9/p5OKXcnJc4MrHRCpQVXXo
TLSH
T151E3D06C6FEACC26D51754797E54F0CBDB064F2F460A672F210A841C9A70A8D0BE19FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c4c79290-9353-4d0a-af58-740cc9f3d333.tmp

Path C:\Users\Admin\AppData\Local\Temp\c4c79290-9353-4d0a-af58-740cc9f3d333.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\gleeemtv.rgt\Default\Web Applications\Temp\scoped_dir4716_1341118264\Icons\128.png
Size 2KB
SHA256 3a45652c64d2a35cad427fc4541ab36ac42f11425f2d996edc38a6498d98bae8
MD5 306472d164006935bf98edcf0cd28837
SHA1 f2ad2740a46607728c5444ccf2a93a774bb300ea
SHA512 51547f18c6518d60ebb1aeca780bc1b9fa85f444a5abe60ba6b0f34d64f4006ae01c24128284e02e7b9e1d96c7111f3c8c597a1e74f2a29fe4ad6c139f0123de
TLSH
T1FF41C7998B466878F215E305C0493E7E79B2BD1A1C13E05A21B040430DA9BD55FEB61C
MD5 SHA1 SHA512 TLSH

Submit Download

192.png

Path C:\Users\Admin\AppData\Local\Temp\gleeemtv.rgt\Default\Web Applications\Temp\scoped_dir4716_1341118264\Icons\192.png
Size 1KB
SHA256 56b7a8100c9fd352d2c25b6a9c9a05b47950cf5f84d07ab014a0b7cd2850e5a5
MD5 51429005fa10fb2c81fe734e74695d0e
SHA1 9dad5c509e3ad1ab8b1d0ff911600a83b62e3aff
SHA512 999fbbfb741ad6499e617e1e637e014099a49e9a5374314e59f6f145cd19f9dcf3e131b4fd6c622f9293033dab91392b0665ca0d567af2c34d20ce255495a04f
TLSH
T1172178BF93B5D1F3DCC2CB03D640509CD80F762B7D6843C5DCA018A986B9D45AAB88A6
MD5 SHA1 SHA512 TLSH

Submit Download

256.png

Path C:\Users\Admin\AppData\Local\Temp\gleeemtv.rgt\Default\Web Applications\Temp\scoped_dir4716_1341118264\Icons\256.png
Size 4KB
SHA256 55d89ccdc27b413cc831f5496b0caf3ec390bc19270ec3294a5d2d38dec42c24
MD5 b3d7fffa6ed9b6dd37f5d2cdb077f22e
SHA1 cb2e013c3d6b7c35eb09170ce884da4fb480e1e6
SHA512 473db4b410a9fd56fa1289ec8314f908ee221977b2d32b5abfe1ad628e60addbc23e3b06f7fdd104d6a2e3076f992c65696ffe1ecc75d553e094a57869df04a8
SSDEEP 96:miJQW62M8GG901ZveUmX2KJ2tra+NO6+K6teIp5f:zJ/901ReUmNJ2tm+NO6ibf
TLSH
T16BA13A8E47A0DC8B8551A3BA1AFAA4E07A30983063F2133576F640EB742D523A309B75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96.png

Path C:\Users\Admin\AppData\Local\Temp\gleeemtv.rgt\Default\Web Applications\Temp\scoped_dir4716_1341118264\Icons\96.png
Size 1KB
SHA256 84a6d2571ed487aec05288f204c16ef239a740d2dfb105bf781c6708b938cf00
MD5 f674dfc82d3ab385e234cc05c89081b3
SHA1 dbdeda809b10a5df7da5b2a2dd12acdb7dc7d427
SHA512 56ad6146a5bd339fdcbd4d66cdfa8144c1eccc7db57a4f790e536fc97291ebd6b13dc5bc6b12c114e72054f87f3372e1cd0c4d6f11eec998e7d3fab008613046
TLSH
T1FE31DA5B19CA9ED15BCC933BE32401336A28845C4F1115890CD6B0AA59D5DB5F63C2BB
MD5 SHA1 SHA512 TLSH

Submit Download

192.png

Path C:\Users\Admin\AppData\Local\Temp\gleeemtv.rgt\Default\Web Applications\Temp\scoped_dir4716_1826902754\Icons\192.png
Size 2KB
SHA256 e401220b69a76a298b2e081a5424af69791a4caa3936af85d8862c05f4ced4a8
MD5 e063d7ac57fed2391e778c3a5817bfed
SHA1 3fddfdcf2917af9ce0e86eddb03725d4a3cdd7cc
SHA512 0de76ca2917cb2162d73a3d61d83dab2795ef1e9ca0f057091cef9eb79c0064dcd13c4749521163e6f77dfe43e0afa68326a32b7c19d8524da509dfbf4f1cb7b
TLSH
T11651060A0759BDB22A31C07991B8D9E7DE0C1003A5BBDD7E19954FF0A913CE43B23681
MD5 SHA1 SHA512 TLSH

Submit Download

256.png

Path C:\Users\Admin\AppData\Local\Temp\gleeemtv.rgt\Default\Web Applications\Temp\scoped_dir4716_1826902754\Icons\256.png
Size 12KB
SHA256 6e8f581f4cee7f8f8af4a9e1059f0d3088b792de7045067d74254e2a6f1f9a6b
MD5 493ff5acf7b11c3f1147a8d9e25e7751
SHA1 6009b5d4c6cf66b4dea48b5c558fb9dfee261c4b
SHA512 684256b0a9d8169eb1c177068c0c04518dc1c1a6c2554c32beedcaf0bb4429902319ecb32d8c97671ba361de6e10e9275e8ef778f61934f38538f35b60a963bb
SSDEEP 192:Hlx0S8vKsNbVmc/vC0+e9JaSyw2X4RTv+ovsCF3vKY8XejYHvhX2kol0f993M:T0vdNbQ72iNXX6rsCFyYAZkh8LM
TLSH
T19A42BFA1B310ED73E30AEF2045FE64B0516C82217FE4A507D331D85ABF0FC9998A95A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96.png

Path C:\Users\Admin\AppData\Local\Temp\gleeemtv.rgt\Default\Web Applications\Temp\scoped_dir4716_1826902754\Icons\96.png
Size 3KB
SHA256 00f563fcf365eb53a4037624ab3783dd6e19d2c6689c9892aa30ad2b16577848
MD5 43400a5061af952e87a0e06e1062b272
SHA1 5b937e80e93bb5f526a964e2a28aa9579e8dccb6
SHA512 8f3f25039af799f055ea81a2008530562b4b24e8afd65b65566b6dd0cdcc66f3735bf0428bb3c4eaf7079ce15499de3846bcdfc1db0707db50e9f3bc2c5e7d6d
TLSH
T14F819F6325E9E9CAAA5ED62071224074845F04EF59313775F07C18BB13CA56DFD70E26
MD5 SHA1 SHA512 TLSH

Submit Download

b05c7100-b2bb-48c4-a879-fdf63cd9d174.tmp

Path C:\Users\Admin\AppData\Local\Temp\gleeemtv.rgt\Default\b05c7100-b2bb-48c4-a879-fdf63cd9d174.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.100.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.100.1_0\service_worker_bin_prod.js
Size 119KB
SHA256 dbc4678e51e79bf4ff3133568e2cb425ab0757aa3c62a9f5df976ba9c01973c6
MD5 0b1499f3fe47f316a96f57238009d253
SHA1 017ef3ccecd691cc1773f477ce5f6ec340798d82
SHA512 7c1b70e4f2bdec5fe4ce573f8bebcd7a7b2a3f975e6e4942240e887c15dd001957ce9be726b8a4b3d730b08194240081de989bd3073819a483258532d75d7246
SSDEEP 3072:HAYGntD+6KcN6TNOEE+ucAQhPbkIWgn2Rp:HuCCN6x1ZbkIWJp
TLSH
T11DC3E8CDB7A57462436365F5002F000FB23AB8AAE44C85A8F188D9E97DB446D8377F79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Preferences
Size 12KB
SHA256 98e185a9ea0dc76a468b7e8d68a2249a893af54579d64a221280afa52ae51145
MD5 0b2cb6bb13d716a0e0bb77a447b8c598
SHA1 051480ddf7fffb9129a82d6c8bcd3e2e70048e98
SHA512 cc9f73d3f1bcb8406ac5b84210ed5f56baabf6cf9305e321eda1a115f376973e1546496c0fc2b1935538bfb789aa7346a5bed0a0fdb7b27987c6fb1384f6e67d
SSDEEP 192:kRNBet/uv7GCpAPRp2JXsb+WNn+62eHTNQFKaV9yiyIsnAUge:kRNBU/KCCUXmXwL2qTScke
TLSH
T1A042C62EBE58B97B4CCAD21AFA393B93E6F9103524802D48E6F8C91C05D76CDB11B457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe587337.TMP

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Preferences~RFe587337.TMP
Size 3KB
SHA256 48c6e656f7a09cf3b2c88dc819a4ce19d9b18ff44a979f814f2b370f48a0d57c
MD5 c062415e4a97f8196330ff7a5b7d2997
SHA1 6d75d7b7fdf41e19c21038935ff15e5605cc8acf
SHA512 821c9c51d346fe4d3839fe5be065c4e87d6bbaa5cc02bbfed604a93d2f5767178a3da218667908c1b9aa6093c4d914849067da9470d699d222b8ac105f16da30
TLSH
T19261506AC0E49CE70CF1737A786E1382FE52477B15001C157A7E68CC4FB29AB9084F6A
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png
Size 1KB
SHA256 bff3a19327fd09a24c1aa4e7f34c508d7e668a8eb32f2cc7c33bcaa7e9ee2319
MD5 2f1881da261cfaea89605ee7a5e33e40
SHA1 fe61ed428aa3636adcfbeb66162f43f0ee091d25
SHA512 a9d8a4172c83030bf4472e900540b2ef3bbbb5e565c39f278cb8aae355354f063a4723c5ed8c3b32dcea45c70903271d170e56879a096b169697fc28dc768494
TLSH
T1FC413B2333F81ABFD81CD69BE465C8A50F395483DA39060706031CE8116343B19DDAF9
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png
Size 2KB
SHA256 afbfdd55b59a6385a28bfe27ef81ffae07f9d77b8c073dc299c6060b5d964a89
MD5 4d5d17c7e7c06b887bb383077131f50e
SHA1 8b29cf29af8358672e31bee5472025b7b07e7df8
SHA512 ccb20424ba2566e11a359bd04cbcb54bc21947bc254f4939c334f7db8c784a1da35461f60a1fc559ab5bde5cda443c82b633b8cc5bda89f5019b391148050be3
TLSH
T179515DED0389C698FB6F764206866917621D39F824EC51E09AE816A3EB101AC1CC1FD2
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png
Size 3KB
SHA256 02bd0f5d045eb5247e576d8151da19d36dc0eee7746c9a426d4dc92ee83125c8
MD5 aceb6eccca82014c9472e49e8b4b6eb4
SHA1 91d2c703fe33ea1867dd3d87b760aa2e5e68a55a
SHA512 b18d0edf51fb6245dc730b5aca21601dc40c762d6c3d96c950b38312406bce16fe7165e786bd0d6ee106d95c90139094bfc4fca08b0f37eb88c086606821ade4
TLSH
T111814D53467373A8BC788965CBCDD0EA8D732D594E4244F884CAD93429D54049825BDF
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png
Size 1KB
SHA256 97bbe02ee0327548d5b3bf2b6f00b507ca4425425e04f95e072b3617b3e4e6bd
MD5 398cdbfaa7de9f8a3931365e364d27f4
SHA1 ed1a3d000aca1e13108f0c0dc68235e444126d5c
SHA512 998dc6d33b867dedf26dd9e773e37038c697407b5d0600e9fbff01a9d30e50c004b9ca00e5ff4f13a18bfe4cdd7669e23a28b8c547c8cfa2fff1fe323506f092
TLSH
T13F3107848DBA44924EC31A70239760AA3C18F91EE235D48A109ACF527B063099BDFE51
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png
Size 2KB
SHA256 444572dc6fc2eb8f1a880711379a0ec4a80d041549fad959fb5678b4c0b08689
MD5 ae3b722b45c677f2b47afa1d9f0fc94f
SHA1 609c3dc27cb90e805157537c673e6b4e7a6c3d96
SHA512 7cd894c041a3c7530698931a93639ed7fd9131aaf1bfeaadc6d29867f5b0a49e101dd0b1572eb113a465d5adfc497f872617cc8c51270d08227f9981db71d19e
TLSH
T1F6516C2378FA9142C8345043D0EFADAD71FF52D3C74A451B31E64020ACAFAE121A139E
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png
Size 3KB
SHA256 bc6ae87a22ff2fe7feca2cb3f83aaebc8f02ad707cda77b51dab26bc9c5be710
MD5 ca441c15198089107955d8c8e5635b7d
SHA1 fc8403f74ead7b83017b9ef45c909576cacf2ddf
SHA512 2db07cb52541df66ebe059d1ada731315f87f0c46b553e72370c006ed313d8d754d8fd15ae317258fee0bc0bc13724219a5de9db8400e81193e4b4ffcfc01abe
TLSH
T158817B01730F99818D289BA9733E44F1526A3C04820775368035BAFA85D2DF618EFE03
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png
Size 1KB
SHA256 23fb4d1613fb426612119928a7222ca84a9cba4ba081a8b1be7f2565c013c590
MD5 520121a67f0bdc7a327bd49d50090dac
SHA1 648e3fbcbbffa431fd2480edf0a342b6920fb3b5
SHA512 36a89b73c4de9d9ef98becbbd31f286014163617063600ed22779e1e87ac35cbfb8341f9e4300994352570b1223719256c0d698dfa4aeb38e7d3907927a79a92
TLSH
T12D11E5B643275C67A2B3011708E03ABC8D605898F02B4A9C90148799360BBAAA4ED3DD
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png
Size 1KB
SHA256 7b1aa50219251762867246b79677fac99c1b61a4ef4e471ae3473c10ada2c50b
MD5 c633806d580f67b98743782c74dde9fa
SHA1 8acb5f35cd7ee2e7d3174ce06d399d46dd275ccf
SHA512 04cbe1571369525f4aab0b2a9fddbb425e9a935d9307d3b4fd2623899644e15419d0f7e0d33372a46442778043c03448e8130d892b4978aedbbcc0a785eaa9e7
TLSH
T1A9210BF662715F4EC79B05AC1FC14A676310122D665033AC5C2594047E4BCE78DB4D17
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png
Size 1KB
SHA256 2a560cdee5965876269d30cf82a85b83aeac16903d4f325209ca3354b971c25b
MD5 310d0edac146f7ce3e4394c066348637
SHA1 b1f1be49560ccb7007700fdf86a5121eb99eaffb
SHA512 1db1aebc30d4912eb9f3474476a2ca3683d078e3e141fbb7964402d01cc5fa5c2e24a1af7b4fad2f19b731d4b26ec9616f5406bf84d66d164a716e9084921156
TLSH
T19C3187F0F47B2D96DF75AD3427028960E6559E962D93DC109D482EE94B0C70981CE163
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 ccefdc2d816137b5954b591e8954c392e0cf27388fef2e437991e3999d9ad3d8
MD5 efa437b6fe5031994d5917a91c19990f
SHA1 d46a1115227ead4e92346b600c28e9ac72cce96f
SHA512 ab52261f15a3f21728b41b4765da5ec6c9e71051b720204ee2decf6f09ac8a0c9a5c12313d921f232f1e698a7425d34415eca8db21a37f423535806bcdf238bb
TLSH
T1F3310AC7644047BA52EDDAF37F6B0C57DC12210107D4A440599F56E17FEEEC86015478
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 bff87e21fa845d8ce3c266db6d904e9c7a3bf9fc2b95a1f1a5ca375f3fdb045a
MD5 097f67b0d583db3f8487ac27379c7eae
SHA1 18acf62fb9bc4e95899c4597cd72de66b6bef763
SHA512 0b6b323fa14e5b0dd6bb87fce791bbd0b7a867988d8332385ba76a35d93d4dd5b67f6be9be5a69fbdcd5da68c30bc840712daa83b9a0187b727d963dc9a9a045
TLSH
T15E514C54BEF34CB2EBC67C7254E65BF5A564C1E62D407A0C86B9CA1245BDD410CCD003
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 3KB
SHA256 abe4eaa1a6fa423bcef61b423dc72386a9cf1968b1041de5270c56a7780254ad
MD5 8e589c60e0ba95ca1b178bad0a8298db
SHA1 d981cd3f9eb63636471e3bd4c0fd7585460ad6fd
SHA512 e8c7b5d340e698f3b1b42d6c3b7653b666e0add095611c00f502782928eb788070ca977b54b42f9515127861e55138a3cc0f02540f0bc2e44694fb0ea595ee34
TLSH
T196517D1B4B8AC56A0E53770E02E57ED454996C569EF383CC2106E7C0081A99F43EBBE7
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png
Size 952B
SHA256 e566796c18517e7084e3a892b3291cc189b85e7830800503c256998ab697a507
MD5 bf7aa030f9cbc7aba123d10adb3ab321
SHA1 d210f3194a494a65d1e32ade703e24fbbef7b444
SHA512 3be8123811222e1d5aa92e7144d41a8ace20ea1d5b082aa51d11df8f573c17f294ead72ee9e94b31259035ebd0eecb904686cf4bb22f0e5313a02756e210b8a6
TLSH
T1E311889E6EAA8CBDD1C3AE4FBD2D22904F13CE54C534BA1B4C4759573A26E54704B501
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png
Size 1KB
SHA256 6a379d8e9545ee7885dcff4c53f1ca553dc9fb0cbaa18a0c71c0b75c8883d044
MD5 c053b2219c4c9e7e7080cbe4e6e3981e
SHA1 0470cf45babbbe1fad32b4dec3593e8ab7a8ac39
SHA512 1271ac3ef670f3b7104c3f4e678ef4bc9990d9427826b104bfa8d31f904895da50ed0f1b673727d39355428f6270d015c0953521b26d8f10f842854b79ec5525
TLSH
T1E021B7BE5B25DE1B97EEA61F72DA9900D89221E27183A6052ECFCB6057145A33C24172
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png
Size 1KB
SHA256 3772d9c9a6fabba60ac0c7b9c93bf230e3c99ebac9af480efc6c778d9881dd85
MD5 cf9a569f60db18903e86e6612cf90efc
SHA1 379dccdc92399b0e4e658ad8f04276bf99501836
SHA512 58f0b5130318069511452b11b1fbdfd898577c714150f5f88a4a4ff80320b33c287c103e464ef24c8543d90de71713f2ee293f538fb078ec2099f9871cef2caa
TLSH
T132210853AFCF4AAE5834129F565C460FFBA3623E2952D409DB2A41AB08CDC14E8462C3
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\32.png
Size 1KB
SHA256 06c00fa3cb29713aa4317b352fc1e1e035c0c7720a42f107cf758fbb21eaed0c
MD5 247675501d3cf1f7987fe8e20dc4a994
SHA1 c0630fbc0c9c7c2aec627667b21b5b9add1d7925
SHA512 6b6f5e0feb15ecde82191178df36fcf9cebb762289116b88a466ab31152d6f8e769e97252e3a41f7f538867920866ce12bd60c9c87fbb5019783de0c5158bfd8
TLSH
T1C721DB9786803C5AE71F76BD5402AE9BF92060197254970E1A560A15C93C5D3FD873A0
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\48.png
Size 1KB
SHA256 bebe7c8f23573efeedb8259fd9e866662dfad2c8e974d2715bb5aebdac870f6d
MD5 93f26885517b76f003062053ad718275
SHA1 eb97bbd3de38ad8efd87e112ad76d6a6d78ffda9
SHA512 34f8a81113a9ca950a07c5f5c3511e3f11f8f9e9a2a1040872015064e2146154d4eb31b33d8ee291434535881f82685c0e90c52e76ea731ecafde73771595520
TLSH
T10031F95284AF0C128406F5E5CD57910B7F37ACBA9AC2A589023B7E7A105824D7B6C449
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\64.png
Size 2KB
SHA256 f5fcedc00655f8a9b63b379feb04ef904a64328e9ef79e7a411de5139d398ebe
MD5 18b13f82a338cf91ce3ec3ad9702622f
SHA1 403a48626de0cb33ddea61e6de7c895eb7482bca
SHA512 08a6fac277ffdbbc18c5166032b426e7d8a7856f7dd03ab01938000b28a869d80476017164a6728643ae8908616c574fddd8fabf946bd66b841ef13f5906969b
TLSH
T1F7413AD73E887CDDACB22A746A6175C1F0E846B24687DF44E60D6918CF61C43001638C
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png
Size 960B
SHA256 c6fa451ecd1a8a9533801028bc70cf82ef48eba11bb835e53e6c530b43018938
MD5 8fc407c5a96f560cfbb46503741dd11f
SHA1 31eb59362b3c99abd75bdf605bdf46d793ef99b9
SHA512 7ed6d7c679ab5928427095beef9ae476e8bc57a5c81cb633bce1b646a896557b5b49112d489b2112ac2749e1adaf6b1a7544be36c570696fff80725352eac68a
TLSH
T1BC11CC5290BD5338C4D16953E04223E10E566CFCE4EE91366B8FC80D893EA5D9CCC621
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png
Size 1KB
SHA256 3fc8b8392989fb26381f0a14bb356cae5f998a4dde004c06a51e974034f9ccfa
MD5 b75ce0c6ffcbdcc1066a2e6c8c3aa5fc
SHA1 2ca49f0080b985a68692eee2582298a9353c7916
SHA512 a3ac3a8cb7de26b7e4fa126497dcc228462b04da9a99a0b4647c1d8f877131f6597af80c3d7e834b50938a6c1349ccb14e9e0dd0b06673fa789d78e3e499bf7d
TLSH
T15C2196C3239DF6E5E54D50A745CF1B12F7BF375829B4A058A08E42C502B77C192CA534
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png
Size 1KB
SHA256 f6ff978b0f4c0d28e96b27b6242565480a73615b03a4b95640f8d20136fc2a91
MD5 518326c327ce412aff2d0f63700b372e
SHA1 24b69d3fb978c36bd349b516cbb5720addcac515
SHA512 fa4c22a9c51cb75ef04984ac10ee068fc9d262b7cc2f969f537784bd71240359cb3c34d9789b043f43e7109e7028b17da50074cba2b8759ea31e5ef2898b0707
TLSH
T16E21E79532856E7C8FA21F4BE0642A1DF2761D0423258DA603B12CF10CE040829AD2A1
MD5 SHA1 SHA512 TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Default\Web Applications\Temp\scoped_dir5924_1931946456\Icons\128.png
Size 5KB
SHA256 63be4dfbc222f0c026579113af9aa7dea61e78a166ab9af053b46c1e172240ff
MD5 9cafc16ce8040254ec411cc5a8f954f2
SHA1 0d9841be48e134edf43c7ef970d24ddf852d155e
SHA512 aa1e0ac8d0647ee6c0b481e671b20fc68ff253dc72748b2aaf22f15bd8decd2b9723b16f8cd4c19d9a250abaa8d517101bad6ebfed7fd3a90ceefce02c1b3b75
SSDEEP 96:ALdfTPsPOWpgaNHQxO20qtLppvSFLtGaoFuPhQd1YDzpsE60tkuuAaw:m16NHQgoLjvSVtY2h6CDzpsErVu0
TLSH
T119C17E55555D711FD09D157110AF4A0F31A7E2AAC3785720C97E1BD0F88DE4603A3EB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Local State
Size 90KB
SHA256 622e9fcfa76cd50f3f96886b3a625b3b2a516113320edc02c26699cbc6300312
MD5 f817599e13bed07b03cb2c7ab304e526
SHA1 f8bd0986fe6781d5029ac8605c90eab5a3cb8208
SHA512 c1b8a85c53826599f9435d5f987dd78e442d64894b2f69834e9d45789f3295f2c5f49f296a5f7b21aad13f27784fb17e89376ad457cbcaaf9a72a32f917515da
SSDEEP 1536:mVCQsjPF3c7b7GD5bHM/L0LbadJAsKr0IMZOMRahmCSCD9U2z:muPdcrGFMALSJPKr7MZOTOk9Z
TLSH
T17993127359C80CEF0BA84247724EBC0A5A681DDBBA5C36F4CCD3A54DE850BE58E4E5D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe587318.TMP

Path C:\Users\Admin\AppData\Local\Temp\noaq2l2y.ise\Local State~RFe587318.TMP
Size 1KB
SHA256 73e40e83aa7b3d041f157acbe8151047477ce29905f37e822c8efc4f77930378
MD5 9b54edba5dc0f018001ff85bb78814b6
SHA1 d869abd923c9f3262bbb7b7e0143fa6791dc4df4
SHA512 483fcbde1b4ebdb4249caa1a200331a53586340b7e780937dce3c56177831a35f29defc33a52ee601dc067e466c74531b971c5bec79eab3e8a71777ac6af442b
TLSH
T1D91186723578A7F0BCC58A4CEB02DF920D7E223FC052CA0839C908040A5B6DC7A0EE35
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsaF86C.tmp\System.dll
Size 11KB
SHA256 c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
MD5 9625d5b1754bc4ff29281d415d27a0fd
SHA1 80e85afc5cccd4c0a3775edbb90595a1a59f5ce0
SHA512 dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
SSDEEP 192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
TLSH
T1BD325D06235081F3E1914138846B3E175F6A15069BF58E97DFD38646BE30BE7BD79503
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59e6ec3e-b926-4ab9-a046-5baaaddefe5d.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5144_1787292693\59e6ec3e-b926-4ab9-a046-5baaaddefe5d.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5924_844017738\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr\Crashpad\settings.dat
Size 280B
SHA256 55c849280c2822f00d97f2b4b5e54bbed96eae335d37f9a13c70fa6054634a2b
MD5 55172e273a42cf5272a6235cea8c39c1
SHA1 d3199d76c283505a3ba2cf05aa7a601476ef7dbc
SHA512 7a990710892cb104985c46e4a423ea2592cda09222ead6206b85dc33bb1aa6258ccf0f6100d1f63b4c5b5feb689e4f51cff864a0d2bed4ff68eb972ac2d70e1b
TLSH
T1ACD01122B3038020C808A0322CA2EA08000CAC300220A2A0002200C0ACAC882C20AA00
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 478B
SHA256 0ae1251f6056f9548946bf972df2da2bf6cfd1b0a35164bf29422bd3f62df94c
MD5 1e7d8b0fe3caebbf2503d00e5e641afb
SHA1 bf7c331a851a7c63e5a33a64c6ab3ec7e0ec08e5
SHA512 5a66de8dc21884ac968b4a098a80f720d3bcab34d11717d1e46f9e8e80031d2d185cb6fe353cac5cba044d57d785af970c060bc2e7c44c5271fb2445043625c8
TLSH
T157F027772DFB1924FA6FD7E214B150A400557C588D64EC9F251AF6A710B12542099C22
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 256B
SHA256 f7af2af0e9a7c5c68d512672a9f67306afab803b5e32a39241353897fad9a210
MD5 9a70797257922af088b53b78b3f8e895
SHA1 1e4205db8c1fefcaa859375e499ff5eb3cbf0baa
SHA512 1708fae823d6ae637f48b2bf5c75f0e0afb13d5b478750dda26946758b314cfd84a300b6300474a011217dffeb3fab6c506cbe4841e1ea1622c3d4fc2d0f3d68
TLSH
T138D0A7BB2EFE0814FBAFE6E6007114A942673C844CA0DC5E741EB5D76071331645AC62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 382B
SHA256 3e6602f8c8ad9938a874e737682b59a6ff2dad31c3721a91f5ec8eb131a10d07
MD5 1ae93ed9ddd55a7b6227f8347f19c7f7
SHA1 e53af82ef62f770e6a086a6bad3f51a2f67fb12a
SHA512 9c62264704529f05de3a4228b431963c702000145a664b9f4659e0b7e68af6b9a58625dca473fa56e2d3e8a6b4ddecb58c1ba9833a9cd63481d92ac52fc3fc38
TLSH
T1B0E0C0771EFF0814FEBFE7E314B110A400423C588C54EC9E251972D310B0325208AC62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58a2f2.TMP

Path C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe58a2f2.TMP
Size 156B
SHA256 a63d0737469dafe5acd1d1fa26c3fcc4f34bc26c4c41962f1bcde43b93ff1e55
MD5 ae1ffef6203100a6327b9c1fa22c71c1
SHA1 836a87493b76c82bdcb13252e6c6a84447e8f63d
SHA512 465d8778d3211fdf21bfd4af64632fb4620a58314930f392e4b529137806cadc61ad9ad39f6600d9adf8cb7d8f3a699f766ae9f76b45571f997cd0bccf945559
TLSH
T10EC08CB72A6D0814FACAC2C200321498463B3C884CA19C4A201E74836031121A01AC21
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr\Local State
Size 3KB
SHA256 b07e5c130c29e124001dbaf45e4fd00c2af42bf2166bab18ec7f41707df728f5
MD5 1928c688ecc312ec88d56cfb275f12c4
SHA1 37b56de5e86927af56becf9e358a61db2f57e8ee
SHA512 97fa0c51609d6c73a2dd8472cfd29dc8b81307d04d7b397f69de6c7daf9797e714459f8f235b4570a3dd8ae02a4256c5c681562580d82d57cc3308854d80dab3
TLSH
T18081A3727428FC3348E55945B88A3A939E3870B3EC02EF48E5C8531804EB64C3B0EC27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr\Local State
Size 4KB
SHA256 7a9285150718b9c62d6d7d15ee8794acc544220895375f3b7497131ee3b35396
MD5 893b66ccf0058136d2e0c006382f3028
SHA1 3c349f5ff2f1f48ae06bdf99bafd622ed692e90e
SHA512 31d753b8c81fff90e38a6f7dabf46ac31745af0d7e4abbeb7cb198fa17b7d8a68ebbe061acc4706da5cbba087503fce767615beee16a5249cbb100f6f78e0b24
SSDEEP 96:9qGNk2QsFfSSwy58Frh/cInURoDotovtRhDxBMOOvYC+h3K0eUncRxHq4a:0GNKLBooDUwjRHn93Kqco
TLSH
T13EA1A4726578FC274DE5A905B88A3B93AEA47073E845EF4CE5D8170C04E7388274AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe589611.TMP

Path C:\Users\Admin\AppData\Local\Temp\wxgtv4q3.upr\Local State~RFe589611.TMP
Size 1KB
SHA256 44704fe7e73b1a6af0022fa6288f6db6c33b1e458c23a41e91fba9879ea6ba7d
MD5 6d57b90bd109b5ba3515c306af2fd402
SHA1 bd4c87004934d57408c5b149c0208a1e65bddc91
SHA512 4dc89e121941c485c7cac414276fb513ff9e247652440ed57de067944439d74ddf6537fdae43c68758d9bb92084c428447f037c694d4615fb171abc7d713f66b
TLSH
T11331B5B1B5A87C73ACA14603B50EBF571E34B532D0129A4829CC431C14F758CB609C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Continuers.sne

Path C:\Users\Admin\AppData\Roaming\Forkldning0\Continuers.sne
Size 372KB
SHA256 751cf5646a1073a6fc0f9c27162d8646de6eae55f3d3e291cc67938ece945987
MD5 aeebb776e8add3deb4e667d1673d3754
SHA1 ea1228d49010401a7f7cb89920ced82ee8fdd4f6
SHA512 3d6700f6cbef45f61c78643adaf7aa39ea3ac8e88c315850cddb74ddc6a44eb4a52d563e93b5c47a320ed8a66b6c2ac44b3ec39bd6391a681bace2b2b39a82ae
SSDEEP 192:T665cw+VGUrxWpcauPSgy47yo7j2Lwm9K8XXEQt47nhyhITiBwNWbIFXaupYhcni:TpC4bqhB7yACJK8djqeWdHYSLDHI
TLSH
T1B184CF440AEB6F88C29655999CBB70A68D5908FBDCE06B06CF3585D80156F99C093AAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gaardene.inn

Path C:\Users\Admin\AppData\Roaming\Forkldning0\Gaardene.inn
Size 224KB
SHA256 f530d65c3b3e5fcb0e6fb025e9f906c36cbefc894c8cd821a8991a0060bcf751
MD5 792703ab9f0b04baa96f4e57baa3fb01
SHA1 8ca1a3814acdda72ce052bc8de12f09576eeadf7
SHA512 687cc2d613e57899418282b7468f7fae24a0c7cfb13bf83da82157ecd9bdc46017d45883b533fcff6f7532df25a8b9f110cee5126be09c0c7ad9e189d8f5fa30
SSDEEP 96:qICzUibziJwR/XygoH8IQBbThC507zR8NBiS46zQte61p/5YZV/YUI+2:qIUv9lyHcIEbtCQz0BiStQI6LyZFJQ
TLSH
T18724AFBB4AE350C58D721C2FE34568A4D108216B8D05E6681D538CB79A0BA2C66C72BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

betweenbrain.met

Path C:\Users\Admin\AppData\Roaming\Forkldning0\Kodagu\betweenbrain.met
Size 32KB
SHA256 e598e12c3256f11e743cb3c5214e07ef8bc2b43e2041afcb7f81a0a6bc228e7d
MD5 a780d1fed89a0f323e672b9fc2559c27
SHA1 8f871807fc8bb5131aecbe45629317a939e0249b
SHA512 c52b0bae4c8fb2c88a406aab6caa7508985e8922639f1907d5838d9454f2de87095e52f551bd16fa822c532547ebd240c0dc9cfa6bfd7dce646e51494a802491
SSDEEP 24:no1kz4PLtWN3s0pE3c5je89w62kq7dxk/wZOww2yHMMhSAZaOs8rtVtCYbkUmJ:zzyLjiE3c5g6mw/IoSAZabcnJS
TLSH
T13FE296E1CF254A7878664B5C99F02694E5E177AEF4D400A389308D8DC06CB2C67B0B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

insurrections.jpg

Path C:\Users\Admin\AppData\Roaming\Forkldning0\Kodagu\insurrections.jpg
Size 14KB
SHA256 29e7ec0b4cab9884ce7fe17b5dccf4f3621826822bdd74b8691e21570836d67c
MD5 8bc34bce6971a061ead79ad4ce924977
SHA1 e42dcb41ac9ab639f41da047c2be79369b67c86d
SHA512 da8f87b062204be99ca1b87e975df954b75b0bbea0dc54ab9fdca60a8d81abb8d0f80b6a965070bf05edb2f9697a965d258bb42b3537bb01535dfa926d361575
SSDEEP 384:n9pfzqZmYktnRuswUGkGq0+MRPZWrDRYKzv9MRZ:n9IZRktnvwXkNw3+3FuZ
TLSH
T17962BF6B4AC7A991DF330A70AE151D6117BC1D12F672AA737846C6CB8D12F7C8A2C105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bundfradragsgrnsen.For

Path C:\Users\Admin\AppData\Roaming\Forkldning0\bundfradragsgrnsen.For
Size 27KB
SHA256 e848d8320b0ca46008eeea4959cc04644c033372b10b4848020925f48cc70244
MD5 771c50cd3dc1dec5939940d89f9baeb7
SHA1 053df40e332de0dc08750a0b0153325545c196ad
SHA512 27bd601b6b285e3ef78017c1cef5ba08aa38007d6f7f4bc4d58867f774c19febe2cb74717b722e085e50bef412e06cc4eeeafa7b78d4580eb5ea5e12dc633a0c
SSDEEP 384:LH8dgcMptKkUaVZwKTaU/ZR9tIsTO16Ik+fdAG0Smj21fEnylT8:LcKdKkUa3wKuUBnr+UG0SjfEnylT8
TLSH
T1E2C28ED58B69CCBACC06D578C3A5A1FA4DA924535E5EDCFC617EB81982092C3B2304BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Google Chrome (3).lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome (3).lnk
Size 2KB
SHA256 4ea9bfb906ea79b1ad80f387efeeba7badc4c99127cffc692c3a403114a98b0d
MD5 7f8a259b2e3e9a0895d54a71a987c0ba
SHA1 91dccd1616d8e6b5a6c57261668e1528c7e615b4
SHA512 6bf18c3fe8114efb878b070a9620497e2bae6d9d1f0d69f6e2d7638ce2265b0a9871f7d6bcc101a797db25217741c0e5a52080d647e646ac6efc163109b852a9
TLSH
T14F41AC166BF90B98F3F396326DB73B300FBFF816E6644A1E908842480CA151019ACF77
MD5 SHA1 SHA512 TLSH

Submit Download

9FQEK7D2F8VEUY7JGMO6.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9FQEK7D2F8VEUY7JGMO6.temp
Size 4KB
SHA256 8f812a3d651cd2f4b255e45a066fda5808b392c5bcd092cfc93b24feacd9538e
MD5 26f7ebfc370c098d14dd6123170ec0ee
SHA1 4d32bc7e15ae6917cc1c2d0241a7d764aaa0ef09
SHA512 1a0078c4474a52da881816cab9a4c8861cc723ede7bd5cfdc54c4ec9218762cbe1084558d0c437c50d4bcde0868f21811228286792a1d94a25705153b64084ca
SSDEEP 48:fv2YFudOOxlrSTJ9zCNYJdLXuHepIu2YFudOOxlrSTJ9zvYygdLXuHl2u:fm4JoGu+SJ4JvdIux
TLSH
T11C91DE529BE60996F3F7A9B2997377205BBFFE045B14CA0D404041080C73B459A7DFAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 7b1fe900020c5f95e377ecf401f928c1421dabd48945445eeb729065d5f71cff
MD5 80450fda3f9a632a1681cfae9e8ef8e0
SHA1 f7e42575c371f21833cd226f6d296f8b504575c4
SHA512 4d4c528d957a47b97b333cdfbe8ebf711467b46055fb10d7729ad96aac7cb90bf7151633a53cba1b33ccb27360172694fb7f70a2406c0aeec207987cf264d7e4
SSDEEP 48:pv2YFudOOxlrSTJ9zCNY2dLXuHepiu2YFudOOxlrSTJ9zvYlgdLXuHl2u:pm4JoXu+8J4JvaIux
TLSH
T1F391DC529BE60996F3F7A9B29533B7215B7BBA085B04CA0D004002480C73B459A3DFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\crashes\store.json.mozlz4.tmp
Size 6KB
SHA256 a8353a52c55aa5ac854284bd3164caab452c94ddb1e7a1f3dc0d2c31ce338a59
MD5 61c96d1111b54ef2b70a1c1035b8dc10
SHA1 d1ecc89772afb81342808f47d84bfa8200b6651b
SHA512 2f7d6a10f3cbb5965c101628f74b61d018be75197849d063606cf58bc2996734b0d48b4fbbcdcccfc6450d65b000775ffcd11084e2c54fc5cefca1cf2e2a8dfc
SSDEEP 192:B01vWh0r335FDAs2grZ7f3unaSZqOL8aZSwpQT2:Rh0Tpx2gJupZzjm6
TLSH
T195D19F239E629C9055521829F022F74A5A177D0F68AFE6EE3DEF738908F1B481F2C741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\crashes\store.json.mozlz4.tmp
Size 6KB
SHA256 ae3271de8c9cfc819174e8a8d5a30a12fd652bd4d67d80315a4278f04046c801
MD5 9f68fb9d47a8df8acf1a09b30e69bb75
SHA1 69005bb821cc3f291eac8f99b1b94cf039f30414
SHA512 359eb2827f0bcefa05fe8e1188d7b407c48155f54c3ce8799cced0c2d9b1972c72ecca8afdca3b736beb7d91a9f8a573d7668d9c1b7caaf81e3d2eb5c6249c02
SSDEEP 192:ew01vWh0r335FDAs2grZ7f3unkgYPBJ2qXdjS8la11Sev:eWh0Tpx2gJukHPBD5MS8
TLSH
T141D1A0A3DCC25DD21B923816F0167B4AA5176E0B69BEEFEA1D53B3C908F25C40F18741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 5299eb3911b03d368971098e64777be2be33c1971ea70f40e66990b5dc6bbd9a
MD5 a77d1c0f090066af4d58a1d1ae2d9da3
SHA1 52e95d91bc0de56be064c13062f8439c8f98a8f6
SHA512 8909f54f22249c2d05fe441b4767e4d81ea6ea27900a95ab0524c22b0d5f6e720b2babd037864a8cd7754911126bd4764adbfb58699bac5c5325810cffa39e6b
SSDEEP 768:mexzDIVLLGcmhusoRoG5Eotbhb6bfbyOFxm/:mexzsqoRj
TLSH
T168E20240EB1A953FD41812BADCA51B042F79FC8A59192FA73A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 3a972488916ac5a1db4101c626500cf5f2df699558a54f67170f6739c5223483
MD5 312ac7848e478182479256f2821d4338
SHA1 d27d87373fc2f83f94c2a271a21c0105c1d64ab0
SHA512 847929d6c94f1344f33cee1db3e546b1098379e099b56a0c811d5021c618bdb5bed2a7eb542361d99621e756fdb21fa44a416cfc43a6407e6a23aad089e6e994
SSDEEP 192:VOv5zboHMl9yjRcF1/66Joz0dzgCl6mc0dz:Kbosl9yjE/66JozQzgC1jd
TLSH
T133E10E64E638863BC408537BDCA62B411F3A384B988E3F2935AC654C2C572DD778E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 2cbc788dfecf78d9b8224467958458a4b8c1dba4ff853f14ba003a458600933f
MD5 470205599e39b7461589d22d00f1c671
SHA1 bd248634aa662cd168f810735ec07b401f5a3378
SHA512 26508e4fc1d683bbada71792f9f5f5670bb543aeb1e02599bc0a92ee00f6c89fb37533b47468a56cd1f849bc42205ef1e01f21fc232630806f9c7dfac8f19d8d
SSDEEP 192:Lo1d66Joz0dzgCl6mc0dVOv5zboAZl9yjOS:md66JozQzgC1jMboAZl9yj
TLSH
T17DE10F64EA38863FC448427BCCA62B401F36385B9C8E3F2935AD65482C472DD768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 5273609a52100ab03913c6cbc80708df091b329b00f1632bdffa857c4a98ca4f
MD5 c659c89319a04af91fd2a7d415a079c0
SHA1 cd86e2cefd80db96635caf423a67970230074d3f
SHA512 2c521f2ea93ba9951daff806749aaba914c509bb8dd6ad81be28a8d54d7624bbce7ec39618c79761bb57a66a6c8645d9de43be122b258759adcd790e87b57bc5
SSDEEP 192:sOv5zboHMl9yjRcT1/66Joz0dzgCl6mc0dz:Pbosl9yjW/66JozQzgC1jd
TLSH
T1CCE10F64E638863BC448537BDCA62B411F3A384B988E3F2935AC654C2C472DD778E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 648909aceaa72b3719a7ba25ae3e2ff18d716b7b29674462b09b0a9d814b4e35
MD5 6c2f292abdb500e015318b6280498d0e
SHA1 317b59ea66b1c24e6ae20ae69aa7c5a493d36603
SHA512 5a4d827d8d4879088da4fca7eda591779e9ea51c25351d00c8bad36a6b6ff54dc88c964ba2499ba57ea24f8859e5457f1f5817c6e58030a57aadbaafd545d5d9
SSDEEP 96:BF/QFDFOFLFR/dd66Joz0dzgClKtmc0d/UGSdF95/7bkW6QXjrcPyUR6ax:D1d66Joz0dzgCl6mc0dzOv5zbooCyj0
TLSH
T139B1BB68F628463FC458423ACCA21B501E76384AA89E3F1936ECB45D3D673CD768D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 10e182f22041a24c252cc9ad56613b4c138f7b7d32251d236f6ca27d504a3fe7
MD5 f373d2e3cfb89fa0e7b1681acb3a6763
SHA1 13c84eab4a6daeed00427a41c7203a2e583f7d65
SHA512 0c6f33ee065ec8be96af70c94dc2c2ac1d2edc47b965fcc0d9ed655171f346e3d207b8860bbaa7a777790728e6890741787a0001b7f92ca0634f1d6f22be24ee
SSDEEP 192:VOv5zboH9Zl9yjOSxgt1d66Joz0dzgCl6mc0dz:KbodZl9yjQLd66JozQzgC1jd
TLSH
T1BFE10F64EA38863BC418427BDCA62B411F36385B9C8E3F2935AD654C2C472DD768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 4921955c3b4441e83cc7a391dfac9d8fb3a378d0a7344ace3ea9bddea5a48e64
MD5 f11885f36dd1b67002030cfcbc74660d
SHA1 adbfdd9e352a1f421d22a0637ba0ef74f3511e48
SHA512 f019b6786f24ee691f23ace1321096421466d2ec95ab11d274eafc2f3be953c43e957618ffa8f87cc33e5f73c340217dab7710b704d2392dd766e155d030a9ef
SSDEEP 192:4gt1d66Joz0dzgCl6mc0dwOv5zboH9Zl9yjOSV:pLd66JozQzgC1jBbodZl9yjb
TLSH
T160E1FF64EA38863BC418427BDCA62B411F36385B9C8E3F2935AD654C2C472DD768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 875096b9c2290e6feda7039f992de96f2cffd2d3aa47edab97335fd888c9f67d
MD5 f43d86675bd5f0276a36947aa284c63c
SHA1 5637f8ed1fa54224b2e872c0b0e064113e1b1f9b
SHA512 a2f1e2dcf29854819ad746973739b30d07b957b388d67b148499be4f8e4c10f3bda942379719bd1db228e035cd6405d65119bc6104ed490bd5041552488e4140
SSDEEP 192:VOv5zboHqZl9yjOSYtz1d66Joz0dzgCl6mc0dz:KboKZl9yjOHd66JozQzgC1jd
TLSH
T161E10F64FA38963FC418027BDCA61B411F36389B9C8E3F2935AC65482C472DD768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 ff09b9c42d574e8365876cfbbed8fc5439855ced2e3c4506642497bad7d285f2
MD5 0a75ab862d8a4edef3917be491a0d1f0
SHA1 13b77c952df3be5bf9887fff46494a97aebb8a0e
SHA512 ed4b4e22660cae88ff9516b23bce492fd112250895197b76d376dd9df5953d62021f8f3d06b637b13feb77ec9d950d047a02228f4d7f42fbcdb03d3cf0061361
SSDEEP 192:sOv5zboHqZl9yjOSJ71d66Joz0dzgCl6mc0dz:PboKZl9yjT5d66JozQzgC1jd
TLSH
T140E10F64FA38963FC418427BDCA61B411F36385B9C8E3F2935ACA5482C472DD768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 c5396663203f042d2789c180c6ea9f0b81bcc1ad2d9c408f0be7d30955fc29d1
MD5 ac185b7fd75e9bd82f315fce68f94eec
SHA1 7b0021a66dc8297354f3a017c926967c825c097a
SHA512 444f9576fd26f488531fa0ca49fc4c5fd32f7cd715a4cb0d3200e3212dc15169c8ae471881ce7bfc7c8bc5bfb7c619f643c0fa6b47a3a37d3d40c51d9c768667
SSDEEP 192:Rgw1d66Joz0dzgCl6mc0dfOv5zboH9Zl9yjOSV:6qd66JozQzgC1jCbodZl9yjb
TLSH
T126E10E64FA38863BC408027BDCA62B411F36385B9C8E3F2935AD654C2C572DD768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 9a0c4daa8cc1e1acf7b7e1a8b75c1e78780ea6e722353bb4686ad4c9baeba752
MD5 d57d485860b76fa5fcd6a5db1a33ece4
SHA1 c6c5828b630ba5878b869fb1a494356bc7d09589
SHA512 b138fe64b43f7ae5a2ff84063df0c855a2312cc1fdf6fedc502b6acbcd17e81260592d1e97d53fe8c00d527dc23fa3a5b057b638b52628c1331049232bc1d013
SSDEEP 192:4q1d66Joz0dzgCl6mc0dZOv5zbo7bl9yjOSV:4Ud66JozQzgC1jEbo7bl9yjb
TLSH
T12DE10E65FA38863BC448427BCCE61B411F36385B988E3F2935ADA5482C472DD768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\events\events
Size 1KB
SHA256 dde1242f0f46219bd52fd32df09fa9e53c6888dd3c4a04b27223d98bf53df72d
MD5 f436748b28c380f9ce163d7204a45832
SHA1 a685ed3c2d047ac164e2028aa06408c5d22ecaca
SHA512 62994732d69d0c1d4c77523ec8836b985fc0094b589600505a793d5a6bf59641944e257280bf68e2eac1841a525e2e4bd0b01cc387b672652be45d29aa7a6669
TLSH
T1E321645D39B88D6AADEBE6AC7445028E53528E1204C71C474D52DF8CCC85ADD326A47D
MD5 SHA1 SHA512 TLSH

Submit Download

08446816-5aed-4776-b242-e87bb7816e50

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\08446816-5aed-4776-b242-e87bb7816e50
Size 16KB
SHA256 3ea3e3a0667d4e02d398453f1b1d7a7838c0b3a637e75dfc447cbbb2f05fe488
MD5 293f77f28ee5a4817826ba055285a611
SHA1 c9c4b10733466bd708f04056959db2cb40248dc7
SHA512 25794cf9fc329189ea177f34baa73dd3bf7cf6c2456cb06e7dff5c6fd7a08c23cf7d840c159d18c9cbce2b6632ae3cb1c7bbffaf3897c6f64a0dc93a6e3f40aa
SSDEEP 192:+f+0zxeGP8a1vNdiXC280U70kdFlwUnRHfvB7vAJ1R7WpU4upzMJRUiTZQzxaEuJ:+GV9UnRHfv1Cg/ufiTClM2DKS8b1
TLSH
T16572B856582049BAC291E3A894EC7FC3E6F52CCF4C418FC98BE4BD086DDE56E512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b4e7d7c-f17c-4fcc-a632-05574fa52032

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\2b4e7d7c-f17c-4fcc-a632-05574fa52032
Size 3KB
SHA256 7c96cf8a2312e09e809cdd7a95e012184498f43805e63137f55a90b5eb5a0acc
MD5 947b958d7de2515b5c1a4dd438f1e33c
SHA1 1139bba3f24d8b0407957c6ff9f18bb7840d8bfe
SHA512 d170ec68648ddbbe1a0b5f2cbbdc07069272358d38aa6da8eaf9632301ba777f90803a5f549d32bced46beee858b890b4c29b0d1942dfed438a16b07e4eda98c
TLSH
T134616572896879739FFCA140E3677A448ADF339B14C30BC92569CE2846E8434578B25B
MD5 SHA1 SHA512 TLSH

Submit Download

2f004eff-830b-4283-9324-8dd329d22b37

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\2f004eff-830b-4283-9324-8dd329d22b37
Size 886B
SHA256 3fb5d226ece9f062593a434f225b4839bb00da240c214444a746ebf49b6390d3
MD5 dbb048d604a0de305362f2a9e45ec5ce
SHA1 7e3fd05d93f985e823d54c834b9a2c347f8d8856
SHA512 53ac4c5f026ec929d6f97e480b3a8af16c1a77f86cfe2c76ebc42e511ab52f1e7d0f7eee35d6dc0a1de8e90d30398a383fbb75cf0d3ac6d8215de2d2ad1ea1d2
TLSH
T1D8112751D674BCF2CC7CD2DB89D1B75257E0742340CA1D28BEB49A180CB952E5393607
MD5 SHA1 SHA512 TLSH

Submit Download

399b6df6-bc58-4636-b2d7-342244520319

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\399b6df6-bc58-4636-b2d7-342244520319
Size 3KB
SHA256 2259b25946bfcc131e15e590e0eeb4b7b1a3e6965b3acb22b427f42bc593351c
MD5 57e31fdf003de55c342f00a3c124ee1f
SHA1 3521ff19f0ebed8fdd1d12579a1d414ea9d6698c
SHA512 e3e3685ab608e0b99afcea1248a8616a50aef5d2c35477cc1d93244309783dbb2432f087eaaac7daa77b4c7fa3014d87ac3ab58b3a456badd7c71669075b7fb0
TLSH
T1046143718A68B9738AECB144E3777A458EDF339B54C30BCD2569CF2482B8424578B25B
MD5 SHA1 SHA512 TLSH

Submit Download

4c92c53b-a1c3-4750-836e-96b397cd4778

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\4c92c53b-a1c3-4750-836e-96b397cd4778
Size 3KB
SHA256 dcb644f43b96ad78d7ab29e88213268f85b45e33316afa0b473e7a58df40787c
MD5 a70cbace7011864b0ff2ec67fb8c6766
SHA1 b792a2a9c8a16831e4f3a8f4ed07c7e8387a0ba3
SHA512 4b9a1345cffea856dc63b578eda2a6cc29721f9cc3c613db64324f7e0a2507112398af0005a7f45bc86b3489b3928e33494249e4efb676dfd233769d69caf614
TLSH
T14E61343285A8B9738AFCA145E3777A5589DE33CB18C30BCD2569DE2882F4424578B24B
MD5 SHA1 SHA512 TLSH

Submit Download

4f56d089-9926-40d3-a050-69fe8902c465

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\4f56d089-9926-40d3-a050-69fe8902c465
Size 3KB
SHA256 1dcf7a4e619e44050c293d8d5af7e6526009875f66e737f21d3fac9dabeb1152
MD5 19441744c797d336f32ecdb59d445e1d
SHA1 d0f63f8efcebe5c6739cc9ea64025d89fd7dd453
SHA512 ff02b0033bac47f57c7c3b5d88d92361581c893e27ac481e436245c4568145308963ead829df4224e470f0fa83df323d32b79162abffc1dc4f99d6e86f938dd3
TLSH
T1A161657289B8A9738EECA144E3377E458ADF339B14C70BC925698F2446F482457CB24B
MD5 SHA1 SHA512 TLSH

Submit Download

769f5647-4bfa-4118-b439-109419abffff

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\769f5647-4bfa-4118-b439-109419abffff
Size 3KB
SHA256 7b3a1bc518954f3cd193451f192fb8080fe4e45bd6cc88bcf3c863fdfcff69e7
MD5 f11e9072d576446505518d12b6daaa64
SHA1 38fa94c712238687811186ab836f631f20ee2279
SHA512 7d46d8c5698890cefd5111ff2d5402adead18b97073d15460343c59b37b4265f611796fdeeefac1a1911dd62ddc58e3a47efad45d46ad2ab04937fb71f02b9ac
TLSH
T15161677145A8A9738BECA044E3377A448DDF33DF14C20BC9256ACE2442F4434578B34B
MD5 SHA1 SHA512 TLSH

Submit Download

78db4b57-b0ea-4e3c-b272-57747de324c9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\78db4b57-b0ea-4e3c-b272-57747de324c9
Size 3KB
SHA256 88daadf80e983b71dc1032a340be5dc297f0fa678d149b3a577989a5976a9ef4
MD5 a7ffa80d7f3ec7b721177f31d601ab71
SHA1 161fdd05cb3b7ae0712e7509a3c4523fc93b56d5
SHA512 d763f803271842370f5b48d26392aa5698018048d0c40a2891ce385b06db83e6c69aa37d9ca900dee86089f1b4ee6dc14bd561e89d6b5fbd5662ed225040bdf0
TLSH
T11C6145228568B9738EECA144E377BA858ADF338B54C20B8D25798E2442F843457CB24B
MD5 SHA1 SHA512 TLSH

Submit Download

8f2e4e6d-f605-409a-a818-4ae8884fa56f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\8f2e4e6d-f605-409a-a818-4ae8884fa56f
Size 871B
SHA256 ad43c41ff0eec6022771d0a866700fec76253730ab1915583b7beca2074fa998
MD5 5fb8014be472c6685cf835322d979bbe
SHA1 5f846f093cc5fbaa84648881d6153bbc0ec9e25f
SHA512 c85d28d847c06d2314e2cae12b695d8c641468917c530179373847d9c63eec9267fcae38526bc74d8a4f22e0961197f3bd14ec217553ec9d4056a764a3fb079a
TLSH
T1A5112351D634B9F2CC3CD38B889277059BF4741380CA14183DB55E040D7A62D97D2707
MD5 SHA1 SHA512 TLSH

Submit Download

8f4db846-ad65-491a-a5ea-350a51494290

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\8f4db846-ad65-491a-a5ea-350a51494290
Size 3KB
SHA256 5a2b3373d3c9ed45f727696f41a6ab923b97e8daea7adbf585edfe1768e97e24
MD5 75fd982b284f2098b10bcf36f4ab583c
SHA1 c0a56abb5bb602093cab7e0be1f3772c340d52ed
SHA512 0f39740cf134f35fb164627d66f9d318817451858fdcea75456f9cddb45ff486214a70278f875f1763a915567a80178dcd2594577448e80260e39e867c806845
TLSH
T1806154328964A9738BECA144F3377A598ADF339B54C30BC92569CF2442F482457CB24B
MD5 SHA1 SHA512 TLSH

Submit Download

8faf1a20-6a54-4e9f-8343-188b60775bdd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\8faf1a20-6a54-4e9f-8343-188b60775bdd
Size 235B
SHA256 9abe887770f963f5d3ba41e7417da24ec88e0cbd20c846b4b0d58ae165818fba
MD5 9742bee8ce78875832ed8a359e3a6bfd
SHA1 35133ac45379a7f7bde53171a08e78f46d4cd956
SHA512 3b8e550e88e33d46cb3f6687ec9b914b13f98cb049635324dd81ec9f4cd0aa60b377bf62f831d2bb645f0ba9444d9332082b49aaa5acc1da3749de959d34a80d
TLSH
T154D0978024A8272C0C005F07B0A069C6B0488C3328F09810EDB0D234AAF9EC8022281A
MD5 SHA1 SHA512 TLSH

Submit Download

916800f6-8ad1-45b7-b5cb-9712886c1753

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\916800f6-8ad1-45b7-b5cb-9712886c1753
Size 235B
SHA256 dedec47a96e4369c7a515761116485187854ad129c8118f203d9b17a2ac1ce97
MD5 5a3a4fb5decc2c51066f75ca05a5def5
SHA1 d1321d709ee2b7ec1e9236c4a624c063b0fa2928
SHA512 fc553106319728626c02c6c0dce09d195927523561bb8cb69873e9bd679fa5358745d9bb26dec239d23e9d604940d69b5904a0c61e6500f628ebd3d4912fbb27
TLSH
T144D097847888236D0A214F02B0B02AD230858C3364785818AA618474EAFCAC891A182A
MD5 SHA1 SHA512 TLSH

Submit Download

98289883-7de3-4428-8398-ed88b70cba04

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\98289883-7de3-4428-8398-ed88b70cba04
Size 235B
SHA256 05fae06576eae4409e24f2ec23edb80bc3cb935bb5c1b0e19a957acb75010825
MD5 f01e57340e76d3a1cf1ac3a23bd6fd15
SHA1 5a02137b3899fa96eed64dcd1dd108c2a1813408
SHA512 b7e30e161b7a5fb1725bc28c5edd3fa1492ae19bd4d836bae79910a9ea281808a114ac0e9fc55cdbc2fa53ae07398e443d956a23639af29e73e2bca7bc629b53
TLSH
T1C7D097802CE86B5C08040F03F0F068C630844C332062A8A0D56201388AFADD45261D2A
MD5 SHA1 SHA512 TLSH

Submit Download

ce1abb4e-8b9e-479a-88a2-1ddd21789a8c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\ce1abb4e-8b9e-479a-88a2-1ddd21789a8c
Size 2KB
SHA256 992695c8825ea0ea41b14137313dbf45d0d5fb3453d52117bb9b24f45cc5bd2d
MD5 395b27e9e181d9937936e2f9b3cafcdd
SHA1 9fb60726c5a222ad87220719d752ebab8cb1f451
SHA512 ac3a12f8d8348295d01350eafb11f9ead192f15745d723fe625df2650a2e9d8d7c4d501d11879841fde3e49b2c92a3dd32ecf8ad0e126c3f414d59d73088e210
TLSH
T15251635839785CBA6CCAE56C988233CD53A0CA0300821CC32E66CF4D9CC97DDB36B52A
MD5 SHA1 SHA512 TLSH

Submit Download

d404b718-4eac-45ce-b380-3274271b58a6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\d404b718-4eac-45ce-b380-3274271b58a6
Size 3KB
SHA256 c6f47b31d302ff7f51c9d8c2097e9ff84ca2b69e5d471250697558a6d809c86b
MD5 2d2594f6ae195b825627287d6342e066
SHA1 1d7cad526dce4560fed0aa0c652a10ccd851647c
SHA512 a9f463cea2f70965d527b4fed2f585801b9dde688e25402c36fab6a12ff264cc8f3e89884d5f79b62ce3002d63079a289a6430ca7027a409570dd475691bb7c3
TLSH
T1836155728568B9738FFCB041E3777A458ADF338F14C30BD96569DE2482A442457CB24B
MD5 SHA1 SHA512 TLSH

Submit Download

e34dc640-d6f6-46b4-89ff-92ef73ee23d4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\e34dc640-d6f6-46b4-89ff-92ef73ee23d4
Size 3KB
SHA256 5184ff8bb61267a87bc14b07576ac5a3fa851260a9b51108660ec66526f66c08
MD5 fed0dca04472f68b0ff49e6b3b8dabaa
SHA1 1f816ee55b8159fa302ead8338246961268e8de6
SHA512 08d65bec51ca8b750bb42a8390b2887d8f8e0e6e2b1404c4bc66225d6a760029c8e83cfaaac319ee2787a6b7ee52a1d1570f2c207503c4d132af8fe240ae00f8
TLSH
T153615672856869738EECA141E3777A458ADF339F14C70B8D25B9DE2482E4424578B34B
MD5 SHA1 SHA512 TLSH

Submit Download

f162693c-dbb0-43a0-9e50-c27d31f2669b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\f162693c-dbb0-43a0-9e50-c27d31f2669b
Size 2KB
SHA256 87d0c2ff0fe1b881f7f21c882c5e8713b03b551ddc4601e9bcd95356eda4fa08
MD5 bb74b6ca79d789a5ffbca74a8f816362
SHA1 084b2aee2286c5c64bc6449cb0f67b20ad63cd2c
SHA512 4b931c1d9750025503330dae805cbe07c6a06454ac82d24a3d55949af8df3bde55a68fbca42ec8b9bcc659f6d99b614b1b943c8eb3da1c8717d74bcac15888a7
TLSH
T18051425836785C774C9BE15D9682378E23A1C91300C21C572EA1CE4CDCDA69D636B53A
MD5 SHA1 SHA512 TLSH

Submit Download

f37c4082-795d-4a78-8838-da94e2f2f8a8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\f37c4082-795d-4a78-8838-da94e2f2f8a8
Size 883B
SHA256 aac2b9f64e67e357746ae9bb287985fd4403e90303b339f5be4ec7d24e16ec47
MD5 006d852259ef591dbf0e23480bc8beb5
SHA1 99d7991c1560ad6a041c92ca4eb9e190d95a822b
SHA512 bf2d8bda2c5dca9da4f06bfc368ced1d0865200bb4573035968522084e262f686ea46fb94696cb76528f18833192bd9adb4c61a330c3bb568e84641d17643442
TLSH
T154112391D734B9B1CD6CE25BCA9277069BE4752380CA54183EF04A040DBA62D935770B
MD5 SHA1 SHA512 TLSH

Submit Download

f4965954-b959-4df3-ba00-7065090a38b1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\f4965954-b959-4df3-ba00-7065090a38b1
Size 886B
SHA256 177938f1549e1cbfd69f627e6a750cd8b2a368b6dd08da52ce5413f2454118aa
MD5 2993689f9056ee0f0115ae4e08553926
SHA1 693e26ae418c23bb5d0bdcefc586ea363dc6dcb5
SHA512 2b70f3f17585318b35c2644c4fe1d58a12788fe20e317ef8dc1d0a4207b3cfd8ae50d02ce1b2bad01e88865c9ed9160d376d68c37cb4968bb5e433225e2dd558
TLSH
T187112751DA78B9F2CC7CD39788E1774187E4741340C61D147DF48B180DBA52D6392607
MD5 SHA1 SHA512 TLSH

Submit Download

fc7816c8-fcfb-4724-92a3-09a31a132c19

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\fc7816c8-fcfb-4724-92a3-09a31a132c19
Size 235B
SHA256 e7ee44183ffc4934bb4bd3604591c466bad7c6a7f00407b1e4338e5d887f93cb
MD5 6ab7eda7bb3e5d20544059b3cbfcd79d
SHA1 61868f35d4d2856b6dbc9cd1e4646f82b229d2df
SHA512 510e5d8e8e0d2b355b0b3e87de5e0dc1a5a1d02cdb315bf2e882e535da6134d36a2ed4a044598d0a09cdb9880f89e26f5ea837a252c5b78f956ef57b5a86e022
TLSH
T17ED0978024ACA71C08041F02FCA02ACB31858C3324659C20DA6549B4D9FCEC95112847
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\prefs-1.js
Size 6KB
SHA256 9034c065ed24a93e5a35d511d3e7d99387e4bb4bf8216761afe8ef6a6dee0a4d
MD5 0922bb7206f76228b381316d12ec6c81
SHA1 7dd0ac59ecbf10fb0653d8fb675e0d4a9f79602e
SHA512 b80a36c3b514fec1ba59517d22e728e26827739b7685603f139427f8f61c6bd479e35736994e3f73688117e71070bce42d21497de97f4a37a3564ef058c279d9
SSDEEP 96:xHX9UTUq1qGqafu3C9/1zSLx1SSlIdv9jonlHw303tBw88H8L4cnQVJ:d91RafuS9/ySSLw303tBw88B
TLSH
T1F0E12F7894088F7F78B6766CAC6888716AB2413BBBBF68D710B544C5010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\prefs-1.js
Size 6KB
SHA256 07a556d558204773aa18ffc4b86e9af0b1989cf54c3b80a5f506252cf1a4b626
MD5 4707a52bc418c0650e6f07aa523695a0
SHA1 ff52abe9d17630569abc26f75d7d7bdea32ab2fb
SHA512 bcd4bba30c5e21b660b3c43fb15a3cdca204eb61d4cfb54db791c129a0312a26d3dd2ba3d6e9c15753fdc92cad75fbb43eb3d01b3a3e71f1860023df2f696ab1
SSDEEP 96:xHX9UTUq1qGqafu3C9/1zSXSSlIdv9jonlHw303tBw88H8L4cnQ8jJ:d91RafuS9/6SSLw303tBw88Y
TLSH
T166E1207894088F7F78B6766CAC6889716AB2413BB7BF68D710B544C5050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\prefs.js
Size 6KB
SHA256 7063e9e6d0eab7bb53cbb51ee3e91e7cdf15b314541171f26c17eb0cdfb2e3ce
MD5 c91489567af675bb76da15f62ffdc440
SHA1 43109c896398c2c01725f04a85d94a726492a9c9
SHA512 f31a396488541d1115ae9bb5cfa253e8c78d47dd53511e2ae4d98b5081658b2b7baf63cd838e731fda157b915a8a10cf6c9419891fc384d98094b5680e5bfcb7
SSDEEP 96:xHX9UTUq1qGqafuKjmnjv1zSlSSlIdv9jHnlHw303tBw88H8L4cnQVJ:d91RafuNDgSSMw303tBw88B
TLSH
T1FEE11E7890088F7F64B6766C6C6888316AB2413BBBBF68C750A544C5010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

Sales Order Invoice Reconfirm bank details.exe

Path C:\Users\Admin\AppData\Roaming\Sales Order Invoice Reconfirm bank details.exe
Size 890KB
SHA256 49c7caba0e93c51ed5fb1f246fc884b944d95a5ee19a3c7e9bbb43f7eed5255d
MD5 2b6a04fe17efacaac9cef9f251590d77
SHA1 80f276e9d632a38c8f95788c9d36bbfcb0134abf
SHA512 cf645c2f08dcc1e0471d7a3d65100ede428f15fb4fafd3694bba5bcc185fae4797702a05736c18061974cb2321f21dcfb1a578a7c60304989aad2af61198a560
SSDEEP 24576:mHO/MdQiqo48IIqWdBz6kqd43jbz1HVkMIwSqLbBYNGA:mHO/ueIqWdBGzKb0wSqp9A
TLSH
T1CA1512605752944EE0530874ACE23776E7D8AE6637AEC38277C0B59C7D2B75A4F283C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 9KB
SHA256 bc4d2ac320287d7334cef9c0780f24eea859b76954c1befbee1da905ad0e3806
MD5 57c1fae64374bba88f354cdb98211920
SHA1 3aee591c3e09a1baa89fbaafb65f360ed53d0645
SHA512 f4409031b9d91a1df3c87db1a1fa862d0c953c64661a0a4b423750add89c22089f28140fdf495aad8637c40747e1dbf8f6762836d16a18abbca3fbd52b09f8a1
SSDEEP 96:gja+FwNKVFaggFy76pDPhK3MK3hVEqcFURphhK2CK2rn+bOk7c4fMw+88a+IhK3C:dHbyOzgBcic5i7dM3885Gt2MP
TLSH
T1C9129ED58E02456F7F82DF6B339331A45DAB200BCBE464B277DB5102B4CAAA4052F5B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1736-4336-0x000002126FCE0000-0x000002126FD3D000-memory.dmp

Download

memory/2404-1837-0x0000000037C00000-0x0000000037C20000-memory.dmp

Download

memory/2404-1711-0x0000000000480000-0x0000000001797000-memory.dmp

Download

memory/2404-1836-0x0000000037BE0000-0x0000000037BF9000-memory.dmp

Download

memory/2404-1712-0x00000000079A0000-0x0000000007AB2000-memory.dmp

Download

memory/2404-1713-0x0000000037BB0000-0x0000000037BD2000-memory.dmp

Download

memory/2404-1714-0x0000000037BE0000-0x0000000037BF9000-memory.dmp

Download

memory/2404-1834-0x00000000079A0000-0x0000000007AB2000-memory.dmp

Download

memory/2404-1835-0x0000000037BB0000-0x0000000037BD2000-memory.dmp

Download

memory/2404-1715-0x0000000037C00000-0x0000000037C20000-memory.dmp

Download

memory/2844-298-0x0000026068DB0000-0x0000026068E23000-memory.dmp

Download

memory/3880-3537-0x0000023E1F4E0000-0x0000023E1F53D000-memory.dmp

Download

memory/3992-488-0x000001F8CCBB0000-0x000001F8CCC0D000-memory.dmp

Download

memory/4252-1689-0x00000000079F0000-0x0000000007B02000-memory.dmp

Download

memory/4252-68-0x0000000000480000-0x000000000053E000-memory.dmp

Download

memory/4252-4353-0x00000000079F0000-0x0000000007B02000-memory.dmp

Download

memory/4252-51-0x00000000776C8000-0x00000000776C9000-memory.dmp

Download

memory/4252-4351-0x00000000079F0000-0x0000000007B02000-memory.dmp

Download

memory/4252-172-0x000000003ADB0000-0x000000003AF72000-memory.dmp

Download

memory/4252-75-0x000000003AD00000-0x000000003ADB2000-memory.dmp

Download

memory/4252-70-0x000000003AC20000-0x000000003AC86000-memory.dmp

Download

memory/4252-173-0x000000003B000000-0x000000003B076000-memory.dmp

Download

memory/4252-174-0x000000003AFA0000-0x000000003AFF0000-memory.dmp

Download

memory/4252-175-0x000000003B080000-0x000000003B5AC000-memory.dmp

Download

memory/4252-176-0x000000003B730000-0x000000003B74E000-memory.dmp

Download

memory/4252-180-0x000000007775B000-0x000000007775C000-memory.dmp

Download

memory/4252-53-0x00000000776DB000-0x00000000776DC000-memory.dmp

Download

memory/4252-52-0x000000007775B000-0x000000007775C000-memory.dmp

Download

memory/4252-4347-0x00000000380A0000-0x00000000380AA000-memory.dmp

Download

memory/4252-65-0x0000000000480000-0x0000000001797000-memory.dmp

Download

memory/4252-67-0x00000000079F0000-0x0000000007B02000-memory.dmp

Download

memory/4252-442-0x00000000079F0000-0x0000000007B02000-memory.dmp

Download

memory/4252-2569-0x00000000079F0000-0x0000000007B02000-memory.dmp

Download

memory/4252-4346-0x000000003C830000-0x000000003C8C2000-memory.dmp

Download

memory/4252-4345-0x00000000079F0000-0x0000000007B02000-memory.dmp

Download

memory/4252-4339-0x000000003BCC0000-0x000000003C017000-memory.dmp

Download

memory/4252-4338-0x0000000037C20000-0x0000000037C42000-memory.dmp

Download

memory/4252-69-0x000000003A530000-0x000000003AAD6000-memory.dmp

Download

memory/4280-3522-0x0000000000400000-0x0000000000401000-memory.dmp

Download

memory/4280-3538-0x0000018A8CE00000-0x0000018A8CE5D000-memory.dmp

Download

memory/4380-2808-0x0000021E06180000-0x0000021E061DD000-memory.dmp

Download

memory/4380-2807-0x0000021E056D0000-0x0000021E05A8B000-memory.dmp

Download

memory/4524-2800-0x000001FC45690000-0x000001FC456ED000-memory.dmp

Download

memory/4524-2799-0x000001FC44C00000-0x000001FC44FBB000-memory.dmp

Download

memory/4576-515-0x00000000008E0000-0x00000000009F2000-memory.dmp

Download

memory/4768-50-0x0000000000B30000-0x0000000000C42000-memory.dmp

Download

memory/4768-49-0x0000000010004000-0x0000000010005000-memory.dmp

Download

memory/5148-1932-0x0000018528400000-0x00000185287BB000-memory.dmp

Download

memory/5148-1933-0x0000018528180000-0x00000185281DD000-memory.dmp

Download

memory/5292-486-0x0000000000170000-0x0000000000171000-memory.dmp

Download

memory/5292-1302-0x000001B15E380000-0x000001B15E3DD000-memory.dmp

Download

memory/5912-1301-0x00000216D0C40000-0x00000216D0C9D000-memory.dmp

Download

memory/5972-1948-0x00000281ACF60000-0x00000281ACFBD000-memory.dmp

Download

memory/5972-1947-0x00000281AC4D0000-0x00000281AC88B000-memory.dmp

Download

memory/6056-499-0x000001D1DF8E0000-0x000001D1DF93D000-memory.dmp

Download

memory/6324-4335-0x0000024F8C940000-0x0000024F8C99D000-memory.dmp

Download

memory/6392-4333-0x00000180B7650000-0x00000180B76AD000-memory.dmp

Download

memory/6412-4337-0x0000026EEF550000-0x0000026EEF5AD000-memory.dmp

Download