phantom_stealer | 2babb5268496a4b5231d8d58e3f84ebe220ab2ddea277ec9910bdbdffb572f4d

Analysis

max time kernel
149s
max time network
133s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/02/2026, 16:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payment receipt 2.bat.exe
Size 269KB
Sample260218-t2etmaet2a
SHA256 2babb5268496a4b5231d8d58e3f84ebe220ab2ddea277ec9910bdbdffb572f4d
MD5 3238874df93198525df1c1a03cc4b75e
SHA1 498b7141a37239f11edcb5f477a5c62f2dc167b8
SHA512 f540de49269648bc853025ea0b19bdf672a1a9e68eff8fecf7eeb7929080802fc7d189777484e1dc72101c6e17032b5da3b007a930d120f9782fd4c3282af993
SSDEEP 6144:kcBvWb0Pv8SNUzKRdCb1J49OYTczmB/doLcPCkT:tO0PESSK6xJQJTnxifkT
TLSH
T1394412A5B270D4F3D2735BF09E731A779BB9EF14129146833B45BB2E7C37A408A4A502
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery phantom_stealer installer persistence spyware stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.lodenrandmarines.com
Port
587
Username
[email protected]
Password
20w1L)5%G@5E

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
mail.lodenrandmarines.com
Port
587
Username
[email protected]
Password
20w1L)5%G@5E
Email to
[email protected]

Mutex

Q0WUU38GCA3VXVPVKPFZ

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
0
start_delay
1
startup
1

Signatures

Detects PhantomStealer payload 2 IoCs

resource	yara_rule
behavioral2/memory/1708-30-0x0000000000440000-0x0000000001757000-memory.dmp	family_phantomstealer
behavioral2/memory/1708-32-0x0000000000440000-0x00000000004FE000-memory.dmp	family_phantomstealer

PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer
Phantom_stealer family
phantom_stealer

Executes dropped EXE 3 IoCs

pid	Process
5352	Payment receipt 2.bat.exe
3116	Payment receipt 2.bat.exe
6728	Payment receipt 2.bat.exe

Loads dropped DLL 3 IoCs

pid	Process
2052	Payment receipt 2.bat.exe
5352	Payment receipt 2.bat.exe
3036	Payment receipt 2.bat.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Payment receipt 2.bat.exe
Key opened	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Payment receipt 2.bat.exe
Key opened	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Payment receipt 2.bat.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Windows\CurrentVersion\Run\Payment receipt 2.bat = "C:\\Users\\Admin\\AppData\\Roaming\\Payment receipt 2.bat.exe"	Payment receipt 2.bat.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com
2	drive.google.com
40	drive.google.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	icanhazip.com

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
1708	Payment receipt 2.bat.exe
3036	Payment receipt 2.bat.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2052	Payment receipt 2.bat.exe
1708	Payment receipt 2.bat.exe
5352	Payment receipt 2.bat.exe
3036	Payment receipt 2.bat.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payment receipt 2.bat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payment receipt 2.bat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payment receipt 2.bat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payment receipt 2.bat.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1200	chrome.exe
6484	msedge.exe
652	msedge.exe
5112	chrome.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x001900000002b3d7-44.dat	nsis_installer_1
behavioral2/files/0x001900000002b3d7-44.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 38 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Payment receipt 2.bat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Payment receipt 2.bat.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134159061544378266"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1708	Payment receipt 2.bat.exe
1708	Payment receipt 2.bat.exe
1492	chrome.exe
1492	chrome.exe
1708	Payment receipt 2.bat.exe
1708	Payment receipt 2.bat.exe
1708	Payment receipt 2.bat.exe
1708	Payment receipt 2.bat.exe
1708	Payment receipt 2.bat.exe
1708	Payment receipt 2.bat.exe
1708	Payment receipt 2.bat.exe
1708	Payment receipt 2.bat.exe
1708	Payment receipt 2.bat.exe
5060	firefox.exe
5060	firefox.exe
5060	firefox.exe
5060	firefox.exe
5060	firefox.exe
5060	firefox.exe
5060	firefox.exe
5060	firefox.exe
5060	firefox.exe
5060	firefox.exe
5060	firefox.exe
5060	firefox.exe
5060	firefox.exe
5060	firefox.exe
5060	firefox.exe
5060	firefox.exe
5060	firefox.exe
5060	firefox.exe
5060	firefox.exe
5060	firefox.exe
1708	Payment receipt 2.bat.exe
1708	Payment receipt 2.bat.exe
1708	Payment receipt 2.bat.exe
1708	Payment receipt 2.bat.exe
1708	Payment receipt 2.bat.exe
1708	Payment receipt 2.bat.exe
1708	Payment receipt 2.bat.exe
1708	Payment receipt 2.bat.exe
1708	Payment receipt 2.bat.exe
1708	Payment receipt 2.bat.exe
1708	Payment receipt 2.bat.exe
1708	Payment receipt 2.bat.exe
1708	Payment receipt 2.bat.exe
1708	Payment receipt 2.bat.exe
1708	Payment receipt 2.bat.exe
1708	Payment receipt 2.bat.exe
1708	Payment receipt 2.bat.exe
1708	Payment receipt 2.bat.exe
1708	Payment receipt 2.bat.exe
5864	firefox.exe
5864	firefox.exe
5864	firefox.exe
5864	firefox.exe
5864	firefox.exe
5864	firefox.exe
5864	firefox.exe
5864	firefox.exe
5864	firefox.exe
5864	firefox.exe
5864	firefox.exe
5864	firefox.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2052	Payment receipt 2.bat.exe
5352	Payment receipt 2.bat.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	Payment receipt 2.bat.exe
Token: SeShutdownPrivilege	1492	chrome.exe
Token: SeCreatePagefilePrivilege	1492	chrome.exe
Token: SeShutdownPrivilege	1492	chrome.exe
Token: SeCreatePagefilePrivilege	1492	chrome.exe
Token: SeShutdownPrivilege	1492	chrome.exe
Token: SeCreatePagefilePrivilege	1492	chrome.exe
Token: SeShutdownPrivilege	1492	chrome.exe
Token: SeCreatePagefilePrivilege	1492	chrome.exe
Token: SeShutdownPrivilege	1492	chrome.exe
Token: SeCreatePagefilePrivilege	1492	chrome.exe
Token: SeShutdownPrivilege	1492	chrome.exe
Token: SeCreatePagefilePrivilege	1492	chrome.exe
Token: SeShutdownPrivilege	1492	chrome.exe
Token: SeCreatePagefilePrivilege	1492	chrome.exe
Token: SeDebugPrivilege	3036	Payment receipt 2.bat.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe

Suspicious use of FindShellTrayWindow 24 IoCs

pid	Process
1492	chrome.exe
1492	chrome.exe
664	chrmstp.exe
5060	firefox.exe
5060	firefox.exe
5060	firefox.exe
5060	firefox.exe
5060	firefox.exe
5060	firefox.exe
5060	firefox.exe
5060	firefox.exe
6148	msedge.exe
4336	msedge.exe
5864	firefox.exe
5864	firefox.exe
5864	firefox.exe
5864	firefox.exe
5864	firefox.exe
5864	firefox.exe
5864	firefox.exe
5864	firefox.exe
1860	chrome.exe
1860	chrome.exe
4004	chrmstp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5060	firefox.exe
5864	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2192	2052	Payment receipt 2.bat.exe	79
PID 2052 wrote to memory of 1708	2052	Payment receipt 2.bat.exe	80
PID 2052 wrote to memory of 1708	2052	Payment receipt 2.bat.exe	80
PID 1708 wrote to memory of 2140	1708	Payment receipt 2.bat.exe	81
PID 1708 wrote to memory of 1492	1708	Payment receipt 2.bat.exe	85
PID 1492 wrote to memory of 3204	1492	chrome.exe	86
PID 1708 wrote to memory of 1492	1708	Payment receipt 2.bat.exe	85
PID 1708 wrote to memory of 1492	1708	Payment receipt 2.bat.exe	85
PID 1708 wrote to memory of 3204	1708	Payment receipt 2.bat.exe	86
PID 1708 wrote to memory of 3204	1708	Payment receipt 2.bat.exe	86
PID 1492 wrote to memory of 5812	1492	chrome.exe	87
PID 1492 wrote to memory of 1200	1492	chrome.exe	88
PID 1492 wrote to memory of 5372	1492	chrome.exe	89
PID 1492 wrote to memory of 2692	1492	chrome.exe	90
PID 1492 wrote to memory of 3756	1492	chrome.exe	91
PID 1492 wrote to memory of 1720	1492	chrome.exe	92
PID 1492 wrote to memory of 1612	1492	chrome.exe	93
PID 1492 wrote to memory of 1268	1492	chrome.exe	94
PID 1492 wrote to memory of 2072	1492	chrome.exe	95
PID 1708 wrote to memory of 1720	1708	Payment receipt 2.bat.exe	92
PID 1708 wrote to memory of 1720	1708	Payment receipt 2.bat.exe	92
PID 1708 wrote to memory of 5372	1708	Payment receipt 2.bat.exe	89
PID 1708 wrote to memory of 5372	1708	Payment receipt 2.bat.exe	89
PID 1708 wrote to memory of 5812	1708	Payment receipt 2.bat.exe	87
PID 1708 wrote to memory of 5812	1708	Payment receipt 2.bat.exe	87
PID 1708 wrote to memory of 1492	1708	Payment receipt 2.bat.exe	85
PID 1708 wrote to memory of 1492	1708	Payment receipt 2.bat.exe	85
PID 1708 wrote to memory of 3204	1708	Payment receipt 2.bat.exe	86
PID 1492 wrote to memory of 4544	1492	chrome.exe	96
PID 1708 wrote to memory of 3204	1708	Payment receipt 2.bat.exe	86
PID 1708 wrote to memory of 1612	1708	Payment receipt 2.bat.exe	93
PID 1708 wrote to memory of 1612	1708	Payment receipt 2.bat.exe	93
PID 1708 wrote to memory of 1200	1708	Payment receipt 2.bat.exe	88
PID 1708 wrote to memory of 1200	1708	Payment receipt 2.bat.exe	88
PID 1708 wrote to memory of 3756	1708	Payment receipt 2.bat.exe	91
PID 1708 wrote to memory of 3756	1708	Payment receipt 2.bat.exe	91
PID 1708 wrote to memory of 1268	1708	Payment receipt 2.bat.exe	94
PID 1708 wrote to memory of 1268	1708	Payment receipt 2.bat.exe	94
PID 1708 wrote to memory of 1720	1708	Payment receipt 2.bat.exe	92
PID 1708 wrote to memory of 1720	1708	Payment receipt 2.bat.exe	92
PID 1708 wrote to memory of 2072	1708	Payment receipt 2.bat.exe	95
PID 1708 wrote to memory of 2072	1708	Payment receipt 2.bat.exe	95
PID 1708 wrote to memory of 5372	1708	Payment receipt 2.bat.exe	89
PID 1708 wrote to memory of 5372	1708	Payment receipt 2.bat.exe	89
PID 1708 wrote to memory of 5812	1708	Payment receipt 2.bat.exe	87
PID 1708 wrote to memory of 5812	1708	Payment receipt 2.bat.exe	87
PID 1708 wrote to memory of 1492	1708	Payment receipt 2.bat.exe	85
PID 1708 wrote to memory of 1492	1708	Payment receipt 2.bat.exe	85
PID 1708 wrote to memory of 3204	1708	Payment receipt 2.bat.exe	86
PID 1708 wrote to memory of 3204	1708	Payment receipt 2.bat.exe	86
PID 1708 wrote to memory of 1612	1708	Payment receipt 2.bat.exe	93
PID 1708 wrote to memory of 1612	1708	Payment receipt 2.bat.exe	93
PID 1708 wrote to memory of 1200	1708	Payment receipt 2.bat.exe	88
PID 1708 wrote to memory of 1200	1708	Payment receipt 2.bat.exe	88
PID 1708 wrote to memory of 3756	1708	Payment receipt 2.bat.exe	91
PID 1708 wrote to memory of 3756	1708	Payment receipt 2.bat.exe	91
PID 1708 wrote to memory of 1268	1708	Payment receipt 2.bat.exe	94
PID 1708 wrote to memory of 1268	1708	Payment receipt 2.bat.exe	94
PID 1492 wrote to memory of 2312	1492	chrome.exe	97
PID 1492 wrote to memory of 4016	1492	chrome.exe	98
PID 1492 wrote to memory of 2112	1492	chrome.exe	99
PID 1708 wrote to memory of 1720	1708	Payment receipt 2.bat.exe	92
PID 1708 wrote to memory of 1720	1708	Payment receipt 2.bat.exe	92
PID 5352 wrote to memory of 3116	5352	Payment receipt 2.bat.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Payment receipt 2.bat.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Payment receipt 2.bat.exe

C:\Users\Admin\AppData\Local\Temp\Payment receipt 2.bat.exe
"C:\Users\Admin\AppData\Local\Temp\Payment receipt 2.bat.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Users\Admin\AppData\Local\Temp\Payment receipt 2.bat.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment receipt 2.bat.exe"
  2⤵
  PID:2192
- C:\Users\Admin\AppData\Local\Temp\Payment receipt 2.bat.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment receipt 2.bat.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:1708
- - C:\Users\Admin\AppData\Local\Temp\Payment receipt 2.bat.exe
    "C:\Users\Admin\AppData\Local\Temp\Payment receipt 2.bat.exe"
    3⤵
    PID:2140
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1492
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffd665ac728,0x7ffd665ac734,0x7ffd665ac740
      4⤵
      PID:3204
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1900,i,3706213020237231701,15465164867387190325,262144 --field-trial-handle=2208,i,9931168839389248636,15010116404876034826,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
      4⤵
      PID:5812
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu" --force-high-res-timeticks=disabled --metrics-shmem-handle=2284,i,4522111517899982099,5265333300781664197,524288 --field-trial-handle=2208,i,9931168839389248636,15010116404876034826,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:11
      4⤵
      System Time Discovery
      PID:1200
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu" --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,5446576273404427666,3441538579849007892,524288 --field-trial-handle=2208,i,9931168839389248636,15010116404876034826,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:13
      4⤵
      PID:5372
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3020,i,10906515060220669168,5442632728636746673,2097152 --field-trial-handle=2208,i,9931168839389248636,15010116404876034826,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:1
      4⤵
      PID:2692
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3080,i,5384766461108915945,826273584860700746,2097152 --field-trial-handle=2208,i,9931168839389248636,15010116404876034826,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:1
      4⤵
      PID:3756
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3348,i,13799743225701023550,12559464139051285960,2097152 --field-trial-handle=2208,i,9931168839389248636,15010116404876034826,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:1
      4⤵
      PID:1720
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3384,i,4783013447309512085,16582994459628524010,2097152 --field-trial-handle=2208,i,9931168839389248636,15010116404876034826,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:9
      4⤵
      PID:1612
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4064,i,17359877317777582020,4641629836305952009,2097152 --field-trial-handle=2208,i,9931168839389248636,15010116404876034826,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:9
      4⤵
      PID:1268
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4368,i,10898663942118071770,17506570189295502320,2097152 --field-trial-handle=2208,i,9931168839389248636,15010116404876034826,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
      4⤵
      PID:2072
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu" --force-high-res-timeticks=disabled --metrics-shmem-handle=4480,i,1898566473217185604,3438836224985649999,524288 --field-trial-handle=2208,i,9931168839389248636,15010116404876034826,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
      4⤵
      PID:4544
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu" --force-high-res-timeticks=disabled --metrics-shmem-handle=5104,i,7266200188974003500,3750923014227922194,524288 --field-trial-handle=2208,i,9931168839389248636,15010116404876034826,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
      4⤵
      PID:2312
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5172,i,2092686120281747567,5043361824084259161,2097152 --field-trial-handle=2208,i,9931168839389248636,15010116404876034826,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:1
      4⤵
      PID:4016
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5184,i,13443775333993789623,8097683082514499111,2097152 --field-trial-handle=2208,i,9931168839389248636,15010116404876034826,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:1
      4⤵
      PID:2112
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      PID:5920
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff6998e55a0,0x7ff6998e55ac,0x7ff6998e55b8
        5⤵
        Drops file in Windows directory
        
        PID:3184
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:664
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff6998e55a0,0x7ff6998e55ac,0x7ff6998e55b8
        6⤵
        Drops file in Windows directory
        
        PID:948
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5268,i,8170078081749480027,11269587677175692166,2097152 --field-trial-handle=2208,i,9931168839389248636,15010116404876034826,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
      4⤵
      PID:4328
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu" --force-high-res-timeticks=disabled --metrics-shmem-handle=5320,i,2064321504470870457,9024206788510654875,524288 --field-trial-handle=2208,i,9931168839389248636,15010116404876034826,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
      4⤵
      PID:3684
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu" --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,13718063073138418020,15572141841604393967,524288 --field-trial-handle=2208,i,9931168839389248636,15010116404876034826,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
      4⤵
      PID:2780
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5256,i,6481727636342045872,8843589001729540231,2097152 --field-trial-handle=2208,i,9931168839389248636,15010116404876034826,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:1
      4⤵
      PID:4304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wlq3xv5k.dmv"
    3⤵
    PID:5944
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\wlq3xv5k.dmv
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:5060
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1916 -prefsLen 27097 -prefMapHandle 1920 -prefMapSize 270279 -ipcHandle 2020 -initialChannelId {e31c7faf-94f9-4e2c-aeb7-7d04dbbc4456} -parentPid 5060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5060" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:5764
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2280 -prefsLen 27133 -prefMapHandle 2292 -prefMapSize 270279 -ipcHandle 2016 -initialChannelId {4a51f1e2-6811-49bd-aa16-fa3f5443646d} -parentPid 5060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:3044
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\484a9bae-3062-4648-a243-d458edc7c2c9.dmp"
        5⤵
        
        PID:5388
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2168 -prefsLen 27133 -prefMapHandle 2660 -prefMapSize 270279 -ipcHandle 2656 -initialChannelId {19959c74-b5dd-46ef-930d-8099aecb1fd1} -parentPid 5060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5060" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:2552
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2bdc6f37-0564-4bcd-b855-03562f266200.dmp"
        5⤵
        
        PID:5348
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2168 -prefsLen 27133 -prefMapHandle 3116 -prefMapSize 270279 -ipcHandle 3120 -initialChannelId {b5967650-c83d-47ca-9f5c-8f28d864fff8} -parentPid 5060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5060" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:6108
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\de8b6823-c39c-4090-b4db-7590026b5496.dmp"
        5⤵
        
        PID:5376
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3120 -prefsLen 27198 -prefMapHandle 3184 -prefMapSize 270279 -ipcHandle 3112 -initialChannelId {8719b3ec-e359-4cd9-b976-ce664babda7d} -parentPid 5060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5060" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:2260
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3584 -prefsLen 27323 -prefMapHandle 3588 -prefMapSize 270279 -jsInitHandle 3592 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3600 -initialChannelId {d3f4dc4d-1751-43d5-bae7-a5b7a0954525} -parentPid 5060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:5272
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6edf4eaa-7982-4d2a-9d58-bb6021d98127.dmp"
        5⤵
        
        PID:328
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3112 -prefsLen 27323 -prefMapHandle 3560 -prefMapSize 270279 -ipcHandle 3564 -initialChannelId {8d2a65ea-f043-44b1-acb1-1076c6ffb0f3} -parentPid 5060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5060" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:220
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e3555625-2c4c-467a-8cd7-994832baffa1.dmp"
        5⤵
        
        PID:5828
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4144 -prefsLen 27323 -prefMapHandle 4148 -prefMapSize 270279 -ipcHandle 4156 -initialChannelId {c92d1490-c3bb-4c2d-9c47-67fac1de35ac} -parentPid 5060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5060" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:2080
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4544 -prefsLen 34822 -prefMapHandle 4548 -prefMapSize 270279 -jsInitHandle 4552 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4560 -initialChannelId {d10ef4b3-6f59-4658-ae26-90e3cc537b25} -parentPid 5060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:1276
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3212 -prefsLen 35010 -prefMapHandle 3180 -prefMapSize 270279 -ipcHandle 4788 -initialChannelId {c5ca572c-ba5d-445a-855f-e92a058d0273} -parentPid 5060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:7052
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5108 -prefsLen 32900 -prefMapHandle 5112 -prefMapSize 270279 -jsInitHandle 5116 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5128 -initialChannelId {672651a5-c7ff-4f54-bce9-c560034d3d14} -parentPid 5060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:7060
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5088 -prefsLen 32900 -prefMapHandle 4996 -prefMapSize 270279 -jsInitHandle 4800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5136 -initialChannelId {7892152f-6e95-4e0e-b1e0-49f165035375} -parentPid 5060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:7068
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5604 -prefsLen 32952 -prefMapHandle 5608 -prefMapSize 270279 -jsInitHandle 5612 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5680 -initialChannelId {08a45036-2470-4622-ae5e-2b9a3f903c4f} -parentPid 5060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:7124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:6148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ec,0x7ffd6658c188,0x7ffd6658c194,0x7ffd6658c1a0
      4⤵
      PID:6184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1648,i,17968850238355706688,2617784272122440560,262144 --field-trial-handle=2476,i,4680307195481874299,8869414210824996817,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:2
      4⤵
      PID:6436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,11728244516793465841,3870796078377506078,524288 --field-trial-handle=2476,i,4680307195481874299,8869414210824996817,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:11
      4⤵
      System Time Discovery
      PID:6484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,5054315568811706561,10428006697758514973,524288 --field-trial-handle=2476,i,4680307195481874299,8869414210824996817,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:13
      4⤵
      PID:6492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,1913274609839725245,3980533657409879093,2097152 --field-trial-handle=2476,i,4680307195481874299,8869414210824996817,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
      4⤵
      PID:328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,5685559717024833004,17428393117795272247,2097152 --field-trial-handle=2476,i,4680307195481874299,8869414210824996817,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
      4⤵
      PID:6744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,17918049078053053625,15225668478293685467,524288 --field-trial-handle=2476,i,4680307195481874299,8869414210824996817,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:14
      4⤵
      PID:6976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,7197979056325701123,5946349869069395984,524288 --field-trial-handle=2476,i,4680307195481874299,8869414210824996817,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
      4⤵
      PID:6996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,15486075687819485788,6424839203802603097,524288 --field-trial-handle=2476,i,4680307195481874299,8869414210824996817,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14
      4⤵
      PID:7004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3716,i,15224266184917146668,3684596508314606226,2097152 --field-trial-handle=2476,i,4680307195481874299,8869414210824996817,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:1
      4⤵
      PID:7012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3724,i,1738170858475745074,9213469883457841655,2097152 --field-trial-handle=2476,i,4680307195481874299,8869414210824996817,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:9
      4⤵
      PID:7020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3804,i,4366438241630236002,4854274049829228268,2097152 --field-trial-handle=2476,i,4680307195481874299,8869414210824996817,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:1
      4⤵
      PID:5852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3816,i,14536042947145957610,17965436889563238848,2097152 --field-trial-handle=2476,i,4680307195481874299,8869414210824996817,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:9
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3880,i,13590610476722777862,12168242535849377288,2097152 --field-trial-handle=2476,i,4680307195481874299,8869414210824996817,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:1
      4⤵
      PID:2564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3904,i,15364127406294714999,15327484065060948698,2097152 --field-trial-handle=2476,i,4680307195481874299,8869414210824996817,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:9
      4⤵
      PID:2912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3940,i,7760516914866143306,8782813032867558857,2097152 --field-trial-handle=2476,i,4680307195481874299,8869414210824996817,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:1
      4⤵
      PID:5560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3964,i,7376963492443254526,17359932561814393225,2097152 --field-trial-handle=2476,i,4680307195481874299,8869414210824996817,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:9
      4⤵
      PID:2368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4044,i,15050345677723573368,16419778432525550895,2097152 --field-trial-handle=2476,i,4680307195481874299,8869414210824996817,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:1
      4⤵
      PID:3508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4056,i,9099874628346103198,4454899996598524753,2097152 --field-trial-handle=2476,i,4680307195481874299,8869414210824996817,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:9
      4⤵
      PID:3716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4740,i,1119989465687346862,4163667954966669673,524288 --field-trial-handle=2476,i,4680307195481874299,8869414210824996817,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:14
      4⤵
      PID:1164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,12905936031580472614,11252950120358406456,524288 --field-trial-handle=2476,i,4680307195481874299,8869414210824996817,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:14
      4⤵
      PID:2884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,2206665074302474757,10738443526270912235,524288 --field-trial-handle=2476,i,4680307195481874299,8869414210824996817,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
      4⤵
      PID:5532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=568
        5⤵
        
        PID:3944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,1574420743572420023,14991029098383035348,524288 --field-trial-handle=2476,i,4680307195481874299,8869414210824996817,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
      4⤵
      PID:1904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4592,i,11837417318577095557,2366295699100438950,524288 --field-trial-handle=2476,i,4680307195481874299,8869414210824996817,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:14
      4⤵
      PID:6220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,809745800683139923,9409996908256085096,524288 --field-trial-handle=2476,i,4680307195481874299,8869414210824996817,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
      4⤵
      PID:6376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffd6658c188,0x7ffd6658c194,0x7ffd6658c1a0
      4⤵
      PID:6064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1700,i,16791060599431389222,1062456459067876104,262144 --field-trial-handle=2120,i,15489363618101969669,11605231113713434561,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:2
      4⤵
      PID:852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,4460339930707919906,16088283904017063758,524288 --field-trial-handle=2120,i,15489363618101969669,11605231113713434561,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:11
      4⤵
      System Time Discovery
      PID:652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,8560227066238165976,11735996245778928593,524288 --field-trial-handle=2120,i,15489363618101969669,11605231113713434561,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:13
      4⤵
      PID:748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3044,i,7220952340333886784,3713387064646084041,2097152 --field-trial-handle=2120,i,15489363618101969669,11605231113713434561,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:1
      4⤵
      PID:1960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3052,i,17569065748952559279,14163834030016659967,2097152 --field-trial-handle=2120,i,15489363618101969669,11605231113713434561,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:1
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3324,i,806454977661808892,10501055384618042177,524288 --field-trial-handle=2120,i,15489363618101969669,11605231113713434561,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:14
      4⤵
      PID:3560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3332,i,14546826626332600173,6174054152183544683,524288 --field-trial-handle=2120,i,15489363618101969669,11605231113713434561,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:14
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3336,i,4823201943119785884,17639391187055151871,524288 --field-trial-handle=2120,i,15489363618101969669,11605231113713434561,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:14
      4⤵
      PID:2848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3412,i,14775353159549788697,3783662177165796386,2097152 --field-trial-handle=2120,i,15489363618101969669,11605231113713434561,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
      4⤵
      PID:5808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3444,i,3153029001159829039,5185056688143457238,2097152 --field-trial-handle=2120,i,15489363618101969669,11605231113713434561,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:9
      4⤵
      PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3496,i,15619982160491724646,9364753980514466467,2097152 --field-trial-handle=2120,i,15489363618101969669,11605231113713434561,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
      4⤵
      PID:132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3528,i,16100110111767527990,2224407562022933647,2097152 --field-trial-handle=2120,i,15489363618101969669,11605231113713434561,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:9
      4⤵
      PID:6976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3544,i,1440108412742256634,5171477129395510292,2097152 --field-trial-handle=2120,i,15489363618101969669,11605231113713434561,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:5168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3580,i,2217883100423651575,17331829403300450317,2097152 --field-trial-handle=2120,i,15489363618101969669,11605231113713434561,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:9
      4⤵
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3624,i,17893856870180505211,16330581515659608185,2097152 --field-trial-handle=2120,i,15489363618101969669,11605231113713434561,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
      4⤵
      PID:1264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3620,i,6001497187597436271,18398016729821409585,2097152 --field-trial-handle=2120,i,15489363618101969669,11605231113713434561,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:9
      4⤵
      PID:3264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3676,i,5812485209957975292,4854999011244363962,2097152 --field-trial-handle=2120,i,15489363618101969669,11605231113713434561,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
      4⤵
      PID:580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3708,i,9101580318257444183,15129447001856226318,2097152 --field-trial-handle=2120,i,15489363618101969669,11605231113713434561,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:9
      4⤵
      PID:7088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,5594045077864630772,10546266006914493519,524288 --field-trial-handle=2120,i,15489363618101969669,11605231113713434561,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14
      4⤵
      PID:1096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:6228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,16938552027784550707,8758282727391060396,524288 --field-trial-handle=2120,i,15489363618101969669,11605231113713434561,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
      4⤵
      PID:3140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=592
        5⤵
        
        PID:6864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,5685593879290908879,12875582145208057890,524288 --field-trial-handle=2120,i,15489363618101969669,11605231113713434561,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
      4⤵
      PID:5612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,7879053430743700273,3904540378977532932,524288 --field-trial-handle=2120,i,15489363618101969669,11605231113713434561,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
      4⤵
      PID:6960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,8059038124769228929,11171751085629362249,524288 --field-trial-handle=2120,i,15489363618101969669,11605231113713434561,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:14
      4⤵
      PID:6832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3868,i,787930334259556766,8545098833610331455,524288 --field-trial-handle=2120,i,15489363618101969669,11605231113713434561,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:14
      4⤵
      PID:6796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,3965196725553488954,10104488490059662019,524288 --field-trial-handle=2120,i,15489363618101969669,11605231113713434561,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:6432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,3965196725553488954,10104488490059662019,524288 --field-trial-handle=2120,i,15489363618101969669,11605231113713434561,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zi5k52i0.hff"
    3⤵
    PID:4888
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\zi5k52i0.hff
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:5864
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270331 -ipcHandle 2056 -initialChannelId {fa683bed-87ad-4f09-8ef7-c8675f2d4ef4} -parentPid 5864 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5864" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:5000
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2212 -prefsLen 27133 -prefMapHandle 2216 -prefMapSize 270331 -ipcHandle 2508 -initialChannelId {01f8b8d6-48d4-4497-a0ca-0ff8e2856dd0} -parentPid 5864 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5864" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:2032
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\fbdbf830-8a8f-4a5e-be4f-d1e1026714cc.dmp"
        5⤵
        
        PID:1080
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2896 -prefsLen 27133 -prefMapHandle 2900 -prefMapSize 270331 -ipcHandle 2280 -initialChannelId {4a9fb557-2e52-4743-8068-7690e7ba01c8} -parentPid 5864 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5864" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:2976
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c4e03aa6-d7a7-47fb-be34-42961e5b2b48.dmp"
        5⤵
        
        PID:6956
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2280 -prefsLen 27198 -prefMapHandle 3068 -prefMapSize 270331 -ipcHandle 3060 -initialChannelId {18677ba2-2c19-452a-b3bd-faa420152154} -parentPid 5864 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5864" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:6760
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3560 -prefsLen 27323 -prefMapHandle 3564 -prefMapSize 270331 -jsInitHandle 3568 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3576 -initialChannelId {33660442-88b2-4422-8a94-abd670677555} -parentPid 5864 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5864" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:5596
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e9f7bdaf-2c0f-4bb9-9aae-2e4190adbedd.dmp"
        5⤵
        
        PID:6836
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3744 -prefsLen 27323 -prefMapHandle 3748 -prefMapSize 270331 -ipcHandle 3780 -initialChannelId {9252794a-9bba-4b9f-8854-f47d459852bf} -parentPid 5864 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5864" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:4244
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b4d5192d-4ea7-4594-915a-f05621fa883c.dmp"
        5⤵
        
        PID:2452
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4224 -prefsLen 27323 -prefMapHandle 4228 -prefMapSize 270331 -ipcHandle 3532 -initialChannelId {f65ebbce-17bb-4a1a-9adb-c8f0252a56e7} -parentPid 5864 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5864" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 rdd
        5⤵
        
        PID:2780
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3000 -prefsLen 34876 -prefMapHandle 2940 -prefMapSize 270331 -jsInitHandle 2928 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2832 -initialChannelId {4f0d8a30-b055-4794-8101-1fb2097ad544} -parentPid 5864 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5864" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:2528
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5012 -prefsLen 34876 -prefMapHandle 5016 -prefMapSize 270331 -ipcHandle 3260 -initialChannelId {8f66fb0c-0da1-427e-abea-f6fef6f11ea5} -parentPid 5864 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5864" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        5⤵
        Checks processor information in registry
        
        PID:4608
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5088 -prefsLen 32766 -prefMapHandle 5092 -prefMapSize 270331 -jsInitHandle 5096 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5016 -initialChannelId {1f219a29-7b83-4fbf-931a-1d5c905b3e75} -parentPid 5864 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5864" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:4228
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5264 -prefsLen 32766 -prefMapHandle 5268 -prefMapSize 270331 -jsInitHandle 5272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5280 -initialChannelId {914d2981-d2b6-44c9-904b-7b686dde6de8} -parentPid 5864 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5864" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:6936
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5220 -prefsLen 32818 -prefMapHandle 5216 -prefMapSize 270331 -jsInitHandle 5212 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4124 -initialChannelId {f41d9852-4402-439c-b419-949103ffe201} -parentPid 5864 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5864" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:5184
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\p1whi05l.wyr"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1860
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\p1whi05l.wyr /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\p1whi05l.wyr\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\p1whi05l.wyr --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffd665ac728,0x7ffd665ac734,0x7ffd665ac740
      4⤵
      PID:6792
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\p1whi05l.wyr" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1616,i,14752427100231416453,5878176130070257996,262144 --field-trial-handle=2044,i,12223198974949154502,14198006646791761606,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:2
      4⤵
      PID:3176
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\p1whi05l.wyr" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1816,i,15010758165127199664,3031012164545152352,524288 --field-trial-handle=2044,i,12223198974949154502,14198006646791761606,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:11
      4⤵
      System Time Discovery
      PID:5112
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\p1whi05l.wyr" --force-high-res-timeticks=disabled --metrics-shmem-handle=2152,i,10278010814263122465,7650380956192474990,524288 --field-trial-handle=2044,i,12223198974949154502,14198006646791761606,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:13
      4⤵
      PID:6996
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\p1whi05l.wyr" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2904,i,9135754081844563569,4882776715917737858,2097152 --field-trial-handle=2044,i,12223198974949154502,14198006646791761606,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:1
      4⤵
      PID:5068
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\p1whi05l.wyr" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=1632,i,17833124121234078977,14845255466617926405,2097152 --field-trial-handle=2044,i,12223198974949154502,14198006646791761606,262144 --variations-seed-version --mojo-platform-channel-handle=1148 /prefetch:1
      4⤵
      PID:3916
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\p1whi05l.wyr" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3096,i,3019849054424017346,8368907869145956871,2097152 --field-trial-handle=2044,i,12223198974949154502,14198006646791761606,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:1
      4⤵
      PID:5440
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\p1whi05l.wyr" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3112,i,12568527993170267383,11456967465406334461,2097152 --field-trial-handle=2044,i,12223198974949154502,14198006646791761606,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:9
      4⤵
      PID:1104
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\p1whi05l.wyr" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3992,i,12403311542480554599,15712481121165034124,2097152 --field-trial-handle=2044,i,12223198974949154502,14198006646791761606,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:1
      4⤵
      PID:7028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\p1whi05l.wyr" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4168,i,8277760118248848076,9124256256341319080,2097152 --field-trial-handle=2044,i,12223198974949154502,14198006646791761606,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:9
      4⤵
      PID:2308
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\p1whi05l.wyr" --force-high-res-timeticks=disabled --metrics-shmem-handle=4480,i,1227754261814922855,2833488831169178759,524288 --field-trial-handle=2044,i,12223198974949154502,14198006646791761606,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:14
      4⤵
      PID:6980
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\p1whi05l.wyr" --force-high-res-timeticks=disabled --metrics-shmem-handle=5172,i,4966886997391064283,4618380336683615881,524288 --field-trial-handle=2044,i,12223198974949154502,14198006646791761606,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
      4⤵
      PID:2976
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\p1whi05l.wyr" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5276,i,16996817905695642939,2430230257298136806,2097152 --field-trial-handle=2044,i,12223198974949154502,14198006646791761606,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
      4⤵
      PID:816
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\p1whi05l.wyr" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5292,i,14265871687977618292,4786428642598598330,2097152 --field-trial-handle=2044,i,12223198974949154502,14198006646791761606,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
      4⤵
      PID:5380
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      PID:5596
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff6998e55a0,0x7ff6998e55ac,0x7ff6998e55b8
        5⤵
        Drops file in Windows directory
        
        PID:6940
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:4004
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff6998e55a0,0x7ff6998e55ac,0x7ff6998e55b8
        6⤵
        Drops file in Windows directory
        
        PID:768

C:\Users\Admin\AppData\Roaming\Payment receipt 2.bat.exe
"C:\Users\Admin\AppData\Roaming\Payment receipt 2.bat.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5352
- C:\Users\Admin\AppData\Roaming\Payment receipt 2.bat.exe
  "C:\Users\Admin\AppData\Roaming\Payment receipt 2.bat.exe"
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Users\Admin\AppData\Roaming\Payment receipt 2.bat.exe
  "C:\Users\Admin\AppData\Roaming\Payment receipt 2.bat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- - C:\Users\Admin\AppData\Roaming\Payment receipt 2.bat.exe
    "C:\Users\Admin\AppData\Roaming\Payment receipt 2.bat.exe"
    3⤵
    - Executes dropped EXE
    PID:6728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5920_13415906154071792.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5920_13415906154071792.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

664_13415906154042739.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\664_13415906154042739.pma
Size 696B
SHA256 a7b9a05b043222171de04f38a2f514c0e50a144a524def6b527eecb1e91d7400
MD5 976a0e0f71c3a5a254d24e0ee6648de8
SHA1 e66dbeb0cc0fd0ceace6f7c309f0c3bc8b59a00a
SHA512 cee06480ec08c0cb3ca87d1471f8b027ed4d38266536f63ef55949ed5fdf789388b64de29823fadfaf09394bc1ea8bae38ee88daa7019f86412b8e52d6a2570d
TLSH
T1C1010E46A3144F77CC428D3584FE27512BB5FA501B821BBF7B10724F2E021C89E99168
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 70361fc5bd4a7fbfa22050ccd859760c6116cf7d33bde25cb161d909d05030dc
MD5 4f53605ee73bf1920f9e0fba0d5ad6e1
SHA1 a5e8ec2eed580a327ddfd06260683e06f9b18933
SHA512 fe47f4dd7fed6677496a5e7df825d4a981f1a4a7c30ef49e250a3966fdd74173d58b0d03905c0abdd1e21bb04d84ca496a6bd3165f3f6d0f32415ca9976105b1
TLSH
T12831AF4EA2113067D6417F72D8CA7E83CDB132476BCBD46B18446E4229AAFC15FC80C5
MD5 SHA1 SHA512 TLSH

Submit Download

9E62DD75009A293E0AF9565AE544F23E_C5DC66B967C4A97E401F60B0221602AA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9E62DD75009A293E0AF9565AE544F23E_C5DC66B967C4A97E401F60B0221602AA
Size 280B
SHA256 246665c9ad649080cdf099da8bf408ccd0833983bc5693ce2ad23116a8bb8186
MD5 aa5c86583d5180f2ba5d7f4c76de17d7
SHA1 9f65f37f76fa37ade18b2df1926e7338f8bc1cc5
SHA512 81c327d50b2bfb4b97e3b8790a02bc7612954cf0087d27fcdb279cead54cf6c8259bb275dfc2f7884607fa6db71958815811e10008b4a687d7d781bc00f8cfec
TLSH
T1F9D0C20B11AE2640357684746CECD7343A9184918888194958E2C7A2509BBF8E216C00
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

C60C0C29522E01E6A22BD2717F20782E_28FABAD10A333A20D63515592C5BF0E5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C60C0C29522E01E6A22BD2717F20782E_28FABAD10A333A20D63515592C5BF0E5
Size 279B
SHA256 bfb1c668368d2258b73031e027f11314324b9feef5b7bdf0c00a50c408df3b07
MD5 304c871bc4d543db33419b57096371e9
SHA1 ad79174cacb2a098723ae270dd7b51f7e117f557
SHA512 a7e2c6c4789f24d7954e4ba43e47aa4499b8f47a2c71e9733eaa3cc0780c4178bfcc61112bd739ff794399b4459cb3440c1eb335b55e8b9a3037a81aa3822854
TLSH
T19DD02B57512D67D83421D5F16EF9CBB43396D0B00156A59FD0EAC361044AED85537E14
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 6b857438b4b09197cedc6e00f96499e0ad4d61bfbb1076a3fa97b067d6c5650c
MD5 028b30c4c0ed1f0db774ff66be2c6de9
SHA1 105ddd9f2d69766bdf3741e0d2cafa1c11d43e35
SHA512 20f17810793e5774f4fb7c4ed2241eceb2ab1fe11d14ee8dbc29c9481b058af2395cc84610a490ffb4534c3319c40bfe3865282c06890cb5165940f266f11f26
TLSH
T168C09B2237314615F1215A7F5993B73147FDD1108EF383056671161D7C16E429CF9D16
MD5 SHA1 SHA512 TLSH

Submit Download

9E62DD75009A293E0AF9565AE544F23E_C5DC66B967C4A97E401F60B0221602AA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9E62DD75009A293E0AF9565AE544F23E_C5DC66B967C4A97E401F60B0221602AA
Size 398B
SHA256 c17dd3a9e66cd726cfe7898ab698e1bd5fc0d629cb1f32c3d8d5fb51152b890e
MD5 ffb6de08560ff9688998dc62ac508d10
SHA1 209f3ee359c5b791d157114615026f6c19e278be
SHA512 6d1fc1945a921d41d980f6dfa52d4c299ea06dc56bb4648620dcb21937778ca28c1203e829c5e61b56d43ec11b1dd58cee001b1f6cffdf4ba33d95df67b507d7
TLSH
T1FAE026182AF7019CF560E33D2FC1D9E109EDF50314A866B81C65070ABF22AC55C41DB9
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 bd5fce391287574f5c0cd7598ea81b74e7e4ce5588188febf57f0923ba86cf15
MD5 fc72804a0df26dfb9838cc97957be352
SHA1 93d7d8d824e547bd1e6d8508b6788cad59036fb2
SHA512 389a65c6feaf9bd404dac10c45f8b764f96f3572e43ab237766083b33988e6060ba0169f5dc0c3bdf73113bee04fb3307747bf605c750510e4018de61bd42972
TLSH
T188C09B54B3754719F10E213D79E51B041BF94106B6D6C315477451348514B4008B1D05
MD5 SHA1 SHA512 TLSH

Submit Download

C60C0C29522E01E6A22BD2717F20782E_28FABAD10A333A20D63515592C5BF0E5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C60C0C29522E01E6A22BD2717F20782E_28FABAD10A333A20D63515592C5BF0E5
Size 398B
SHA256 004eab2226900aad2d38f3d457cd5a174d33ea66fc40d74ac13bb0c3e7c4e2ba
MD5 7acd803f344a4a0360b609ba75079f76
SHA1 1a91dbd163f6d381833c7ef32dcb19acad452913
SHA512 562a3de00c7cd9fe4f4043017ec4aca92a4c2387c25c59002406ddec0451a9a5454750230ff395d6620ef5085258ecc53a59692768a19c463371651b11682d2e
TLSH
T13BE0260805FA005CF1A2D3F8AECAE971499DF003146482B919B15709BF12AC56C82DB4
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9zyrz34.default-release\activity-stream.contile.json
Size 4KB
SHA256 12e4cff4789fee607794984ce4a36b88537e04f1c51a96c82f099286ab045f51
MD5 8c919de4fa5b82c4033a24c11f1a3a17
SHA1 6331244d49a190712c4c446ceee6e2579f22c105
SHA512 68ac76ef113c435f90dae15010e4226a91b6a52f26b2c26928c7ae1918b7c7121812637e0a1c48c7391d6d74d876d91ba3f190c0f6d961fc38463eab8876f7e1
SSDEEP 96:KmjMAt6cZrp7dsESfW8DlgU8zaEvdsp6ezGqb7l:KmjJt6cfd4fxlF8fvd2zGqb7l
TLSH
T173A1E6DFDC39948B472217E8AD4F277DE003E1465BEA9C44EB41CC11A5A57CE42DAA48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9zyrz34.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 49c0d747a9584416aaede45d8826554b6e78dba8f3f21a504c40c1b3597c8071
MD5 c4e967215bbf3d3af68bb07188ab6442
SHA1 ef3f0c96e3ab21e589bd99e4d626e123d8597160
SHA512 ac279994f85617ffcc8576bfc0adfa0b8d8960fc2a9777c9fbaf5e183b42d59555be7f926f12e727546cf9af57b2bd086e927bfd4c21ea4ed6ac75f0168f2687
SSDEEP 1536:j1mTVKo4hlEoNslItWyyDDathEwFofjfzfl5:j1mso4hlqqooPEwk5
TLSH
T17D731C63A3A8B1BB1F9137DA2C4B7A4B56D24149F38506CDFCEDCA1CC18D644123A6AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9zyrz34.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 47cc8f74eabed00888d42abbec001e6843b3afe886299a17b79240d3f369ad7e
MD5 3960d2da1647907f41ad66d29029f87b
SHA1 0e99ee1d9226340c95b5b4c5668c1a76ef18f273
SHA512 a1a3cd76deeea03422c8d9e13c288e3677757b4820b035a93accf6dba89756b01709d26d806a84c354218dec488396f5ffc00212fc3a9063829a3c6e20040086
SSDEEP 1536:jTrlif/DDma6MTtO0VsQ00JIWuTEVKPXBn7a53K0oLkpsZw3OFhZ9UyXEjQv7suX:j3lq6MTJSRPTEUROpNOx9U70sqdJ3
TLSH
T1D8A3BFFACFA2CE3D55FFD02D5A82893EFD362404B3A72019C863671461C6BB87675648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00eff512-de08-40ec-af63-7a67cbe0a14e.tmp

Path C:\Users\Admin\AppData\Local\Temp\00eff512-de08-40ec-af63-7a67cbe0a14e.tmp
Size 146KB
SHA256 31e3cb755cf2d66510c7f94c42df615dc13575ad2e8fd5a63887ca145424d34e
MD5 98144a4b67ce21832c45a0d20d3163fc
SHA1 d5d7d718eb78e4332899326f111796da8604a2d3
SHA512 3e25330d1ce5810426da57aff275d2ecdd09b6c0cbe4f7534cf8bf17c39f595dcca147b204b6f74396b23160757cc030753c4c227b0dbea54f489b9016459ae8
SSDEEP 3072:w0mACj/voHPqreKLgf7UxnNvVx0v23PPb3jLqX0kj2y7uzTs/oGIZnn:w0mACj/Yq76U5zx+cPP73qX0kj2yEZn
TLSH
T1D8E3E06C6EDAC806C45B60BAB915F0CBC5068F3BAB49741FA64948684D70B4E07F1EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c8c022d-a81d-4693-b8de-7062b0fb4927.tmp

Path C:\Users\Admin\AppData\Local\Temp\4c8c022d-a81d-4693-b8de-7062b0fb4927.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx\Crashpad\settings.dat
Size 280B
SHA256 fbc4554b249388758f5b8a4ee4eb2c0c5080cc77986462eb8fd614d4a18103e1
MD5 720b81ba04cc27572c5c11968af9c716
SHA1 5bdacd484df35b12b8a7e80ab6bbe4229dc48648
SHA512 af2a67cd0c0b67a7ce9beb3df9703f5a50a856f3ed877701f8828c3b40b5efb75cda39069c5736b54cf8010c5be71c6da2202d699b4d47b5c829c9591c053d76
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx\Crashpad\settings.dat
Size 280B
SHA256 46191176cd56e048da66c9bead4360412e73bf43f5fce731b91a6327b8fe5654
MD5 def77bbd498970b3380b384e745e0041
SHA1 9e64a642ba6990aa9f42b0a7105bad76a33bb933
SHA512 0a5863e6c5b64c1a01e82d7a429ba12a26fc298f2f7f1cf2af3718301184dfe02b94d4fda16435fa1a3af481c09b38d71e469c800c6ff178d50143d9d4feb3c2
TLSH
T1CDD02200FB032A02C3BC88B3323BAB8308EFCA00280202E038BAE08C0C00300028E080
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 6e45092641531b3375d3f2c8573727fdb8cd5badb1f3a18cb622ffdca2778da8
MD5 accf25aa2f531a0f3c59b4185fddadf7
SHA1 1f9ae8c835b42af882694ae63c1de4446f8411bc
SHA512 7423e8329bb4f1be0650c19b76d80be7845fc01cf67652eaa127d5def23cf3b025eb896be3df4f9d8ddebfca3cabd6579a06db437d950b992e443b1d2734ad9c
TLSH
T1C6D02BF628F51410DE7F93E3547100A14423BC90C901EC4E0129729310B131A2C17C20
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 ca66098dbc8d1c0e52a467a1766e0eeab66735f6ee13288780ffc26de1d8b1c8
MD5 2bcb82505ed0b3c3da4efc1a095f6b0a
SHA1 7ec7974e4b4700f37a2f3fde4967c76b20dac607
SHA512 e03d4479b6af673e45e968eed7a9c115117237a4277e36cf03d2fc377a4e49de1a368e07481e3e1b91d400902197360901f675d15d1a8393bb6cb7480850ef7c
TLSH
T12DE0DFFA2DE72820EE2F93E7547100A1446ABD94C900BC8E2436729710F2749681AC72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58b90a.TMP

Path C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe58b90a.TMP
Size 153B
SHA256 60edf5125a016c0888136fc7f581ffdf83ff532fee2c767b3a641a4a05b0928c
MD5 df6e4f1f23a56de5d6e34f94d45dcaea
SHA1 2d10ab79cf002aa6828fac9d6e6189dbd2db2db5
SHA512 5e08cfe20da8ba9049170975517463d20f9b65f6bf1ff6a40a74ec8ee57c91f54a060c6eb886009e58f7fb2a568ed886b06db2c544638601d390344c1aad1d29
TLSH
T1BBC08CB728AA1800EE2A53D3413228F581366C88C940BC4E801E71C320702223126C20
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 25a37818884ce1510b5e5d26a43090e18f694be3c42b39e3e3b1e84faa78890a
MD5 26e3a2e175947657e530c831fd8740c8
SHA1 bf7be5ae102c2def9276571ad23ee528ee163d4e
SHA512 9a63b48260d8eb2ba1c414a274e47ffbbf57349e15f80e9fe0bf0885025fc9f444ed52f5bb359995c5c7692580a07df667885a437ea9a07be38e3c9c8224c297
TLSH
T1C7216E20793F225138FDB6C891D48796924130B3B2ACE43B76F8085689AAF115DFF4D9
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx\Local State
Size 4KB
SHA256 c89cdc2c54f9429a996dae26459d3f5e42783175413808004d2394bdc6d3a4f5
MD5 69a5b6a7f4015999a5b8843559e5fed8
SHA1 63368613386d934a8f04b9070c3d076034af1bc8
SHA512 7ab29a8cf90d58ad95b600f75a86496bbf9ef2fc8b3a348419fcf79bc52752a7bacf9c6255ceeb54a5b220a67c0dc2aa2601c653ea3dcd46b50261516b9ed7ae
SSDEEP 96:wqGNkUQsFfk/xO58Frh/cInURoDotovnOnDYBTgvgLhT0eUnbuglq4a:7GNYh//ooDUwODshhTqbVu
TLSH
T1F2A1A5716568FC679DF5A944B5C62792BEA82077E885BF8CE6D8160C04DB388270AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx\Local State
Size 3KB
SHA256 e92293968cb1ecd55b105444e159d4ed3337ceae7a706ad4140f6bcfb154f991
MD5 2c8637afe41e4cb7174cfbb08412cda1
SHA1 605cee1bbefd802f861c1345167df35bd8814627
SHA512 16ec804d6637669056c772c10b9596e08730646a4aa4b4d43666b7e9f97fb9db3720ee52c0557947c61f266e9b4978b6fce3ac99ca511c8dccce9695db9fbbee
TLSH
T10181A8716528FC6399F56944B5963B93AEB830B3D941EF88E7C9530804DB7482B0EC37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58af85.TMP

Path C:\Users\Admin\AppData\Local\Temp\dbqfh3ay.trx\Local State~RFe58af85.TMP
Size 1KB
SHA256 94f5434949d1efc7c3e4f7bcdc34859f9a6549a5776a851b1c774420004ac02b
MD5 427202d32c3c672ec0c1c8c568fcdedc
SHA1 22778efb3ce99ff631205af99b1e9d9fc6e0a33a
SHA512 9f1dc5e64c70a42c4eff65728808a6c2370ccc2a7136e40029371c29e64054eef0e71529e2c82d201d9a9cadf0b26d393b0c09f1986b359e50620ba26b91e505
TLSH
T1D0315330A5987DB7FCB05545B28A7B536E782036D1416E8863DD121804E778C221EC37
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png
Size 1KB
SHA256 23fb4d1613fb426612119928a7222ca84a9cba4ba081a8b1be7f2565c013c590
MD5 520121a67f0bdc7a327bd49d50090dac
SHA1 648e3fbcbbffa431fd2480edf0a342b6920fb3b5
SHA512 36a89b73c4de9d9ef98becbbd31f286014163617063600ed22779e1e87ac35cbfb8341f9e4300994352570b1223719256c0d698dfa4aeb38e7d3907927a79a92
TLSH
T12D11E5B643275C67A2B3011708E03ABC8D605898F02B4A9C90148799360BBAAA4ED3DD
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png
Size 1KB
SHA256 7b1aa50219251762867246b79677fac99c1b61a4ef4e471ae3473c10ada2c50b
MD5 c633806d580f67b98743782c74dde9fa
SHA1 8acb5f35cd7ee2e7d3174ce06d399d46dd275ccf
SHA512 04cbe1571369525f4aab0b2a9fddbb425e9a935d9307d3b4fd2623899644e15419d0f7e0d33372a46442778043c03448e8130d892b4978aedbbcc0a785eaa9e7
TLSH
T1A9210BF662715F4EC79B05AC1FC14A676310122D665033AC5C2594047E4BCE78DB4D17
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png
Size 1KB
SHA256 2a560cdee5965876269d30cf82a85b83aeac16903d4f325209ca3354b971c25b
MD5 310d0edac146f7ce3e4394c066348637
SHA1 b1f1be49560ccb7007700fdf86a5121eb99eaffb
SHA512 1db1aebc30d4912eb9f3474476a2ca3683d078e3e141fbb7964402d01cc5fa5c2e24a1af7b4fad2f19b731d4b26ec9616f5406bf84d66d164a716e9084921156
TLSH
T19C3187F0F47B2D96DF75AD3427028960E6559E962D93DC109D482EE94B0C70981CE163
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 ccefdc2d816137b5954b591e8954c392e0cf27388fef2e437991e3999d9ad3d8
MD5 efa437b6fe5031994d5917a91c19990f
SHA1 d46a1115227ead4e92346b600c28e9ac72cce96f
SHA512 ab52261f15a3f21728b41b4765da5ec6c9e71051b720204ee2decf6f09ac8a0c9a5c12313d921f232f1e698a7425d34415eca8db21a37f423535806bcdf238bb
TLSH
T1F3310AC7644047BA52EDDAF37F6B0C57DC12210107D4A440599F56E17FEEEC86015478
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 bff87e21fa845d8ce3c266db6d904e9c7a3bf9fc2b95a1f1a5ca375f3fdb045a
MD5 097f67b0d583db3f8487ac27379c7eae
SHA1 18acf62fb9bc4e95899c4597cd72de66b6bef763
SHA512 0b6b323fa14e5b0dd6bb87fce791bbd0b7a867988d8332385ba76a35d93d4dd5b67f6be9be5a69fbdcd5da68c30bc840712daa83b9a0187b727d963dc9a9a045
TLSH
T15E514C54BEF34CB2EBC67C7254E65BF5A564C1E62D407A0C86B9CA1245BDD410CCD003
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 3KB
SHA256 abe4eaa1a6fa423bcef61b423dc72386a9cf1968b1041de5270c56a7780254ad
MD5 8e589c60e0ba95ca1b178bad0a8298db
SHA1 d981cd3f9eb63636471e3bd4c0fd7585460ad6fd
SHA512 e8c7b5d340e698f3b1b42d6c3b7653b666e0add095611c00f502782928eb788070ca977b54b42f9515127861e55138a3cc0f02540f0bc2e44694fb0ea595ee34
TLSH
T196517D1B4B8AC56A0E53770E02E57ED454996C569EF383CC2106E7C0081A99F43EBBE7
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png
Size 960B
SHA256 c6fa451ecd1a8a9533801028bc70cf82ef48eba11bb835e53e6c530b43018938
MD5 8fc407c5a96f560cfbb46503741dd11f
SHA1 31eb59362b3c99abd75bdf605bdf46d793ef99b9
SHA512 7ed6d7c679ab5928427095beef9ae476e8bc57a5c81cb633bce1b646a896557b5b49112d489b2112ac2749e1adaf6b1a7544be36c570696fff80725352eac68a
TLSH
T1BC11CC5290BD5338C4D16953E04223E10E566CFCE4EE91366B8FC80D893EA5D9CCC621
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png
Size 1KB
SHA256 3fc8b8392989fb26381f0a14bb356cae5f998a4dde004c06a51e974034f9ccfa
MD5 b75ce0c6ffcbdcc1066a2e6c8c3aa5fc
SHA1 2ca49f0080b985a68692eee2582298a9353c7916
SHA512 a3ac3a8cb7de26b7e4fa126497dcc228462b04da9a99a0b4647c1d8f877131f6597af80c3d7e834b50938a6c1349ccb14e9e0dd0b06673fa789d78e3e499bf7d
TLSH
T15C2196C3239DF6E5E54D50A745CF1B12F7BF375829B4A058A08E42C502B77C192CA534
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png
Size 1KB
SHA256 f6ff978b0f4c0d28e96b27b6242565480a73615b03a4b95640f8d20136fc2a91
MD5 518326c327ce412aff2d0f63700b372e
SHA1 24b69d3fb978c36bd349b516cbb5720addcac515
SHA512 fa4c22a9c51cb75ef04984ac10ee068fc9d262b7cc2f969f537784bd71240359cb3c34d9789b043f43e7109e7028b17da50074cba2b8759ea31e5ef2898b0707
TLSH
T16E21E79532856E7C8FA21F4BE0642A1DF2761D0423258DA603B12CF10CE040829AD2A1
MD5 SHA1 SHA512 TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu\Default\Web Applications\Temp\scoped_dir1492_1783361312\Icons\128.png
Size 5KB
SHA256 63be4dfbc222f0c026579113af9aa7dea61e78a166ab9af053b46c1e172240ff
MD5 9cafc16ce8040254ec411cc5a8f954f2
SHA1 0d9841be48e134edf43c7ef970d24ddf852d155e
SHA512 aa1e0ac8d0647ee6c0b481e671b20fc68ff253dc72748b2aaf22f15bd8decd2b9723b16f8cd4c19d9a250abaa8d517101bad6ebfed7fd3a90ceefce02c1b3b75
SSDEEP 96:ALdfTPsPOWpgaNHQxO20qtLppvSFLtGaoFuPhQd1YDzpsE60tkuuAaw:m16NHQgoLjvSVtY2h6CDzpsErVu0
TLSH
T119C17E55555D711FD09D157110AF4A0F31A7E2AAC3785720C97E1BD0F88DE4603A3EB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\kunfhczw.wcu\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx2566.tmp\System.dll
Size 12KB
SHA256 014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042
MD5 12b140583e3273ee1f65016becea58c4
SHA1 92df24d11797fefd2e1f8d29be9dfd67c56c1ada
SHA512 49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a
SSDEEP 192:gFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/nC93:E7pJp48F2exrg5F/C
TLSH
T15D425B0583618EF3F5965E3C00667E2F2B79BE3416F100A39FE34481A99A1CF99B5392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

192.png

Path C:\Users\Admin\AppData\Local\Temp\p1whi05l.wyr\Default\Web Applications\Temp\scoped_dir1860_1541646096\Icons\192.png
Size 2KB
SHA256 e401220b69a76a298b2e081a5424af69791a4caa3936af85d8862c05f4ced4a8
MD5 e063d7ac57fed2391e778c3a5817bfed
SHA1 3fddfdcf2917af9ce0e86eddb03725d4a3cdd7cc
SHA512 0de76ca2917cb2162d73a3d61d83dab2795ef1e9ca0f057091cef9eb79c0064dcd13c4749521163e6f77dfe43e0afa68326a32b7c19d8524da509dfbf4f1cb7b
TLSH
T11651060A0759BDB22A31C07991B8D9E7DE0C1003A5BBDD7E19954FF0A913CE43B23681
MD5 SHA1 SHA512 TLSH

Submit Download

256.png

Path C:\Users\Admin\AppData\Local\Temp\p1whi05l.wyr\Default\Web Applications\Temp\scoped_dir1860_1541646096\Icons\256.png
Size 12KB
SHA256 6e8f581f4cee7f8f8af4a9e1059f0d3088b792de7045067d74254e2a6f1f9a6b
MD5 493ff5acf7b11c3f1147a8d9e25e7751
SHA1 6009b5d4c6cf66b4dea48b5c558fb9dfee261c4b
SHA512 684256b0a9d8169eb1c177068c0c04518dc1c1a6c2554c32beedcaf0bb4429902319ecb32d8c97671ba361de6e10e9275e8ef778f61934f38538f35b60a963bb
SSDEEP 192:Hlx0S8vKsNbVmc/vC0+e9JaSyw2X4RTv+ovsCF3vKY8XejYHvhX2kol0f993M:T0vdNbQ72iNXX6rsCFyYAZkh8LM
TLSH
T19A42BFA1B310ED73E30AEF2045FE64B0516C82217FE4A507D331D85ABF0FC9998A95A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96.png

Path C:\Users\Admin\AppData\Local\Temp\p1whi05l.wyr\Default\Web Applications\Temp\scoped_dir1860_1541646096\Icons\96.png
Size 3KB
SHA256 00f563fcf365eb53a4037624ab3783dd6e19d2c6689c9892aa30ad2b16577848
MD5 43400a5061af952e87a0e06e1062b272
SHA1 5b937e80e93bb5f526a964e2a28aa9579e8dccb6
SHA512 8f3f25039af799f055ea81a2008530562b4b24e8afd65b65566b6dd0cdcc66f3735bf0428bb3c4eaf7079ce15499de3846bcdfc1db0707db50e9f3bc2c5e7d6d
TLSH
T14F819F6325E9E9CAAA5ED62071224074845F04EF59313775F07C18BB13CA56DFD70E26
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx\Crashpad\settings.dat
Size 280B
SHA256 2601b4b990fa6e093cee23e5d5687cd4a54d2861360cf0b663f9562a0676f35f
MD5 d1d1183dd9f086d56c47c94f27914b0b
SHA1 9ffb53a1dc9aecdbef10a58ef9b9ed0816134462
SHA512 ee6e6a091c08fc5d2c3fffc1b57c768eecc719370fb26341c889763e8f7aa8aedd2e24eede616072d573608b36797d00f21bf1857d46080856052d766c96fd6a
TLSH
T1E5D022B3FF000C2BC2882AF220B88380CC00CF0022A823000E8A00EF08E08288000A08
MD5 SHA1 SHA512 TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx\Default\Cache\Cache_Data\f_000001
Size 34KB
SHA256 8c97e1a3437f857eb8a346a360274ea339a09eda1b965ee1445d870c09b066ca
MD5 4227139d34ecd3be139bf6c7d75fce5b
SHA1 0e984113aa96daf31d002392523ad0dfc9cc3870
SHA512 bdb38f430aa623a17b26044288841a07c82691ee858325b158423839fad99a75b192fe0df269898cd76e22a7e54250611f852ccb763ce82db2f7d1c4eb6fcb52
SSDEEP 768:iFPCuSWxAknP3gQlE3brX+48360GKKAC4FZ8ELh/SAE9gnmlV:iFPCuSonPJErr18ZGKK1oLQH95
TLSH
T108F2F19E3208478D3E6CC638A9C912E24EAB58D8CE3DC702B21DC24FA25C5590D9ACCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx\Default\Cache\Cache_Data\f_000002
Size 398KB
SHA256 87c03baed627271d73bde53208756a0de6c5537739eb9a46987ea0e167dbbfc0
MD5 40b7b79f74238dce9bb7ceceaa35e48c
SHA1 6536ce40e084bc6adadd2297128c5193e7e6f469
SHA512 9d3bd90fb5bda4ff2b22800d288d3bf34802d4455c6dc301f812caf291a756159f5d079db4c407b01729b892dd806c31f76ed67c3c582a3c797d90b34014bec3
SSDEEP 6144:cB9kYUkEl8XstbV5BmTmF/s3GCdAyd31+9p5KgNzx21yteC3Ot7xDAFJVBvf:c1El8X4bV5BAmFkfuA3w9pE13RKTf
TLSH
T180942387E14FD6CC51F9C6F6494D5BAB8AABCCB41D68C2A63DF79B38E008094357121B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx\Default\Cache\Cache_Data\f_000003
Size 65KB
SHA256 86d957ceb243ea402d3240cde0312034790ca12ae85eedb1029eb23e90c655ea
MD5 0872400f71b637a5ff54d2e8343a8753
SHA1 efc6ea1d6df8ecf172980026de188648f4fde367
SHA512 7bd43073d670ef01c9db82de524e2663b77b8409e8939576db52623e7d6806fd0938250a4141cef6177ecce92c5f3a146a78bbb64495a6fb3ff46bd0346c875c
SSDEEP 1536:53DBSbMhX5/eTgSHrfTh40gka0Hp9+l/jXv0wDxvCKaPJs6l:VBS2XfSrllgyJol/jXv0wdb2JsC
TLSH
T1766312B9216CABD9D999DC7C325AC619A81217E6FC2D09580532301FCED3BD83A79C3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx\Default\Cache\Cache_Data\f_000004
Size 99KB
SHA256 cad25cfcc108f11e81cf1a339916e956b5ccd3ab3da38a3bd7a3a7a01adcd3f4
MD5 86e9c0ad8befdb46f1ecda1d3f2c70ad
SHA1 cf9520c235db04ac02e98a7f7c9f3d5d631d4199
SHA512 30a1265891f03df0c46d4f310d97ffa312b84d485a214d895a1c5e260474260d6637592b20d9cf4efa507c131694f63253577fdb352e8e0c46505e02183e0ab4
SSDEEP 1536:GAqrSnLU5BxYE4bP9zel9rbvjJvNCLtY25wJ0qPKldrT6LTMyT2ItH3RHTZ:GAqrSLSvYEwsVbrTfUPdqL4S2iTZ
TLSH
T1AFA312D04BFD43FAB569BAC3256ED48352C0B330AF12B835501ACD9F61D0FBAAC65265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx\Default\Cache\Cache_Data\f_000008
Size 16KB
SHA256 140aeda31ae3ecfa13ad6e3fc76ea978b15f008cb8ec5c10520cc8c6f529260a
MD5 f1fb1822e2ba005ff8ed3e60b155b9da
SHA1 1ac562337ecc0d99d348d5710cb092eab14e0e91
SHA512 597522f504c1c5027957f6e20cc9600f4b74dbd2e9c53ccd5519c49f9eb9ae9b642ad1293a181bee600e616a5805ae49861ab5f11e91ddfd7540063de1da8941
SSDEEP 384:4MMpe8LZPlbf9fm5+rzMmuSQeiJNPZ9q8eR1kGiG:4DDLZPlbf9+5+rzAeiJBmUq
TLSH
T1B872C094D565083AEDADFB8351584AA7121489D82D6939CC433FB9C63CB5C640FA1831
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx\Default\Cache\Cache_Data\f_000009
Size 28KB
SHA256 b421c05a340e40d4d4bd1831521268b6f0afd0461ec3991cfa8d5314bf3207b4
MD5 57f9a7c7e2be49102533a2ceb7a05e51
SHA1 850ab0a80577b7f7effe196cba037899e71594c5
SHA512 66406d54a1d1a44f30e19a9bff1242b50fdcfbf66c33e4c23daaa756c06f50a2e39c991e7a8dfd9a81184cc37c2062d0406070be132e28a22307896e63b55447
SSDEEP 768:dT+CJ4QL+F8S4bApn9Ua0ndjCaixJ/fVW2/AGYnS:TJ45F8SgjXnNCa4fVWVnS
TLSH
T19BD2F1FF1E208D43082F37459DDE71D688A00325635BAE3964A09F59DD9BCBC8D90B38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx\Default\Cache\Cache_Data\f_00000a
Size 76KB
SHA256 463971712881d851652bfd41d59c2ddc332cac2a9fb2951af0b368c2bb8fd08d
MD5 b4f06ceb12022e0306843b201fcc6358
SHA1 d3bb1d4e126049b7584fcf3486bf4ef7d54179c0
SHA512 f50748bbbd811b558e7600491eb88bc913328f5217278566f18e5a3d83b07deed1df31e34d2ff7932f923b32128a6650ab72664e4470652fc9c98aebfdc7590e
SSDEEP 1536:oxuo9/MWob4PAMCd+6XbLc6JjvDvQq2wl2bBab6+MIhAmRPDdU9eh:oxuo9/MWXv0rA2zT2vFab6+hRbR
TLSH
T11A7312CB41BD064A44A5FF9A186380511CEA9AF90777ED2AED0D7E184FD9D03CB568CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx\Default\Cache\Cache_Data\f_00000c
Size 18KB
SHA256 71c11f017e1afd1824decaac1f3f0d545a0a1381344a76a6fbbc83a7564cdeb3
MD5 086974352dc85d2bfc46caf03f91210a
SHA1 6be2cb8b3fea31acca3c38684b21052323b6d325
SHA512 9fe8405059c844c98841ed568b5711ab71f0d159e0d595548500826e2d12f3dd48f09afb96b86b5f1b93756875ec7bec1ccef0ea715c41a5808c8f2675cd8d2a
SSDEEP 384:/ruMCPkasjYUC+0na4U/62ES/vMR+kuOAjfl3uqjMr4w5:/KTPkaYYjnbppJU9+p4w5
TLSH
T12882D04BEF0160873D24A8568660D2D5F4097A1A3736091CEB3F1A49923FCDF176BCDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx\Default\Cache\Cache_Data\f_000011
Size 56KB
SHA256 d18ff28d3b8ef4b09db0a9114bc5405d125533f0dfb34ccc8e66adb6b243a9bf
MD5 6d1e0ed99d449bead1a182620afc923d
SHA1 329a32659325c4e276a4544f5f758967a40558f5
SHA512 885a9cd777619e7edda41f56b41906745479d4dc3a9b40dfcac02b99ce8885259a4ef7e8fd1d6941b9a57d01e5de4c4da8915f6917fc0dd4d3dd38d09a0d69cc
SSDEEP 768:aFhjCnrN2ax+lBhi4dagMi78jEvJCBvHZaFxIOwixuRDjJv7ZfMONOVVJsr/ZFvs:drwaA7gti75M47txkJ1UjTKrTBhHpc9d
TLSH
T1074302F89BD4519E0B18BA39FBD46CF15EAD0C94085FF9F5893A8658828F1A04C2E147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx\Default\Cache\Cache_Data\f_000012
Size 70KB
SHA256 21724bd3c48f76d7a44977aec4b69d0d7855c789e89136117d8ebf052d547364
MD5 34a3223212688ad49ef71ca1cfdd22d8
SHA1 ec618405fbfc575962d0a394170b11da61d80544
SHA512 3188147bfdf2d748e5c3d499bacf65d8eb128a5fcf3fa3c9bed9deb7695e542e282c247a29e99b9fef5d91f1a46b3c9c60718cffc7c5357aa7f7281e59031e54
SSDEEP 1536:w/+hAZX3YAkuzD1VOLkKbPjWBYk5XCXEHqkFw1H6aBFD:E2AFoALhVMfbjCN5S0HNFaj
TLSH
T1E96312649EE8E1DDE2FAD4DD5883950AB0BA44F147BDB3ED3AA47D024675C8D07C6130
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx\Default\Cache\Cache_Data\f_000017
Size 20KB
SHA256 f94733c3fa830b179e8cae87fd4c5ae6e7fa5690421952e6ff102be7a42ab142
MD5 22fec235f8d9436a170eb89f481a2b8b
SHA1 885f1e575417c6b8675edd588b1af7b203c3af61
SHA512 f479b676d7eb136119e98bcb18ff92c1eaa86727ec131bbf0c5b36957ef1a15fdd3cbe9c804ffc7831bd52c98f64b11942b601fe2db355b03d22ed6d875c40bc
SSDEEP 384:DHisDFS105FZGVSZv+cX5t4ySMHzEEuIm5kAzSEwyFaqVgMVsSMk/+6/ievN:ewqWGgJ5yOwWuuEF5V7VsB2+Hg
TLSH
T16A92F19AB274133E1A83EFA450B3DCA5905634BE9D217B199EF4BAED903700F3001D86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx\Default\Cache\Cache_Data\f_00001d
Size 34KB
SHA256 a3d046140b0090086cecee19280790ce82ed894d4e6e8751a8658d8a21555569
MD5 1e17080bc38565e28401d5f061658b68
SHA1 413aab1b9aa41b7735a1647a4bcf17eaad2fea72
SHA512 ac90f9335a703d48e022d6419c4553c0db322200fc543ab91962a985e33f7b399626e529ef892f7c382d9380de370272cedac1b81b9155fd07f2de0eb8d5bbd8
SSDEEP 768:KUL7yxo5dNDsFVwNl+BqQTM3Zzrm2S/t5IKAk:KULnlsNBqQTM3Zz6ZtS4
TLSH
T1CEF202C9F9C41D00F52B6115303CAA58E59DAE74B39F22EBD5D9A2F7A48D2CD0F88613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000027

Path C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx\Default\Cache\Cache_Data\f_000027
Size 16KB
SHA256 ea5b658e470a98a8628375ec4a700938330e9c0cb45d08e4b89e5698b200f2df
MD5 9628ed30a3cb6f6ca5ec1faa75b3d9be
SHA1 696611cb9d9cfa5f2ccccfb6f4cdc1a816bfc908
SHA512 8fa833b989f417cd0c780963e01e1db654c03adcca85ce0231857c07042052db3fc563f9abdf3047ec7b2fef099b2e70e699464041bda55ca0778ce4ed9c28bf
SSDEEP 384:FfktxDpLOpGRWSVKzyxNl31A0vH/56J8L52FRTL+2QC:9ktZp6wRpKkl3fpeiyR/+y
TLSH
T1A272D0429E1B0F29D3607209C36574DF15F99A6B0AD9A0B4CF6DC43C8807AB76D7B239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000031

Path C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx\Default\Cache\Cache_Data\f_000031
Size 42KB
SHA256 cd45898333d25950646e531e94aa4d7e5285bec9ed77fbdb15dcada577559d6d
MD5 094a7e65df2c9b07a0dd4624b2dfc35f
SHA1 877144afcfdd0bfc96b83302ce166cb99d7ad924
SHA512 aa2f14d7c1210173d04fb1f900a55d5c4171dc9360321f3c4df419c2e319b93fb9b00962e1c31626620c00a7d04969f8563a2c585eca8a03906bb462647da485
SSDEEP 768:pFwJYWW/FQY8fHfUZQOXXdvT8+5XYOq2Q+76INzNk+Z04+QG4JAwn8AfVk3tlPZ+:paYWm+/UScvtx9Zq14+QxJFw3tld0Hbx
TLSH
T122130267779702CDEB81CD6D97A20BB54B308A6BC21CA35FE011AD06951F7A11492E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000037

Path C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx\Default\Cache\Cache_Data\f_000037
Size 18KB
SHA256 5b9504241f5a0610adbea9f4db60cf5325fe512acf4487815b578e22b2c20da5
MD5 8ab57b7f9443aeb71e79850e4dc0bc3f
SHA1 d4ade2081092668623aa45704d0f549402cb0c52
SHA512 cbe4d47d1db0486950866efb120fed73f0da0892fcda8b45e3080f63c532058bfffc29528945044112009ec8e84878d7794f2a520f4f890b464e844d6ad2e8bd
SSDEEP 384:l4sp+IwX2m1v2Stn1FH9QhUg/3DAhlmyh/GWaM5pmN97Zyeisi:l3p+IwvhtnnH9L8GJbXDmN97ZyD
TLSH
T17B82D00B84745D0D4457D7F8ECCF519AD398BE10BA99704A2C0D5C463209FFAAB2AEBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 913c8fdc8bbbf4c2e04284e11e7216de15314cd5b952ea644b525018318af60a
MD5 0867faef2614d7e0b595df556d719487
SHA1 cd5166110bb32c5cbd153806edc4e2b8604fde89
SHA512 f264bc6d80546b813c42811b9b0407e0f75f62f369fc55c764c378e5d71d06ae280cb6f2edf3f27ed56abbc8b08cc4fd6ecba81f90466fcf89af17dd7ef2ce8e
TLSH
T1F2D02BF71CE90820ACBF4BE3683650D00403FC54DB40AC8E005D66C768733227522DA6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 730cd6136c69bbd497b6c001d2884d06e246c1e39f6407af1a8f6bd128810088
MD5 bb3164ff48d59a913b872d67246f3c25
SHA1 708917b20384ff261b65bbaed79acbcab36e0f9e
SHA512 46c061fc2b3bf6db332368786eb0299bd119c6009560a1be12b7e1a9ea9ff8f17a3baf4bea0410117b15ebf6443d3a7a2278c1ebe6bd9c9c90bf8e0f37ac0919
TLSH
T178E068F72DF61820B8AF4BD7643650D40446FC28C600AC8F100EB2D364733122825C62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58d23f.TMP

Path C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe58d23f.TMP
Size 153B
SHA256 9d85efc562f68f5f910ed75837909ef06e952938d9032b845ab5dd7c2165c65d
MD5 fb11fa32b30c1b2729098ff2d0800725
SHA1 cc99139a26381ff6664b5b545d613aeb7ab33943
SHA512 c8fd2a5b43334431551c662ad6a6f81f7b92dddbd4646a49d4fee41b8befe992e6a87670fec6e9e8369e5d304d66115ae0b7ef2920c233c26efb42b14206081a
TLSH
T18CC08CF71DA508009D9A5AD2543354948217FC888B40BC4A401E71873432232B122D25
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx\Local State
Size 5KB
SHA256 ddac682a1ed675ca6eed096d95aa49b998a3e437b60a61d3f92eddf63e841807
MD5 81a4211b156c02cea9c6063852fcba95
SHA1 ea3483f8f1b90f93257463e5b963ce5792e7813e
SHA512 698e3cb31e901f83625d8c71f72e8987ef990e818509f89a6a0564e5da98524d2bb5babfb04d20e0884f698e88619e34d8e75e56bdb78ae01eb8f7e35b07ca29
SSDEEP 96:lqGNk4QsFfk/os/RvN8OSKo58Frh/cInURoDotovVKDVBlPqvLfjJ0eUnWb9q4a:cGNoh/JRvNEGooDUw6rFEjJqWy
TLSH
T1E7B1D6B26979EC674DF6A948F5C62753AFA42073E885BFDCD6D81A0C04D73482B0AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx\Local State
Size 4KB
SHA256 612582c1c223fccdc8ec32c226c9aa7933ac78b8b21b2d0ed77b52f2ecb5f897
MD5 5784f4c56fcbae4bff95cba5d96133cb
SHA1 9f4b10792da0bc26f9420c3d6c4d2a667666ee2b
SHA512 d9b924da37f5777cfcab1d90b2431111c3569b2c34f7f248d30b078a4f77c4ea350d6eb131db9426e9ba8042703f810786ca053337a8d79c9b15d570f486d08d
SSDEEP 96:lqGNkHsFfk/os/RvN8OSKo1ukDuBlPqvLfjJ0eUnWb9q4a:cGNch/JRvNEpJOFEjJqWy
TLSH
T12781B8F16829ED6749E66548F58526938E7430B3DD42AF98E5D4531C04DB70C3F0AC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58c668.TMP

Path C:\Users\Admin\AppData\Local\Temp\vhrn2pfz.ekx\Local State~RFe58c668.TMP
Size 1KB
SHA256 a07c879f88c58cffaf99fdd45afabd4db18bbbd693e8040f06c04bbbfea0387d
MD5 b4fc78a77a6d6050f47a14a1988c11e1
SHA1 12dc498e5f60d7500224a8525861beed62a14bba
SHA512 76b0548e30a8a815435db7e41445fcc197982a669113eed19cb5a679080928e155f6f833eb1eede279c8e9e50f9cd4029f1bae72cd63c9bb4b5bb3f309efe237
TLSH
T15631B6F1A8682E77DCE25A89F3897B630E302172D2466FCC55ED461C04E724DA60AC3F
MD5 SHA1 SHA512 TLSH

Submit Download

Google Chrome (2).lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome (2).lnk
Size 2KB
SHA256 255529dfd41359b5895ca1e13a81ff72b2e4945985ed82ca43b05f68a73e263f
MD5 695e79469b9d33440a040f7988fc8865
SHA1 b7dda88b0d1e8af6509214972750ee6ea2054de6
SHA512 5dcb15edd45bb401ea55fae1a75906eb4b479f20c50b096dc9fd2f54c5225d3157dd4d417af1b7854ca298fba35eaa9c3a77210dc22ba736eaf96e74850ded1b
TLSH
T1A841780677F91B59F3F39A326A723B310FBBFC13D2645A1E4194428408A2A2049ACF73
MD5 SHA1 SHA512 TLSH

Submit Download

YTKR1XMXRRSAIFBTZTKE.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YTKR1XMXRRSAIFBTZTKE.temp
Size 4KB
SHA256 678e529a744727eafde4395d42ab955568cb0d3bf69d7163c6f232179e91ea74
MD5 9f1bd51b4d01ce9079fd0f4acdc696d3
SHA1 2b618f65c1cabb53d9abd04f73dbdcf25b2303ff
SHA512 e981f8ce02eafb0ec6006bf925d8f5ddc684f8a0aa895787b41e2e22c131e2d72eaf66372ab3a7dc35b2d0d2a1da2c2c46d2be3e9abf9050966391ac3cf3eb52
SSDEEP 48:5vmkdOmcYcIt/e/1J9zCNYndLXuHrx6pp+umkdOmcYcIt/e/1J9zvYsgdLXuHrxr:5drct3JoIuwD+orct3JvDIuaW
TLSH
T18591F2419BEA5A56F3F7EEB296737B216B7BFC058B05DA0D008502090C72B04967DFA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 6df027031893296233ed3352aec01ba3354572e2b96d9191e798da58f798094f
MD5 ce7983025b722803d7e02e4512896793
SHA1 d56717b92e2d857eb8109f69acc6d202bb59fb4a
SHA512 f0df6cdd46036b56c4a7c154005847564c61b2ae54c314dcb7c8017e3dffc75904771a189521ea3aa49fce65fc5e0e535a20af3feef2982d69a126c1b27258d6
SSDEEP 48:/vmkdOmcYcIt/e/1J9zCNY/xdLXuHrx6ppEumkdOmcYcIt/e/1J9zvY/qgdLXuH9:/drct3JoGHuwDEorct3JvGqIuaW
TLSH
T1509100419BEA5A56F3F7ADB295737B216B7BFD068B05DA0D008502090C72B049A7DFA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2bdc6f37-0564-4bcd-b855-03562f266200.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2bdc6f37-0564-4bcd-b855-03562f266200.dmp
Size 66KB
SHA256 20d5b4f36d58743bdd8f5d7b11eca5149cc478d242cb50648941b7fdf569309c
MD5 caf90481962ec3eb124eb55faeae8bc7
SHA1 4706615b09d52735ca961b0d02805ff72317c5bf
SHA512 920bf29e585853cb0b5cba6e7aebac8bda858c230f548f178638d8c3ef94c2913f52b381b4f06a38e3b9977f533f0840021bd1e1c36733b68047252b54962f12
SSDEEP 384:kkk/sPxjpMff+AQGJaFwM4bcxf8tUMJLp+94knF:kkLcfGl4bjbLq4yF
TLSH
T1EC63B56277940472F92656B71CEB77543BF7F8200793438FA2115ABA1C67BA0ED30E1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2bdc6f37-0564-4bcd-b855-03562f266200.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2bdc6f37-0564-4bcd-b855-03562f266200.extra
Size 10KB
SHA256 62869d6b9e76b388f6f020a29648c1373f3e1cbd524aff2b813e64e39645b6f9
MD5 3a480a6ad43b0425aafd114a3fa3423b
SHA1 af5f14131ce61a0b8ac505084468246517caf1d8
SHA512 cc288b81a7d8f070d4ec19bc31a7029f6e577400e02f03ad7d2113baded829f5d842cef1a0bea8b9965cb00960d87a20376fd5cadd8fd30effff24083ec7e791
SSDEEP 96:STWCsTQXY6pw6lFFdtH0Rh7CTvBb1d0FjMLlIrLlhTLlaXv7aJ4utILfcBCqwvEX:S5AgFbG7WvZ8RLkxsP5wl5hfot
TLSH
T119227353879724B79D4198C4BC30AE7C45EC6FAA51F958A802CC4D47FA468F82FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2bdc6f37-0564-4bcd-b855-03562f266200.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2bdc6f37-0564-4bcd-b855-03562f266200.extra
Size 10KB
SHA256 448ff84267f70479782a450b01351a65f8b37dc832b1d6024f5d20a5b844de53
MD5 7fbcc9af561379fcc7c196f7518527a7
SHA1 5ded2aca80b699098d0913232975b85a027c6449
SHA512 611e6129a889ced0f2eb5aa1775873f8dd64938cc19958678067125f2111b9ceacd0fd70b3c8252f4436b8ced95170b638256c8eb18b216c67ce5a4e2b531ede
SSDEEP 192:S5zcFQiR4p4DnTYaVdVxzPjWBHq4T/fKNtalBhfohbLLkk3N:izcFQi5D/1LWBHq4TmaxAhL5
TLSH
T15D22E831081CE837E7D6AC8DFA393E3AD66D7B1A00E6789C41CCCB49C2A5478A779553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

484a9bae-3062-4648-a243-d458edc7c2c9.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\484a9bae-3062-4648-a243-d458edc7c2c9.dmp
Size 65KB
SHA256 76ffc6e258a5b1412b906476a59e75243480ab8d28241d7251164a566e008ce5
MD5 dc68186190fca92d5887e4ab991615f6
SHA1 f24389b6c3e084491473a9538106d6824efda28c
SHA512 20e943fa713eb928b69fedef1e1a2946d035c7a39488dc860215b3b5e80b7b2d3069593ea4574294caa9015c16f95f89d33eb40d81ad671eead189bd77ea52d2
SSDEEP 384:cxG/fC4q4xwsuorOpNxNKLYY8u6Tx8EaJMx/nLY8VEPsYJJRegrSF:cgC1LNKLIuWRxvi3REF
TLSH
T12F63C752BB94087AF9654EB43CEB77543BFBE8200793439F06924B7A1CA3365AD30E15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

484a9bae-3062-4648-a243-d458edc7c2c9.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\484a9bae-3062-4648-a243-d458edc7c2c9.extra
Size 1KB
SHA256 e3cd5520718a900a9c2af42ba62c8f7ca0930ef83f5b461c82607fba02e89f04
MD5 d3279d8fad0988447b080f978c644a39
SHA1 d39522d7c3d40af3a66bdc231e198b33e19d798e
SHA512 661c60b36d3130a1b81c2c32b5853d9f5bc3f97325bec6292c722635a2e099e61a851a90f853c8a95f5ed7e09765a36a76021fdf7c6e7f54e2b7a8bd867f2a3c
TLSH
T12A3154B381EC6E629E578958763B1303C599732344D35D0D34CD4B0C858E4DCA266AD3
MD5 SHA1 SHA512 TLSH

Submit Download

484a9bae-3062-4648-a243-d458edc7c2c9.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\484a9bae-3062-4648-a243-d458edc7c2c9.extra
Size 3KB
SHA256 a4b63b0d1a139feb581533eaf404b89a65f362f8406291dba93967f38baec01a
MD5 66c9402dc93390f98e19260241c437be
SHA1 eb85665d514260165e1c56a3d5aeda36c908d39d
SHA512 d75f22b3e048c9f4f529752aae4f475f864f5581e3c26ab7eecb13787492bcb74c303d6c1733d3e0ada2e604e3265b99b39c8d0b8f4496625e8c23ac9dd779d1
TLSH
T147812372005CE9336AEF5D8EB3376D1D899EB31998623A8C95DAC71C41B8CF07386143
MD5 SHA1 SHA512 TLSH

Submit Download

6edf4eaa-7982-4d2a-9d58-bb6021d98127.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6edf4eaa-7982-4d2a-9d58-bb6021d98127.dmp
Size 65KB
SHA256 eb97892b30c6633431cec16bca4a21491450e04bf33959f7fc9a29eb803f348f
MD5 15e20fff2a2050111fc032692cbddace
SHA1 35d082f2700fa00f0ded8c39edc3fec7bdc9bd33
SHA512 6c97be0027692649d281363ab5e6792be145f8de0b2a2082cfa3df2be9702e72717f0abc4f9f9a4a4a7c1b9face62a062d033c4a2dc5f5263be74f201b3c9cc7
SSDEEP 1536:1jVTxyPEQXvjAat+Wisd9XFWcjn9Xye30KkDpleGxkV2pHT1k9eg0rAUfZZkvHGZ:pzz68
TLSH
T1D663FA62B7D80462F5B657F01EEB67953BFBE8240363438F0265596BACA3314AC70F94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6edf4eaa-7982-4d2a-9d58-bb6021d98127.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6edf4eaa-7982-4d2a-9d58-bb6021d98127.extra
Size 10KB
SHA256 40edeb9c86415be7d549a50ceace2a0a665965ec657ee1c466d7d34380a9d542
MD5 128aa7c7a52d34382efb700618cae052
SHA1 7fd67bf3e99bdbf187611a780beb2c2e6cc920c6
SHA512 7e68745b411410df6d1bc3803859ce46592fccb8be9da360b486812614c55c631259d03c1710595be310dcd4fdbd6dbcd5bb32320b0c03bd12016448a65c528e
SSDEEP 96:STWCtATQXY6pw6lFFdtH0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7agutILfcBCqwvp:S5tMgFbG7uvZ8RLmxsP5wlsZfoz
TLSH
T1DC227353879724B7AD4198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6edf4eaa-7982-4d2a-9d58-bb6021d98127.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6edf4eaa-7982-4d2a-9d58-bb6021d98127.extra
Size 10KB
SHA256 0de650acaa5d13df0ddbd811dca4d8ccf09a3e9857b4601cbbbc35856e9aeba6
MD5 ecf77d0d97bfbb646d09736de3af187f
SHA1 0f5bf7c63dd635c3f68fbff2dc9f2dba45d10af3
SHA512 5b5ca8426864ed0983ba9221df873ada7d483df7c2f903c076616fbcf6259a65406a234492c96eca9c3c640e51c7d7981d636b3669b46c793c15081d636dc5dd
SSDEEP 192:S5tncFQiR4p4DnTYapdVxzPjWBHa4T/fKNtal0ZfofbLLkk3N:itncFQi5Dz1LWBHa4Tma2AfL5
TLSH
T10D22E821081CD837E7D6AC8DFB393E3AD66D7B1A10E678AC41CCCA49C2A5478A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de8b6823-c39c-4090-b4db-7590026b5496.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\de8b6823-c39c-4090-b4db-7590026b5496.dmp
Size 67KB
SHA256 2076c3b3b0583cae0b3de4b9da45f7c3751d08a28741e04d21b465acbb5975c0
MD5 7a6de21af5a4915da41fa07dbebbcadf
SHA1 346501f2f027b645b0cc5af2d338c69c480a6bb1
SHA512 d6bbabc851c197cd7eca0a4034408e31a0bfd3f100605f4697d43c3a1012ac1737f13a9647c9715ac3a845d4274b74316edbc99d3dc7c950b702fcf1475968cb
SSDEEP 384:l5/OoqudHIpoQvHd+jQK9svk7dtKwI3cyBS7rdolaF:l0jAtAdmtK7TwylaF
TLSH
T19763875A7BA009A2F5265AB41BE777463BF7E8200B53839F02D1557F1C62723AE30E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de8b6823-c39c-4090-b4db-7590026b5496.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\de8b6823-c39c-4090-b4db-7590026b5496.extra
Size 10KB
SHA256 dbfb2f722c830b683647033d809b391acfb8d048aee4c600614bac7a668df611
MD5 89231ff15430a1dcd4716254c032a091
SHA1 df391972534eebd3180e5e786ba0604528005331
SHA512 b98a9b4900238d3a55a5a9d0ce34aa86fa5f31bc806dac2a9c18907964c8b73a0c28ba9c57427d1f7c06e342358041a959712596f4fa0b339b8cf44d521a7f82
SSDEEP 96:STWCXTQXY6pw6lFFdtH0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7aZutILfcBCqwvED:S5jgFbG7uvZ8RLJxsP5wljyfoy
TLSH
T16E227253879724B7AD4198C4BC30AE7C45EC6FAA51F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de8b6823-c39c-4090-b4db-7590026b5496.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\de8b6823-c39c-4090-b4db-7590026b5496.extra
Size 10KB
SHA256 55830aa761d3ff9cf8ae2e58feb8e30f6465c3281f3d6d682b15a7ea97d01309
MD5 a5e2fd50b9736744e89f09ce6727d7d5
SHA1 0d66d6149e03197c518fb6a9698094e6082ee8b8
SHA512 1a97eea809a5d116b6192df72c377c8f027b331ab8e385f05d84be479df18e6a28dd37adc2dec135ba5aa4ce0b172658c1d01c039de12b1e259a3edf66a8e2da
SSDEEP 192:S5CcFQiR4p4DnTYapdVxzPjWBHN4T/fKNtal7yfoCbLLkk3N:iCcFQi5Dz1LWBHN4TmaYACL5
TLSH
T17522E831081CD837E7D6AC8DFB393E3AD66D7B1A00E6789C41CCCA49C2A5478A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e3555625-2c4c-467a-8cd7-994832baffa1.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e3555625-2c4c-467a-8cd7-994832baffa1.dmp
Size 66KB
SHA256 f4d9e69c8dad7956eac6fd05c553a99f8cbfaeb29d50a6b3f8c285cf93caa637
MD5 3acd6dd4b347411cace3892973a4c3b8
SHA1 d0cb405eca4ee3be1b32b179cf5ed5b414764561
SHA512 e613df252efb4112a30a905ff9d486b9086bb0f2c8bdef9b977d83ab885e20150db058f11a4f044ea5c3434b4c548bcfdb869c866a727c605d8c410ebc4d4aba
SSDEEP 384:7D3/gitK0kXkdjw5waDNdxaMLegH7vHsKg2qJX7aLMGUVRF200F:7Dz34/wQHgtZmMGUVRFGF
TLSH
T1A063B552B79004BEF5355AB018EB67663BFBE8241F73438F8618596E1C7EB14AE30E11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e3555625-2c4c-467a-8cd7-994832baffa1.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e3555625-2c4c-467a-8cd7-994832baffa1.extra
Size 10KB
SHA256 0069891ba8291dd028a49414eaed22a10dd81ef9c8bcb85b2d9da98f49190d88
MD5 f5a23caa2089842aa3283a1a864ab6a8
SHA1 027c8907f2c9b77fc6fcb3364a24496f7c6af450
SHA512 315e1f3365b255ea89d182bb7eadb708551a8fd3c94b31e147753bd4834a2239669dd447f5557ce6fcee6e80f0d4720f719372c73b5ff18d1b7b3bfa2f2ff1ed
SSDEEP 96:STWCMkTQXY6pw6lFFdtH0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7aeutILfcBCqwvh:S5M4gFbG7uvZ8RLUxsP5wlyLTfop
TLSH
T12F227253878724B7AD4194C4BC30AE7C45EC2FAA61F958A802CC4D47FA4A8F41FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e3555625-2c4c-467a-8cd7-994832baffa1.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e3555625-2c4c-467a-8cd7-994832baffa1.extra
Size 10KB
SHA256 c65e246b856d63264c0cc7a2896ea07c5cb888c9a88a4aa2cf267aeeef749751
MD5 6d5609ec17164cdc17ff3128e1506e6e
SHA1 e99794ec6e7d97f09585df86d881a45535474cc3
SHA512 fcc31f1d953abec9913247c3dd1078ab7542dcd0a407d4c1a8c15689fba943dffde5052677ae258b9d9433429d1424849fb1ee0268af12c8078cd51eff0d4a18
SSDEEP 192:S5MrcFQiR4p4DnTYapdVxzPjWBH04T/fKNtalKLTfolbLLkk3N:iycFQi5Dz1LWBH04TmaYfAlL5
TLSH
T16932E821081CD837F7D6AC8DFB393E3AD66D7B1A10E6789C41CCCA49C2A9478A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 7dffcdaa039f397ff60e825fb73fb311d982dd2a480d610ec07e4d5cf334d21c
MD5 9571d6c6a92d42805d8846f0bbe5d1fd
SHA1 32243ad8aa6f747c8523d3ecca9471738509113e
SHA512 ed7570ea91376735838d7b81b6100d3e1d85a78251f9d6907e9acb7dc7cc97dd15462aae998f9863a11e08fae12d970f025b07bca0c8d325d469c71bb4958ece
SSDEEP 192:4Ov5zboYbCFyjslMh+1d66Joz0dzgCl6mc0dz:DboYbCFyj1Yd66JozQzgC1jd
TLSH
T1FBE1FE64E638463FC444423BCCA51F400F35395BA88E7F1935AD650D2D5B2EE768D0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 fe320995ec9440a73fdeaea331d128a651a06177085bb7d53ea08962860708a1
MD5 8c99e58db0212bd2c9323621ec0c37b6
SHA1 c9fa5115cb52480889679a9e3f91f7220a72ea3d
SHA512 887bbe5a3853fc1ff2039e717d56cb5f5d1542fc224adefbff4cd1c5739de78c94f4daa83fd1d78bf5eed5dd66a980b7cc4142186998b13b4ef972d569374dfc
SSDEEP 192:f31d66Joz0dzgCl6mc0dNOv5zboHhZCFyjslMw:fFd66JozQzgC1jsboBZCFyj0
TLSH
T13CE10064E628863FC414437BCCA61F400F39389B988E7F1935AD641D2D5B2DD768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 e047c81284d6a3f95afe371d9203d86978d0cc160a664eb27b18b01f1dd4bed4
MD5 0a0fb6ce2adfe2a45d37a909d50b9235
SHA1 88765bd05a1a6b0b25e23e9a3e22deea798852af
SHA512 1f3d312964a7d7d6b88d01906da001e7e1769ab002b2e2ae182db9768db42ac59ca4c6c3aba160352d68977c4e11f398009b480ad026547963047dd4c3edf00d
SSDEEP 384:2Bd66JozQzgC1jdzCmmKWFOZCcGcmhuWJlKD/w06bfb93GUikmboAZCFyj0:2OmHzSkCcGcmhuWrKD/w06bfbxGU3qkL
TLSH
T1EFD2EE54EB2A913FD42453BADCA517402F39B889981E2F573A4C646C6C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 8b5379bb61629b2025c104b614b8c7112217824b7b3d6bc3b6c075a2f511b240
MD5 c403ea3ec78895db389cf370333dfef0
SHA1 cb2c733248cb6a6d4c5dabe6250be7766b52289c
SHA512 3caae3f046a09e9d8bfb4759a7063b430cb3dde689720738025d8ce8006987c59201500332899c53e0d41aec32108d00b0daa26611e980330dba0e0aa3810810
SSDEEP 384:IzCmmKWFOZCcGcmhuWJlKD/w06bfb93GUikmboAZCFyjYBd66JozQzgC1jd:IzSkCcGcmhuWrKD/w06bfbxGU3qkdOm/
TLSH
T164D2EE54EB2A913FD42453BADCA517402F39B889981E2F573A4C646C6C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 83f41d23010f9a1eaa87a41716ce59240e56f368cc4f5a45d6deb38acd2f4d3b
MD5 03f82c5f0236188b138e28130acb8f0b
SHA1 71889bdc93f066332255262bc8156321817a66bd
SHA512 9576633251aa693d43dad9e86003e4ffa326dd8515ea737e1bbbbcfbf0cfed4d998aff6ef68facf422add14dc8be1b7d30d98167eb0085baddb2619f0e5982b0
SSDEEP 192:MY1d66Joz0dzgCl6mc0dqOv5zboHhZCFyjslMw:Myd66JozQzgC1jnboBZCFyj0
TLSH
T10BE10064E628863FC414427BCCA61F400F39389B988E7F1935AD641D2D5B2DD768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 5f523198a7ed2e13287646dce36bab5b3f6e4eb2ecebff79c436ad8aa17f5301
MD5 2cff58bd956da2c960d7ff2ad0d62ab2
SHA1 5e5c56ca64132117ad2033948354a369caa1630f
SHA512 deca048f3e9600d9c92b07a79e787f5cd46f64f1e421c8f38a1a7038536bcade07095ab987e5a4f1296381c9ed8810e7ba34305618e9fbeea2f3676d35f02e27
SSDEEP 384:2nd66JozQzgC1jdzCmmKWFOZCcGcmhuWJlKD/w06bfb93GUikMboNbCFyj0:2QmHzSkCcGcmhuWrKD/w06bfbxGU3k1L
TLSH
T107D2EE54FB2A553FC42453BADCA507402F39B88A981E2F573A4C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 dcdfc0045ec881cf0103f1bfe647c4c8632aa03574875290d7d882581f7a9e74
MD5 7c3cd9553e31ecb14951b7e6f4987764
SHA1 14a6e75c7168ed0f2aea305456485fd6009c2a8f
SHA512 81f09b474bb4c30aeb25041397d989ec88b863685126505f05e131a38161e67908cf3cfe08e916b981e715589fdf2c8b4ced46defed3eecddf109055c850998e
SSDEEP 384:UboAZCFyjKzCmmKWFOZCcGcmhuWJlKD/w06bfb93GUikMJd66JozQzgC1jd:ckrzSkCcGcmhuWrKD/w06bfbxGU3Mmm/
TLSH
T106D2EE94EB2A913FD42453BADCA517402F39B889581E2F573A4C646C6C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\events\events
Size 1KB
SHA256 a0abc99db11fcf644910dbd58a04313c1dc23b243a12f1dfd2ec46ab60f430a7
MD5 0ae9fb4a125b7da71e27bf8dc684198d
SHA1 dec1e2fede099db52f590843b59726cd12966e46
SHA512 dde36aa917b1cbd0a39dd736cc81a6fc11bdf02d8f610c6d5009a832ceda18f37edb8508d909aeee4c29130b5e610a96563f3a63e569125dd87272e8aec738e1
TLSH
T1A321255C3DB84D2AD9D7E2AC7841028E93958A0744C71C4B0D52EF8DCD96A99326A63D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d21a59381906c0a408ffba43cf600f2dc73c67bd9a6695327edef9f96952ae0f
MD5 a7dc56cf1219585a447dbabd5b322f3d
SHA1 fe8b1781704f25dc678fc6f31d32175a0d0a446a
SHA512 521431f44b3bf1468c5450e9a64d5e266d99108cfbfd793ef0df108e2ed7a1559b99baa27af4c84cddcfbfd24abf41cc833129640fef2061043cd55f59e50c87
TLSH
T14B21495C39B88E7AE8DBE29C7441018F53918E0744C71D570E52EF8CCDC5AEA326AA3D
MD5 SHA1 SHA512 TLSH

Submit Download

18a21890-4741-4f2d-a9b7-0130845b982c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\18a21890-4741-4f2d-a9b7-0130845b982c
Size 3KB
SHA256 98b52726c1301090334b314e27c4924044638d46a4b2a0efdb78377d0a2587e6
MD5 4adca8c04ba97cca60f88e5084de88b4
SHA1 bcbcee57d0c6f886d433a485736ce63dfeeb7df5
SHA512 45ce24ec5aded1cb46046aa64b595351cf6feda01b990309a417bb7c92a442aa8589e98d89437774954784a5224d8bb400bebce93642f2b1d58fc74366177dcc
TLSH
T1BA614561052C79738FECA141B3677A848AEE339F18471ACE25B9CD2442F84A4578B35B
MD5 SHA1 SHA512 TLSH

Submit Download

19cbff1d-ffbf-4f7b-81cf-088c562f516b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\19cbff1d-ffbf-4f7b-81cf-088c562f516b
Size 3KB
SHA256 9a8d84cb6a77942ad93c5a0645dd4e417f3ce80b9231aa5cb6bfac2c1b1617e9
MD5 c13dde9b78862b5d4332fb7a725b3f97
SHA1 c6218f8110a24fb6825c06765285393bec8ad62d
SHA512 9322de722621c61dc39b65907cedde1f6e5545cd1253b13a954011f50080faa4c7eddbd7053fd4805043e127a43f8245c34fec9b41fb5cfe239f968844f8a1c7
TLSH
T1D0614461152CB9738EE8A144F367BA848ADE338F58431A8D15B9CD2483B84A8578B35B
MD5 SHA1 SHA512 TLSH

Submit Download

19ee248e-d635-4dd0-bd66-b2d589fddf1e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\19ee248e-d635-4dd0-bd66-b2d589fddf1e
Size 3KB
SHA256 d42562c3fa99fb710755572b3920465c488ede4415e1982efef4a7389ea5a615
MD5 bc5eefc428916d2a897a96ca8f8d3620
SHA1 93bc027f42a9e7004959e0739fc7dd372a3280e1
SHA512 789e4586facab952e38b2cfbd241b21438f0b5d61b884ae1d4188376ebf76355bb79bc39192e68f73f038f741acf8d0ae32e7c914782e01d2c86fafa7da182c7
TLSH
T109616461152C79738BECA100F3677A849ADE339F58431ACE25B9CD3843F84B4578B25B
MD5 SHA1 SHA512 TLSH

Submit Download

33091f45-7bef-4fa4-a84d-c875a13ad24b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\33091f45-7bef-4fa4-a84d-c875a13ad24b
Size 16KB
SHA256 0c97cb012c9d6bf442b1f316bf268e7211fd902241e99ea9798d6a45da02b2f2
MD5 2c49b00f5e8a3521eb6ef4932a3c21b6
SHA1 53c1ebbc4ee14533dd1bc3b9b5f1f9412d5e827c
SHA512 83337fd1f5ff3a88ce555cfaa544ada19191f6eced7288fd4550269026b0585ab386f6fcc5bc92459b0a1fe7943c5d65561809f6d8b01d7d10a7695f1ba9e883
SSDEEP 192:HaUkEurhHQnyBHd1g7zuHDcSgx4CEvReAU23xj2rqHR7SzDhJlDFBr1v7cCBwJLi:F3urhJtRrzxj2mHR7SRJlDFYC8S
TLSH
T15D72C9165860457A8651E36994FCBFC3E5F53CCF4C419FC987E4BE086DDA0AE112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

397fd294-15d4-43e1-a079-5e810d79518b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\397fd294-15d4-43e1-a079-5e810d79518b
Size 3KB
SHA256 527e6313fb012b5ece720d87ae7af364fb28db9f2e9e546724a435527ae25ead
MD5 63701ca4844a1144796829f45a44ae99
SHA1 8823fa24f8dfaa70ac430d17f8b773b0c3675f50
SHA512 1ffeef0a6d1f7d21f7e4fe269055210a9d60a33b0926efda2862b1dd3bd35d8f9bf14761e1af6768fd23fa94edfd54d6e16cb38c6e894bda601ffaee051c6960
TLSH
T152615561192C79339EECA145F3677A848AEE338F54471ACE15B9CD2483F84B4578B34B
MD5 SHA1 SHA512 TLSH

Submit Download

45c82e8d-8b5b-4516-8e40-8eb1891f635b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\45c82e8d-8b5b-4516-8e40-8eb1891f635b
Size 235B
SHA256 ff576dc251b98d32082aa7b60c13a9ad6b3584817e355431cea8ecc2ce22fa68
MD5 2874eb65ca0a449546ace8aaf5cd4ef7
SHA1 c1965884ed23a21f622bb53e588ab87fa2617b80
SHA512 c95506bf0cd9c2d20c8b93955a252893043fb4c5a15fbe5ee5d134a75581008527210e16eba19c613f380d58ebf130fab107b52ed50b025a19a879c6fb590a5d
TLSH
T111D097862498273E0C000F07F0E069C270858C3364A498109B9149B8A9FAECC4162807
MD5 SHA1 SHA512 TLSH

Submit Download

518130b7-c0b9-4521-b0f7-351ca19fc1df

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\518130b7-c0b9-4521-b0f7-351ca19fc1df
Size 914B
SHA256 36316691300c866f0d810bd0d560b4406becfdd20f82c78b04801124229b5666
MD5 9edf9e8b1374fbd0de38219cf07c8b59
SHA1 74d6d6c75d1c0fce2c18c27ba45d8eaa1955843a
SHA512 4bfc6e48a364e600a519ed00a48e82ecafaa89df48611365abd428ac011cb6e049b962f2148c23022b6eb132946705c489b61910eb3eca27fb46e9903ac9e8e9
TLSH
T11D11BA82DA3875B2CDB8939B849577424BB4702380CA49087DE05E184DAA42EA7A6347
MD5 SHA1 SHA512 TLSH

Submit Download

6ca55a79-b9f7-483e-9cc0-721fb15b1fbe

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\6ca55a79-b9f7-483e-9cc0-721fb15b1fbe
Size 3KB
SHA256 d633c6d0a7e50e0a8e3e1911f74140a1d9ffc800d051a2aa8ac2ad38ac6317f5
MD5 e24a1faee4c3e96fdff0c37e7ba2263e
SHA1 ff4ed5bd2149b74f157468693b109d73b2b0fe8f
SHA512 f4ae74c77c95499143c23aa1dc59053e8ade08d105e8a00b1b8c12ba220de82c78146998d8316bc535ff3ae3fcc642b47b423ae6bcca22f0f24b4a59757b1ebd
TLSH
T1C1614661592C79738BECA141F3767A848ADE339F14471ACE25B9CD2482F84B4578B24B
MD5 SHA1 SHA512 TLSH

Submit Download

7cc4fea7-7e89-4e3e-9b35-af65a9d3c906

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\7cc4fea7-7e89-4e3e-9b35-af65a9d3c906
Size 3KB
SHA256 9214dc5c3f73d69c2082c6f0e5e233d3341291eb1ed2142abe8f9ab67e2965ce
MD5 7dfd86a782dfe418f402d03c621081ee
SHA1 5bbb80490fd751c760f15e634b1a691da6f80fb1
SHA512 ebb3808ae79fd3a8fa4bd5a4ed43cf08d02c5e8bf32e1c2f58cc490636ce2abf84985b95d48accc21a7ea64ba5c5ec0dcf172bd95abbe36f642533165e9c9253
TLSH
T152615461152C79738FEC6141F3776A848ADE339F14471BCD25BACD2882B84B4578B24B
MD5 SHA1 SHA512 TLSH

Submit Download

867ac989-b442-4f99-9ba6-07acb2ecce01

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\867ac989-b442-4f99-9ba6-07acb2ecce01
Size 3KB
SHA256 ed0e8c39dea194acead2a9bb6aae54cae93ce6eca6838815d5f188f887f6689a
MD5 0b7e63d86277590fc70865ce8cc971e3
SHA1 120c6a8edaba121152e3d9e822b395f0e6973a32
SHA512 1b85d36a8203b15dccd37bb01a7202c788adfd18166b59510479a55ab9db494426cf494723f34884aab2134517f87bcc5d9252e1397313170e1b0fdc2f9573fe
TLSH
T15A615661092C79338BEC7145F3677A848ADE339F18431ACE25B9CD2483F84B4578B25B
MD5 SHA1 SHA512 TLSH

Submit Download

8f293191-2548-48be-801c-8acee4919614

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\8f293191-2548-48be-801c-8acee4919614
Size 235B
SHA256 0798a57177ea3d6bcb667dbcc552939cac73a0b3bbce826ddcdb52c1f18ff759
MD5 c9493011a7b7727951daaa4c74ab8da4
SHA1 688726633976eceef1e8c1d9d866f72f49fdd8c0
SHA512 da043aecf5786222ca0c3cbee2f031ef57f33d7424f8aab7a4ef072856cbfc63621dd89f04ec82e04c1a395b76ffee81d493e85b30d22451566bf34f9aa0e278
TLSH
T18CD097802488232C08241F07F0A0ACCA70898C3B68B0E820C9600074A9BA9C44262C16
MD5 SHA1 SHA512 TLSH

Submit Download

94a38d44-ec0b-476f-a3d4-363e5f07e022

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\94a38d44-ec0b-476f-a3d4-363e5f07e022
Size 2KB
SHA256 064c53dfbb697846b983278e5dcbcd575c1632f9f432b5b72a17d455a0c01848
MD5 82ff128e8764c3c3358ce4111c190889
SHA1 4ebc82dedb12ecb0822906b4e5c884b8e7131e4e
SHA512 561d6da19dfd3da9d60f7038c6272840b9be77e8f0c402cdfc1c1e6478072229417ccd8b182469d15848b694fe3a816f7bd912c6ba0effe054cf0ab01796d2a0
TLSH
T1F741249C36785D7B9CD6E19D8482338E57B0991340C61C432E51DE0C8DA66A9736A52B
MD5 SHA1 SHA512 TLSH

Submit Download

977125fb-052a-42d9-9059-52c8531a3046

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\977125fb-052a-42d9-9059-52c8531a3046
Size 3KB
SHA256 f4d08c3801f681d3c495d71a05d0abd414c4208a77fe383e21b207367b3a7eb0
MD5 193fe7aedac768440d75388f8191b386
SHA1 53f4aa15389fb16c7acba875812243e1b1a891a4
SHA512 e44c9ed596e79b306e248afaa6ffffe30eb2d5cc89451e0278fc9ffaf8ec589b4e688d68af3a943a34a04f8d04a82c271344135ec7a5bc8fa23c55e72dfae724
TLSH
T105615461152C69738BE8A144F3777A848ADE339F18871A8D1579CD2882F84B457CB34B
MD5 SHA1 SHA512 TLSH

Submit Download

99904e40-6127-4688-b6c5-f6d7c197b52f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\99904e40-6127-4688-b6c5-f6d7c197b52f
Size 235B
SHA256 0fd804a70ceb5bc2c9b17ff3c729cb59cd98d08df6628fbd67ea92c0493f5745
MD5 ad94c70e6e6fed8dfd7ce8c1e514985a
SHA1 4f3bebfcd81145c7115881da45c28fe6601fe252
SHA512 e03b16d6fd339079dabe07bca76d19cc95002893a6c0fb16b4e8e2c29e3a6bc21d793c4ac7d2ce9b1eefc1c6f4d30c8a798cf047792ac8bc72d5a6d61343c328
TLSH
T1BCD09780248C67AC08140F07B0B079CA30A8CC3310709820AA61417889FCDC502A1947
MD5 SHA1 SHA512 TLSH

Submit Download

a6045ae8-a62d-479e-b098-f8b20df13c18

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\a6045ae8-a62d-479e-b098-f8b20df13c18
Size 2KB
SHA256 279a9d902dab52f820b3abe152c4810c2d52117fa954e91154daf2ad089177c8
MD5 279374b7ff3d1edd0d422c4cc46c06d7
SHA1 fff2a6151322be0dbaf340ce3d0ed3f3563c050c
SHA512 a11b26f22c226994d1886716a8d638b38644fd0a9b6a3ec4247681630435e3fcdc8d2a029ace9d301549faab45dfed61ec1523777914454e8abec8d3164d6d22
TLSH
T1B541245835789D37DCEBF19D9482374E53A08A1340C718472E91EF0CCCD66AA336AA3B
MD5 SHA1 SHA512 TLSH

Submit Download

accb0bb9-b5ae-4ed1-98e4-61bd37245c86

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\accb0bb9-b5ae-4ed1-98e4-61bd37245c86
Size 883B
SHA256 2b764789226efbf5b206cc80c334cdd0021856e75f31276182aa935d1da26bcf
MD5 ee5a1c3b55bb1af6ec3ec855d3a957d7
SHA1 1682210db56110586139e2533ee0305030f09bff
SHA512 7d3459c47b130ab0d5ba525eef2c03bc3992378a181e4a49754187607089dcd9431bf737badddceb21298156885df35fb6c37efec3648ef9bd71278d8a23bf2b
TLSH
T137119C8197347572DD68D29BC9913B455BB8752380C684082EE14E1C0D7F52EA366207
MD5 SHA1 SHA512 TLSH

Submit Download

da2d61ff-dca5-448e-bd17-d3e69196d78d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\da2d61ff-dca5-448e-bd17-d3e69196d78d
Size 235B
SHA256 46aa8ef4c07bd24f13ab205db46d60e5ebbe058fe709828dc8beabe17dcfc4fb
MD5 7b9b31aab782b6ff4ab3e3f6a07c8d05
SHA1 db1b03591d82c01e458503dcf30905be7f7c263a
SHA512 e8a00d9ac00af537a7609af0c9f5f28e7f9cb0b7dbf0cc9e5dfd32f04ba517fdec110a1b57e3fe85908c9b1cf73cb19c25db893ece83e8314f31ba509370d4a6
TLSH
T1AAD09784988C6B2C08104F02F0A07AC230868C3325795810CE904634D9BAEC90261856
MD5 SHA1 SHA512 TLSH

Submit Download

e0c7e921-f101-4f16-befb-c7c1cba7d508

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\e0c7e921-f101-4f16-befb-c7c1cba7d508
Size 896B
SHA256 f6c2c31f29d3abf683d53d092f9e4a78d5d70c5f94e9ff12f2117cbc023630d3
MD5 a28e189255e60d307fbdcf2c4420feac
SHA1 5323ccd8791dd449df52e3eea065c8a08b87b435
SHA512 0d5d73f113ac71b546cd1d6aa527a9f77ec15cb425cb8776eb51dba2237826594638dbc0ea8dbb44de9422be73afe72a5dc5872232bb7fb25132330657998134
TLSH
T16F11DC80CA3475B3C964928B89D277424BB4B12380C78D187EA14E1C4CFE02EA367207
MD5 SHA1 SHA512 TLSH

Submit Download

e229d17b-959e-4567-a945-36ae2b314d71

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\e229d17b-959e-4567-a945-36ae2b314d71
Size 886B
SHA256 c4e52e4c9213a446da0153403856267a4ecd3e32d08121be3b22e1524d34e180
MD5 75642f22fc25eb8b2674171d423fb85c
SHA1 70469cbb40672d50b180292f2aeb731652b6e50a
SHA512 70f8fa466dba1397ea1a7b1503ec7a51b49c38a3bd863f7079c5126be25c5006cb08b10f8d347d1765ac83ee1073de927c2041fd7653a26d0c17492855119a67
TLSH
T110110C918A34B5B2DD68C38B89E177428BF4B12380C78C087DA11E1C4DBB42EA7A6747
MD5 SHA1 SHA512 TLSH

Submit Download

f9fbd64b-151a-4cfa-8bad-4252625585f6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\f9fbd64b-151a-4cfa-8bad-4252625585f6
Size 3KB
SHA256 2366dd0ebfd034b9dfa73ad8e5ade6b176f2a2e5954f61bc8d59737ccba66703
MD5 8747e616f70ada7a121483e854ea901d
SHA1 28cbcef7e4299d9b0e4ec9c7e2bf211d266a7cad
SHA512 608b6f780b356d2c1d15316f3d79d37ad46481a56c4a3e6586c2ec67851b060f98ca914a365dba316ccdcd5407353df827970eee54abc45a0afa8a79ac0cb2f4
TLSH
T1BB615561152C79738AE8A141F3677A848AEE339F14431ACD25B9CD2442F84B4578B35B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\prefs-1.js
Size 6KB
SHA256 9a6ee0ddcabafc18921017e76305f2f31cda216e003dbc56b9de0b0adca9d2a5
MD5 d72061ff24a0c548f9003b18b3035581
SHA1 e22f624e786e7b006786cce160a55d4177b773c2
SHA512 51edbcc0babaf003cf1d81a78edcf7ae62cd90a8d82f253839d19b45890965911e0a925721182918efe44a8ce4eb72e311e181bba4d317fdb54cd938f920b359
SSDEEP 96:xHEUTUVqGq/uffkT1zS8SSlldv9jSnWHYumMBw88H8L4cnMz9:W4R/uffkTBSShY0Bw88n
TLSH
T176E10F7894088B7F74B6776CAC6888316AB2413BB7BF68D710BA54C5010CF3456F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\prefs-1.js
Size 6KB
SHA256 efb457650b1d83873d007231f82c5f4508b05dc7053a758eab52b29ee523c0a7
MD5 83ec9240cbe1d7b60705621c31509ce4
SHA1 16dee82932192a7201313c340e4faf43125494a2
SHA512 ada6eee6e26018606b45c6d8dfcc5356bf80c28abe657319c5a3d2f1c0f6f9cd170a732efd750513db66648a8d3b59edb7346b3fe4e6c220e016cf361da8a5a4
SSDEEP 96:xHEUTUVqGq/uffkT1zS4SSlldv9jlnWHYumMBw88H8L4cnMhQ9:W4R/uffkT1SSWY0Bw88A
TLSH
T1A3E10F7894088B7F74B6776CAC6888316AB2413BB7BF68D710B954D5010CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\prefs.js
Size 6KB
SHA256 255bd763d359ea9a05d738ae6d87d56b7eedb44a87e31a33d9ac15f9e03b535a
MD5 f4902d103d2db1b11471d5902ecaf33f
SHA1 f19b9ad94cc09105009fa2c946bd2428da7f7f2e
SHA512 065ed55c747630ff8091d369dcb1eb7651ec3567751d7717968f41d70e8e20a861b104f5d08b65a1fa8b33b9c8c236c2769f760ccd370ef7738bcabe1d5db65c
SSDEEP 96:xHEUTUVqGq/uffKjcnjf1zSOOSSlldv9jbnWHYumMBw88H8L4cnMz9:W4R/uff/rDOSScY0Bw88n
TLSH
T186E10F7894088B7F74B6776CAC6888316AB2413BB7BF68D710BA44D5010CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

Payment receipt 2.bat.exe

Path C:\Users\Admin\AppData\Roaming\Payment receipt 2.bat.exe
Size 269KB
SHA256 2babb5268496a4b5231d8d58e3f84ebe220ab2ddea277ec9910bdbdffb572f4d
MD5 3238874df93198525df1c1a03cc4b75e
SHA1 498b7141a37239f11edcb5f477a5c62f2dc167b8
SHA512 f540de49269648bc853025ea0b19bdf672a1a9e68eff8fecf7eeb7929080802fc7d189777484e1dc72101c6e17032b5da3b007a930d120f9782fd4c3282af993
SSDEEP 6144:kcBvWb0Pv8SNUzKRdCb1J49OYTczmB/doLcPCkT:tO0PESSK6xJQJTnxifkT
TLSH
T1394412A5B270D4F3D2735BF09E731A779BB9EF14129146833B45BB2E7C37A408A4A502
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Brndingerne.aff

Path C:\Users\Admin\folkeviserne\Brndingerne.aff
Size 64KB
SHA256 af5c10791839af522bd0ad9d79fb461c92be2562827a21892b6870c95f91a2df
MD5 c9db8417591d4448dbdf8e93b9cd04fc
SHA1 6d1798b2176cedb43dab5c39bd33bf3cd8c5b6af
SHA512 01edd00d16f4f12af7a34b169b5b56f1c9ce71f339c0883c7654bf52f98f4f3d8d1ec7faf97c9eb7ac0394aaee51796f9ed70b92264a8e0818a5cd77de2bab49
SSDEEP 96:cNw4VlwI4IsLCwD0BTrzjPTf8NPhDyHiFQg5jTqK:cNwa+fLChBTrzjDUxyCF35jTB
TLSH
T12353EBE9C523F0BBE8A00C15615627CEE6C4CC195D154411D7C3ABBD7517FA7119458C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gonocoele.Spe

Path C:\Users\Admin\folkeviserne\Gonocoele.Spe
Size 182KB
SHA256 4f2096ee09f1d2415a63b7545341f68227d734f342d6c9f096b9edb57d734621
MD5 e94f451899ba7dd6d9e28edfb7464e47
SHA1 5802a0bd7b73969137f6810f6b88311f92574026
SHA512 75c04d9490cdfb3c7652fb6408b6f640d42969533f475d4966467c1fe4e5f16bbcc2c2998fe3450fb633234833a7bf2b7311818f8327b5d779fdabe58d33dbe3
SSDEEP 3072:S8CluKGqIT1dmWNdYI0BTftT+rQQuoEcN/R5JnbPQdaTclHg:S8mI5dmWu51TIQfcNjJnulHg
TLSH
T15F04D08C8ED6F0A6CED1FB3D62E1992FB49520212FD59D913C2155F4A632AEC2017C7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 d8740e85859c596f2f6ab9901e299a866ca32e3c459dd86eb91379f3195e22bd
MD5 9df2b78bb74abec247497f1b943e76ab
SHA1 f81c87f6577e959b1785e5efcbdb78353c6af653
SHA512 fb75e9070bae750f37b8ebe701c51277ab02edfa89fae810737fea00d3c48797be21e00aa5e19089aef1851fc6473035c50fef41b0025d706cd907e5b9ab41d0
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 8KB
SHA256 d85724993c532c1da8509d780375cd0821cca50a3cf3a8fea65296db9ada580f
MD5 73bd734fb0b6f4740a7d75993fa7d298
SHA1 635bb7faa856144e81c5b4d74e17d30b5c400d89
SHA512 515d2d83243909b140d8c7853dd45c2d5904abf2699ae4ca24f5835b811ab8b8e049ad6ad5a3da3b0199d1daf45adc537904ced855c11791d3ea725ac7f62d53
SSDEEP 192:PncQAbJ9AIaJFAuVQ5AA3Obb/EAXQ7VuwgfnAILyfqqVwENeKAt24IUbLt6COzin:PncQAbJ9AIaJFAuVQ5AA3Obb/EAXQ7Vy
TLSH
T1C112BDD58F02447F3B82DF6B325332556E9B240AC7F854B237EB5602B4CA966051F2B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/948-477-0x00000000006E0000-0x00000000006E1000-memory.dmp

Download

memory/948-374-0x00000000006D0000-0x00000000006D1000-memory.dmp

Download

memory/1492-74-0x0000020156C60000-0x0000020156C9F000-memory.dmp

Download

memory/1708-239-0x0000000039520000-0x0000000039530000-memory.dmp

Download

memory/1708-67-0x0000000037060000-0x000000003707E000-memory.dmp

Download

memory/1708-33-0x0000000039530000-0x0000000039AD6000-memory.dmp

Download

memory/1708-32-0x0000000000440000-0x00000000004FE000-memory.dmp

Download

memory/1708-30-0x0000000000440000-0x0000000001757000-memory.dmp

Download

memory/1708-64-0x0000000039FC0000-0x000000003A036000-memory.dmp

Download

memory/1708-65-0x0000000039F60000-0x0000000039FB0000-memory.dmp

Download

memory/1708-31-0x0000000077CC1000-0x0000000077DE3000-memory.dmp

Download

memory/1708-15-0x0000000077D6B000-0x0000000077D6C000-memory.dmp

Download

memory/1708-35-0x0000000039BE0000-0x0000000039C46000-memory.dmp

Download

memory/1708-66-0x000000003A040000-0x000000003A56C000-memory.dmp

Download

memory/1708-3620-0x000000003AB30000-0x000000003AB3A000-memory.dmp

Download

memory/1708-38-0x0000000077DEB000-0x0000000077DEC000-memory.dmp

Download

memory/1708-3619-0x000000003AA60000-0x000000003AAF2000-memory.dmp

Download

memory/1708-37-0x0000000006800000-0x00000000068DF000-memory.dmp

Download

memory/1708-34-0x0000000039520000-0x0000000039530000-memory.dmp

Download

memory/1708-43-0x0000000039CC0000-0x0000000039D72000-memory.dmp

Download

memory/1708-3609-0x000000003ABA0000-0x000000003AEF7000-memory.dmp

Download

memory/1708-3605-0x0000000036AA0000-0x0000000036AC2000-memory.dmp

Download

memory/1708-217-0x0000000077CC1000-0x0000000077DE3000-memory.dmp

Download

memory/1708-13-0x0000000077D58000-0x0000000077D59000-memory.dmp

Download

memory/1708-14-0x0000000077DEB000-0x0000000077DEC000-memory.dmp

Download

memory/1708-63-0x0000000039D70000-0x0000000039F32000-memory.dmp

Download

memory/2052-12-0x00000000009D0000-0x0000000000AAF000-memory.dmp

Download

memory/2052-11-0x0000000074A65000-0x0000000074A66000-memory.dmp

Download

memory/3036-1035-0x0000000036A80000-0x0000000036AA0000-memory.dmp

Download

memory/3036-1034-0x0000000036A60000-0x0000000036A79000-memory.dmp

Download

memory/3036-1033-0x0000000036A30000-0x0000000036A52000-memory.dmp

Download

memory/3036-1032-0x0000000006800000-0x00000000068DF000-memory.dmp

Download

memory/3184-466-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

Download

memory/3184-361-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Download

memory/5352-323-0x00000000008D0000-0x00000000009AF000-memory.dmp

Download