phantom_stealer | 235a078447b8d67176bee9b3b3d009f52dfe9f85dbe76434fd3ae7f438795604

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/04/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FACTURA.js
Size 2.2MB
Sample260422-ththnsaz2k
SHA256 235a078447b8d67176bee9b3b3d009f52dfe9f85dbe76434fd3ae7f438795604
MD5 1765c73b5518c5f13360d7e25e27405d
SHA1 d21fb527713375168b5f405edbc7de2bb9dd58ac
SHA512 7debde314b483687dab82e64b0da1ba75ec355aa13b2390660188bd27add25be9e0196a17427676f15010e5e5405eb5ac594c46c76cd22cdaebb83ac1f4c7d11
SSDEEP 768:1wbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbX:dS
TLSH
T141B5574E9ABDB353FD9424F4E849D109E46724B3674242EFEA4EC5CA70E1C74C8F1A26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution phantom_stealer persistence privilege_escalation stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

https://api.telegram.org/bot7790172754:AAF_60hia2tGikwrom2Y4H5E36J4OuLyvag/sendMessage?chat_id=6900395692

Mutex

MBJLXDZN7C92M1SIXOQQ

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 1 IoCs

resource	yara_rule
behavioral1/memory/1428-13-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	4516	powershell.exe	85

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4620	powershell.exe
10	4620	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4620	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
211	icanhazip.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4620 set thread context of 1428	4620	powershell.exe	88

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2528	cmd.exe
784	netsh.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2152	chrome.exe
2268	msedge.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	AddInProcess32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	AddInProcess32.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
4620	powershell.exe
4620	powershell.exe
1428	AddInProcess32.exe
1428	AddInProcess32.exe
820	chrome.exe
820	chrome.exe
1428	AddInProcess32.exe
1428	AddInProcess32.exe
1428	AddInProcess32.exe
1428	AddInProcess32.exe
1428	AddInProcess32.exe
1428	AddInProcess32.exe
1428	AddInProcess32.exe
1428	AddInProcess32.exe
1428	AddInProcess32.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
1428	AddInProcess32.exe
1428	AddInProcess32.exe
1428	AddInProcess32.exe
1428	AddInProcess32.exe
1428	AddInProcess32.exe
1428	AddInProcess32.exe
1428	AddInProcess32.exe
1428	AddInProcess32.exe
1428	AddInProcess32.exe
1428	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4620	powershell.exe
Token: SeDebugPrivilege	1428	AddInProcess32.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe
Token: SeShutdownPrivilege	820	chrome.exe
Token: SeCreatePagefilePrivilege	820	chrome.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
820	chrome.exe
820	chrome.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
6092	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3868	firefox.exe
1428	AddInProcess32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 1428	4620	powershell.exe	88
PID 4620 wrote to memory of 1428	4620	powershell.exe	88
PID 4620 wrote to memory of 1428	4620	powershell.exe	88
PID 4620 wrote to memory of 1428	4620	powershell.exe	88
PID 4620 wrote to memory of 1428	4620	powershell.exe	88
PID 1428 wrote to memory of 820	1428	AddInProcess32.exe	89
PID 820 wrote to memory of 3944	820	chrome.exe	90
PID 1428 wrote to memory of 820	1428	AddInProcess32.exe	89
PID 1428 wrote to memory of 820	1428	AddInProcess32.exe	89
PID 820 wrote to memory of 1192	820	chrome.exe	91
PID 820 wrote to memory of 2152	820	chrome.exe	92
PID 820 wrote to memory of 2476	820	chrome.exe	93
PID 1428 wrote to memory of 3944	1428	AddInProcess32.exe	90
PID 1428 wrote to memory of 3944	1428	AddInProcess32.exe	90
PID 820 wrote to memory of 3536	820	chrome.exe	94
PID 820 wrote to memory of 2744	820	chrome.exe	95
PID 820 wrote to memory of 4444	820	chrome.exe	96
PID 820 wrote to memory of 4704	820	chrome.exe	97
PID 820 wrote to memory of 2368	820	chrome.exe	98
PID 1428 wrote to memory of 2744	1428	AddInProcess32.exe	95
PID 1428 wrote to memory of 2744	1428	AddInProcess32.exe	95
PID 820 wrote to memory of 4800	820	chrome.exe	99
PID 1428 wrote to memory of 4704	1428	AddInProcess32.exe	97
PID 1428 wrote to memory of 4704	1428	AddInProcess32.exe	97
PID 820 wrote to memory of 1164	820	chrome.exe	100
PID 1428 wrote to memory of 2152	1428	AddInProcess32.exe	92
PID 1428 wrote to memory of 2152	1428	AddInProcess32.exe	92
PID 1428 wrote to memory of 820	1428	AddInProcess32.exe	89
PID 1428 wrote to memory of 820	1428	AddInProcess32.exe	89
PID 1428 wrote to memory of 2476	1428	AddInProcess32.exe	93
PID 1428 wrote to memory of 2476	1428	AddInProcess32.exe	93
PID 820 wrote to memory of 2312	820	chrome.exe	101
PID 1428 wrote to memory of 4444	1428	AddInProcess32.exe	96
PID 1428 wrote to memory of 4444	1428	AddInProcess32.exe	96
PID 820 wrote to memory of 4472	820	chrome.exe	102
PID 1428 wrote to memory of 1192	1428	AddInProcess32.exe	91
PID 1428 wrote to memory of 1192	1428	AddInProcess32.exe	91
PID 1428 wrote to memory of 2368	1428	AddInProcess32.exe	98
PID 1428 wrote to memory of 2368	1428	AddInProcess32.exe	98
PID 1428 wrote to memory of 3944	1428	AddInProcess32.exe	90
PID 1428 wrote to memory of 3944	1428	AddInProcess32.exe	90
PID 1428 wrote to memory of 2744	1428	AddInProcess32.exe	95
PID 1428 wrote to memory of 2744	1428	AddInProcess32.exe	95
PID 1428 wrote to memory of 4704	1428	AddInProcess32.exe	97
PID 1428 wrote to memory of 4704	1428	AddInProcess32.exe	97
PID 1428 wrote to memory of 2152	1428	AddInProcess32.exe	92
PID 1428 wrote to memory of 2152	1428	AddInProcess32.exe	92
PID 1428 wrote to memory of 820	1428	AddInProcess32.exe	89
PID 1428 wrote to memory of 820	1428	AddInProcess32.exe	89
PID 1428 wrote to memory of 2476	1428	AddInProcess32.exe	93
PID 1428 wrote to memory of 2476	1428	AddInProcess32.exe	93
PID 1428 wrote to memory of 4444	1428	AddInProcess32.exe	96
PID 1428 wrote to memory of 4444	1428	AddInProcess32.exe	96
PID 1428 wrote to memory of 1192	1428	AddInProcess32.exe	91
PID 1428 wrote to memory of 1192	1428	AddInProcess32.exe	91
PID 1428 wrote to memory of 2368	1428	AddInProcess32.exe	98
PID 1428 wrote to memory of 2368	1428	AddInProcess32.exe	98
PID 1428 wrote to memory of 4800	1428	AddInProcess32.exe	99
PID 1428 wrote to memory of 4800	1428	AddInProcess32.exe	99
PID 1428 wrote to memory of 3944	1428	AddInProcess32.exe	90
PID 1428 wrote to memory of 3944	1428	AddInProcess32.exe	90
PID 1428 wrote to memory of 2744	1428	AddInProcess32.exe	95
PID 1428 wrote to memory of 2744	1428	AddInProcess32.exe	95
PID 1428 wrote to memory of 4704	1428	AddInProcess32.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\FACTURA.js
1⤵
PID:4644

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "IEX $env:INTERNAL_DB_CACHE;[Environment]::SetEnvironmentVariable('INTERNAL_DB_CACHE',$null,'User')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:1428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r4l1qodf.e3c"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:820
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\r4l1qodf.e3c /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\r4l1qodf.e3c\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\r4l1qodf.e3c --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8278fc728,0x7ff8278fc734,0x7ff8278fc740
      4⤵
      PID:3944
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r4l1qodf.e3c" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1700,i,15401972345606583833,6309468554697447279,262144 --field-trial-handle=1968,i,16569471840054969899,13034284874546792974,262144 --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:2
      4⤵
      PID:1192
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r4l1qodf.e3c" --force-high-res-timeticks=disabled --metrics-shmem-handle=2032,i,12014551192885283851,16231948455842957858,524288 --field-trial-handle=1968,i,16569471840054969899,13034284874546792974,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:3
      4⤵
      System Time Discovery
      PID:2152
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r4l1qodf.e3c" --force-high-res-timeticks=disabled --metrics-shmem-handle=2168,i,2653013821574222742,16679672798895468940,524288 --field-trial-handle=1968,i,16569471840054969899,13034284874546792974,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:8
      4⤵
      PID:2476
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r4l1qodf.e3c" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,571236594796091159,12939685987256949431,2097152 --field-trial-handle=1968,i,16569471840054969899,13034284874546792974,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:1
      4⤵
      PID:3536
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r4l1qodf.e3c" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,17216179832667995528,14989498768221082410,2097152 --field-trial-handle=1968,i,16569471840054969899,13034284874546792974,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:1
      4⤵
      PID:2744
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r4l1qodf.e3c" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3596,i,2874750982668554701,2868390345839905921,2097152 --field-trial-handle=1968,i,16569471840054969899,13034284874546792974,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:4444
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r4l1qodf.e3c" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3620,i,6165018997102243800,12808328539352185617,2097152 --field-trial-handle=1968,i,16569471840054969899,13034284874546792974,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:2
      4⤵
      PID:4704
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r4l1qodf.e3c" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4148,i,3171544661297297970,15889389732861871075,2097152 --field-trial-handle=1968,i,16569471840054969899,13034284874546792974,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:2
      4⤵
      PID:2368
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r4l1qodf.e3c" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3732,i,6820827148286270604,4403344403201451171,2097152 --field-trial-handle=1968,i,16569471840054969899,13034284874546792974,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:1
      4⤵
      PID:4800
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r4l1qodf.e3c" --force-high-res-timeticks=disabled --metrics-shmem-handle=4460,i,16019785387282286641,1570116466041419634,524288 --field-trial-handle=1968,i,16569471840054969899,13034284874546792974,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
      4⤵
      PID:1164
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r4l1qodf.e3c" --force-high-res-timeticks=disabled --metrics-shmem-handle=4504,i,3680629541639403243,12242346360267058003,524288 --field-trial-handle=1968,i,16569471840054969899,13034284874546792974,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
      4⤵
      PID:2312
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r4l1qodf.e3c" --force-high-res-timeticks=disabled --metrics-shmem-handle=4556,i,2321696163582884408,7048733942468979366,524288 --field-trial-handle=1968,i,16569471840054969899,13034284874546792974,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
      4⤵
      PID:4472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ao3c3bsw.4nd"
    3⤵
    PID:2548
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ao3c3bsw.4nd
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:3868
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27099 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2092 -initialChannelId {33f21718-d719-4857-a1d9-03b3752c323c} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:4064
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2184 -prefsLen 27135 -prefMapHandle 2172 -prefMapSize 270279 -ipcHandle 2148 -initialChannelId {30e9a95b-86a7-44e0-b15f-f24e21317366} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:4460
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f7889f88-6dcb-4641-9d09-845ae87fe8c1.dmp"
        5⤵
        
        PID:4836
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2776 -prefsLen 27135 -prefMapHandle 2772 -prefMapSize 270279 -ipcHandle 2632 -initialChannelId {0f49c15b-281c-4507-a677-d59fcc94ae28} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:4988
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9d4936dd-587e-44f6-91bc-d8d678ee7fa9.dmp"
        5⤵
        
        PID:3132
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2864 -prefsLen 27135 -prefMapHandle 2632 -prefMapSize 270279 -ipcHandle 3160 -initialChannelId {e52cd069-c52d-46f3-b6ef-1f0fc71e7653} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:4440
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2291d8c9-b4c8-43f4-b939-e741b1e2bacf.dmp"
        5⤵
        
        PID:4208
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3292 -prefsLen 27200 -prefMapHandle 3308 -prefMapSize 270279 -ipcHandle 3352 -initialChannelId {8f59c3ae-ca19-4369-9978-f27f88537873} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:4588
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3452 -prefsLen 27325 -prefMapHandle 3464 -prefMapSize 270279 -jsInitHandle 3356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3784 -initialChannelId {7bfe9cb8-eb2c-47a8-984e-2bfd5628985d} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:1060
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ebcfefe5-9e3d-4b03-9b54-92e87cd4be7b.dmp"
        5⤵
        
        PID:4256
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3912 -prefsLen 27325 -prefMapHandle 3916 -prefMapSize 270279 -ipcHandle 3920 -initialChannelId {9e5bf533-21c2-44a0-943d-b1e6e4491afc} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:4348
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3b5940e8-100a-4a05-a48c-3e7e067a303c.dmp"
        5⤵
        
        PID:2016
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4204 -prefsLen 27325 -prefMapHandle 4200 -prefMapSize 270279 -ipcHandle 4192 -initialChannelId {8c54e5aa-d023-4263-a4d0-902f2e079827} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:5092
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4592 -prefsLen 34824 -prefMapHandle 4596 -prefMapSize 270279 -jsInitHandle 4600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4540 -initialChannelId {de4e12fd-4784-4b84-9328-ade68223015b} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:2560
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4976 -prefsLen 35012 -prefMapHandle 5036 -prefMapSize 270279 -ipcHandle 5044 -initialChannelId {60f706c2-3021-46ca-ae72-685cef3536ba} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:5720
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4720 -prefsLen 32900 -prefMapHandle 5204 -prefMapSize 270279 -jsInitHandle 5208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5216 -initialChannelId {0f7b5241-5019-4b25-bd0b-838b0764ed97} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:5760
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5232 -prefsLen 32900 -prefMapHandle 5236 -prefMapSize 270279 -jsInitHandle 5240 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5248 -initialChannelId {1c1090a3-22bd-455d-b29a-df787bb97393} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:5768
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5588 -prefsLen 32952 -prefMapHandle 5592 -prefMapSize 270279 -jsInitHandle 5596 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5608 -initialChannelId {0ef18cec-bdea-435f-9211-e06b3a534a04} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2b0,0x7ff824afc188,0x7ff824afc194,0x7ff824afc1a0
      4⤵
      PID:6136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b" --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1772,i,3796732649635731815,12187032770033139752,262144 --field-trial-handle=2328,i,6883548885028611880,9717785696603289761,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
      4⤵
      PID:4408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b" --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1956,i,15354832883119900009,1990300128740007293,524288 --field-trial-handle=2328,i,6883548885028611880,9717785696603289761,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
      4⤵
      System Time Discovery
      PID:2268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b" --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2392,i,4939621110343979213,2413355289164274402,524288 --field-trial-handle=2328,i,6883548885028611880,9717785696603289761,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:8
      4⤵
      PID:3764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b" --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3336,i,10695156584707542544,8000737097588993995,2097152 --field-trial-handle=2328,i,6883548885028611880,9717785696603289761,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:1
      4⤵
      PID:2572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3340,i,16583239917548455225,8003285530940061746,2097152 --field-trial-handle=2328,i,6883548885028611880,9717785696603289761,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
      4⤵
      PID:4536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b" --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3568,i,12617971557973619954,12514494691991618774,524288 --field-trial-handle=2328,i,6883548885028611880,9717785696603289761,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:8
      4⤵
      PID:5280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b" --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3576,i,9245712298991476171,1910211228612397213,524288 --field-trial-handle=2328,i,6883548885028611880,9717785696603289761,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
      4⤵
      PID:5304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b" --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3580,i,13524307465560984304,5369054224507313328,524288 --field-trial-handle=2328,i,6883548885028611880,9717785696603289761,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
      4⤵
      PID:5308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b" --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3668,i,9105667439137014388,15616000693719215983,2097152 --field-trial-handle=2328,i,6883548885028611880,9717785696603289761,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
      4⤵
      PID:5324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3684,i,15047393238548115169,12450120373498187498,2097152 --field-trial-handle=2328,i,6883548885028611880,9717785696603289761,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:2
      4⤵
      PID:5352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b" --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3724,i,1049225189594484336,12261458212461732710,2097152 --field-trial-handle=2328,i,6883548885028611880,9717785696603289761,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
      4⤵
      PID:5344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3816,i,3228458084867038823,11349737676805726826,2097152 --field-trial-handle=2328,i,6883548885028611880,9717785696603289761,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:2
      4⤵
      PID:5328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b" --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3836,i,8195172669610064796,10123880389396567356,2097152 --field-trial-handle=2328,i,6883548885028611880,9717785696603289761,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:1
      4⤵
      PID:5356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3868,i,15854093545212055012,18255671015505455422,2097152 --field-trial-handle=2328,i,6883548885028611880,9717785696603289761,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:2
      4⤵
      PID:5368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b" --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3776,i,12414836076921652362,12466933341555653691,2097152 --field-trial-handle=2328,i,6883548885028611880,9717785696603289761,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:1
      4⤵
      PID:5372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3908,i,16868361729825012826,11270732778052847082,2097152 --field-trial-handle=2328,i,6883548885028611880,9717785696603289761,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:2
      4⤵
      PID:5388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b" --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3932,i,3995334936366480135,12964915106739685261,2097152 --field-trial-handle=2328,i,6883548885028611880,9717785696603289761,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:1
      4⤵
      PID:5412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3992,i,17181696360673313934,3602602403718752405,2097152 --field-trial-handle=2328,i,6883548885028611880,9717785696603289761,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:2
      4⤵
      PID:5400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b" --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5276,i,758614937010626767,12258630501292755207,524288 --field-trial-handle=2328,i,6883548885028611880,9717785696603289761,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
      4⤵
      PID:3224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b" --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5368,i,13158106345716206795,10192686021798931216,524288 --field-trial-handle=2328,i,6883548885028611880,9717785696603289761,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
      4⤵
      PID:5804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b" --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5444,i,9263195052472755719,16746400445773380448,524288 --field-trial-handle=2328,i,6883548885028611880,9717785696603289761,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
      4⤵
      PID:3512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b" --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5448,i,8620853232499172175,511980522043828365,524288 --field-trial-handle=2328,i,6883548885028611880,9717785696603289761,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
      4⤵
      PID:4492
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5964
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:548
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show networks mode=bssid
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4840
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2528
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:5704
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:784
  - - C:\Windows\SysWOW64\findstr.exe
      findstr All
      4⤵
      System Location Discovery: System Language Discovery
      PID:5740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_mzewdfwh.sui.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mzewdfwh.sui.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\r4l1qodf.e3c\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\r4l1qodf.e3c\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\r4l1qodf.e3c\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\r4l1qodf.e3c\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\r4l1qodf.e3c\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\r4l1qodf.e3c\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\r4l1qodf.e3c\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b\Crashpad\settings.dat
Size 280B
SHA256 6288a1d1fcf80ef4565329cbd48e3fc1d0fd1f9476d2a96934ddeb0434746b8e
MD5 20dd77d69c00d0b1d597da2be71acc86
SHA1 7b17572cde9089c0a11d694e5951aaa6878a3540
SHA512 e94b67b383cbacc455cb5673318f208acff02f86c0bdefb3b866bd56ae3ef9443a95d8d4fb382da70cbd56bebe854781a2143fc74b07d98aa37ea8145193e2cf
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b\Crashpad\settings.dat
Size 280B
SHA256 6224f9b2d94fca2f8855b5e6aa2916f677a3efe91b127a88c7da403a791d9cc9
MD5 c1f532161b9dcf376f8c61c4b4bbced9
SHA1 5a477a80bb125f0f45a2cbeb1ee2bf0377edae70
SHA512 605cbac1d906f6b1803bfe62fa78e0dddc5cdf4023d8b15604a527db9314a822b6cc9deecd393d2e10da025b68ed0b2f67e31013cc06f6e064c20c8c682779a2
TLSH
T138D011A8F3A00888CAE0A3B203300A080288C80288A2820008A00308AAA8222A30CE20
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 aed359fc36bbdcdc6f1acc5bb91ba91a8e7222150aef310de92b60b019d134de
MD5 2d5f4e5f48cc539068bc8cadd453c07e
SHA1 4be1bc3426b70571d7cd3524f0fee539b3b55ae7
SHA512 61099025a5fe64a34867e16b1fd10c3e58fc21b3475380f64c794de1f8f21b6daf369512c5583c610ed06d01f5c49c8292c635d0898b1958190704ca1b3f039b
TLSH
T134D02BFB2BDA1520DD6F47E3047795A00816BD95CE45EC5E003CB28360F126A7816C51
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 fdd8a132550fef8fac504877db4fc1f7855f32e26b1f4587fd26034b21c7692e
MD5 235ff7a55ddd00dd6acbb99dce7cf251
SHA1 8ac1daa3d175077994630cf8612a8ec860e266da
SHA512 621c64c54ecf2e815477313747bc7a3577d4b92fce95f17afcb4a5b00ff6a096283683c98d9282aeacf5540ec7094182bd38e6ea4272c92fae1cf8c68963ccde
TLSH
T10EE068BB2FE72920EE1B83D6647254B40824BC48CE41AC9E202DB68360F1A196419C22
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58e402.TMP

Path C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe58e402.TMP
Size 153B
SHA256 89e115678322bbbef4eae7d136776b9e9ebd29ca5edc243996c127a41db1d0b9
MD5 7952c11e5cfc88dc096cb580d8ce0123
SHA1 eb511c4602b8463746014230d34c96b043846619
SHA512 a9eb26152faefffd219da0afebbd29d96fb9f0cb8eeeb0ec895e8053f163687c908e83887048345a0f0848634e02b99adc651edb40efb5995ee540beac9deb33
TLSH
T156C08CFB2ADA1520DE4702D2403314A04526AC898E84EC8A002DB1C370B01267412C21
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b\Local State
Size 3KB
SHA256 202c21d431b89a0edc9fbc612400a73be9cf7bded2e35bfcdeb61a95a594c4b2
MD5 93bbe094a903440a0c89acc5aaf24063
SHA1 2a8d9a2cb108f5fb09ce77b7bf5b58d795dc6137
SHA512 d5b3b1bb7bd4786b7bfcc34f7c32e2a283146240dc58e207df3eed98c3d29642b20a0fea79f1061597bc593dad9a34a861b109b88ede0527d16d0b10b04d743b
TLSH
T12581C8716424DC276AE6AA54B58A3BD34F7431B3DE51AF54EAD4531804DB34C3F0A827
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b\Local State
Size 4KB
SHA256 5f2c4ebce496e7005496931ad2df50171b8f5c8fe2fd0184baffc1016948c1af
MD5 07ed50ad1f1e5620e0a3d097be79a7ba
SHA1 47e89e152560c83da913f2593ea49aded3f4ce9c
SHA512 ca614fd8504c59d7652f26dc77771044fd1dae265fe87a831380ea0575c9088a230aa229f15bce55cf164db0a0e0b122b15d04bf22869a7f434588f5b7af497f
SSDEEP 96:FqGNk1yQsFfKtSGNv858Frh/cInURoDotovVzGDmBZ2vTfZ39K0eUnYbX454q4a:8GNuVjdfooDUwBg2+3YqyC
TLSH
T120A1FA716434DC275EF6AA44B5C63B836FB43073E981BF98EAD81B0C04DB3882B46817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58d201.TMP

Path C:\Users\Admin\AppData\Local\Temp\wh534fpe.42b\Local State~RFe58d201.TMP
Size 1KB
SHA256 acdca719a0e4bff191fd9bc7478ab67cc8c6dc9a3ac8885c88e40d2c66983fc0
MD5 21698da8ee89d79124cc5f8aa5c35b87
SHA1 149e4f66af2de478b9fa2164a664e2e1621473ec
SHA512 c5a43096f0b23c37e3fe6bf4ff4ccf104a1beea8ae96e5b7fa81635f896d5de156286232298a533864e8186c7b1101951d3bd86ef021cd7a93e4b9b5c35c7a5b
TLSH
T14C3195F1A8646C77BDE1974AB34AFF931F34217192915E8462EC071C08E76CDA31983B
MD5 SHA1 SHA512 TLSH

Submit Download

2291d8c9-b4c8-43f4-b939-e741b1e2bacf.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2291d8c9-b4c8-43f4-b939-e741b1e2bacf.dmp
Size 65KB
SHA256 a7849d65a67982c913c5d3f6820d9e9c606d81ada9514d6cfdc7712933d55712
MD5 9a1c8f963168dd2ba636058dd1f12646
SHA1 c39f80aeed864e13dc46d60366bac1d2c9289686
SHA512 02714b1b00b5a286c1e74ebb10d7824a124312244b98e73c00794ea297114a264d48265f5330cff0002e14852b66a120438eb3434f2c563680a7afd848f0c208
SSDEEP 768:s+BthSNOOp2+jFB0JJ66XOl0ErLvBupXAyqA6Z1pz:WpdS+6XOl0EfOXAyqA6Z1pz
TLSH
T1B863A422A7B81936D5290A364AE7E7383FFBF41B2763934B0684627F1D7A3406D74E11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2291d8c9-b4c8-43f4-b939-e741b1e2bacf.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2291d8c9-b4c8-43f4-b939-e741b1e2bacf.extra
Size 10KB
SHA256 27b397d71f374db614da8f6a7ecde61c124a6185818fb91f0e4ac2d29361ca34
MD5 698e5385b7e0d2a8d43399ab38f7fcd4
SHA1 d05e80fd952e4e5026d9d54a8cc8b87ece3531bb
SHA512 7b3e88644a94b6a91ab16d09c0601d2eaa3852f94f29c57d55df9ad5b80567c5ef0a665402713065df702cfd21e2793790b3eb870cace738f1efd85530561499
SSDEEP 96:S7WC8T0CY6pw6FFFdW6H0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7aScBvtILI5qwvo:ShwhFLG7uvZ8RLRxsPpwlERfoE
TLSH
T131228453878724B7AD5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2291d8c9-b4c8-43f4-b939-e741b1e2bacf.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2291d8c9-b4c8-43f4-b939-e741b1e2bacf.extra
Size 10KB
SHA256 565ae99b7cd10f350fdf9d5f94adb6734239677011a8633e99a014ff2a9b4339
MD5 9795629af21d1dd3c6d8f4ee11279359
SHA1 0e4ad87c6b536ed29f630658760eb44205a205ff
SHA512 9ec1a9b4de2efad3ec0a345b9ba6d5863ddbbfdca03b3e6f78b7bc9279a5431773a865bde1878dddeab6c12f52d37e02ac0554ee82fcecd1d566dbddc59f0f8f
SSDEEP 192:ShCcFaiR4pmnTYapdVxzPjWBHo4TofKNdalsRfoMbLbUxIa:eCcFaiFz1LWBHo4T3amAMU
TLSH
T1C832E721081CD837E7D66C8DFB392D3AD66D7B1A00E67CAC41CCCA99C1A9478A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3b5940e8-100a-4a05-a48c-3e7e067a303c.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3b5940e8-100a-4a05-a48c-3e7e067a303c.dmp
Size 65KB
SHA256 82bd80621629e37863c62e9fb060457eeec9ea5e2c4f0739ef56b51a98c5e92d
MD5 4a11b187f6cc498728e92cf95fe629f6
SHA1 df2a5837460814fb3080cb12a1a648410d4b7edb
SHA512 689c672cfba470eceea896ffaa8a508af0ca0ab5d940b42c520e3b5cf6580b9320f014fc712b8db4be838f7697147c5c4dfd0fe04f1482adcc8f29fa5c22c85a
SSDEEP 768:TWBThPKdM33CN8L7xjel2wYBupXAyqA6Z1pz:Vdu7xjel2wYOXAyqA6Z1pz
TLSH
T15A63CC12A794142AD43E0A3659E7F7303BF7E4A02B63935B1A00726F9C673DC6E34E95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3b5940e8-100a-4a05-a48c-3e7e067a303c.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3b5940e8-100a-4a05-a48c-3e7e067a303c.extra
Size 10KB
SHA256 111252b8fc63e986a5d6f6f8e776d0a802f6c8629c29ad4e9ab18ca3144a2a53
MD5 6aa15fd15aa699cf5e217e12a790a624
SHA1 107f6b8db465c7ac0fe10add62d514a6f12365cc
SHA512 ac9f4a038a2fb58ab54424cbdd808aba2e311eda5f8c8ce89bf76adea045349f9c87e27f9c3d314829f5142fbfdf954ab51594a0ec2e78c7baa7649583df53ca
SSDEEP 96:S7WCLlyT0CY6pw6FFFdW6H0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7aBcBvtILI5qN:ShLlihFLG7uvZ8RLqxsPpwlqtfoW
TLSH
T176228453874724B7AD5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3b5940e8-100a-4a05-a48c-3e7e067a303c.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3b5940e8-100a-4a05-a48c-3e7e067a303c.extra
Size 10KB
SHA256 23af5b8044cf3591a0c2fe33f451415fccd95c5b624d3900c7bfc229bcda8d6e
MD5 d7905268b02fd698d0cfa1b8616fccb2
SHA1 c91f2a8e9ab191a24709c00a325ad7a32c433398
SHA512 e0aa2d7ec6c9d37e7712eab71f17af1782da148238ca0053f8daea088523ffe35ce0c71339ce9bbf1a5653b75c6a3d0471a19cbdcfeae6452fa1b32c5243a9fc
SSDEEP 192:ShLl8cFaiR4pmnTYapdVxzPjWBHj4TofKNdalStfoObLbUxIa:eLicFaiFz1LWBHj4T3a8AOU
TLSH
T13C32F821081CD837E7D76C8DFB392D3AD66D7B1A00E67CAC41CCCA99C1A9478A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d4936dd-587e-44f6-91bc-d8d678ee7fa9.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9d4936dd-587e-44f6-91bc-d8d678ee7fa9.dmp
Size 61KB
SHA256 c4ef894f408b7884503ce356aa145ee1891f8adf9ed4eb9f7d9d2b68986df54b
MD5 8ca642b6a16ae1d30bfd05ea6f125650
SHA1 211c01106eb7289048f538bb0207dbd0126afdc8
SHA512 f6d65263167120fdef5d06d2f5d69381ac662896b4e005884634329a91af85f4d86e412d6e889b7c2a95b30138b556956edda97e463fe2ed90872ae5f2bdc3b1
SSDEEP 768:PmWs0gDlw8MWmDHxpqKAVRZRTaBupXAyqA6Z1pz:wcAVRZRuOXAyqA6Z1pz
TLSH
T1E853BE1AA7A40479E52B0B3655E7FF323BFBE4102B93935F1210627E1C6BB486E31E15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d4936dd-587e-44f6-91bc-d8d678ee7fa9.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9d4936dd-587e-44f6-91bc-d8d678ee7fa9.extra
Size 10KB
SHA256 af0e0de29ac511b3f0df67809cc26d6125f667fedd203472dc550f36b10b71cc
MD5 67ed6225fc7112be4994e6871b37172c
SHA1 a64c06c95f2d4481b95e41aef9c4e5b944e46753
SHA512 ad81966eab542ab4ad810cacb5ad40788ab3b02382c31ed8ce6a5a6061b34a05eba81a2efdf91cb146850918ee3c2942cb36b7dadf987a4a9334faf613ce0a22
SSDEEP 96:S7WCM7T0CY6pw6FFFdW6H0Rh7CTvBb1d0FjMLlIrLlhTLlaXv7apcBvtILI5qwvt:ShMvhFLG7WvZ8RLCxsPpwlUpfoV
TLSH
T170228453874724B79D5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d4936dd-587e-44f6-91bc-d8d678ee7fa9.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9d4936dd-587e-44f6-91bc-d8d678ee7fa9.extra
Size 10KB
SHA256 7e86e543934d6b45175ee2ceca4d3dfd5deae951c1045910c65ebc95654c7dac
MD5 0306d0268f25fe9bb8d23b9b27def09a
SHA1 59ffe4b556732c0fe085f2ff1e07b40432529e0c
SHA512 263eb6533d0b9700140353052d84c067dede57770c73fafd69401472e8db3450fd4534c8847282c90677ba0c130c5db8f5992932efba2b782dc875c94250b2e5
SSDEEP 192:ShMbcFaiR4pmnTYaVdVxzPjWBH/4TofKNdalspfo5bLbUxIa:eMbcFaiF/1LWBH/4T3aiA5U
TLSH
T18922E831081CD837E7D6AC8DFB392D3AD66D7B1A00E67CAC41CCCA99C1A9478A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebcfefe5-9e3d-4b03-9b54-92e87cd4be7b.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ebcfefe5-9e3d-4b03-9b54-92e87cd4be7b.dmp
Size 65KB
SHA256 e7cbd1bfa623beb0ee9b24821113c1181b023473efef29b63faf847af06ae005
MD5 8be285927dde489b4240d2a5c70ec8b1
SHA1 fb69352f25536b4c6c3d7215dd87c04153e828e4
SHA512 86de8b1e91de5fc7c7b50521262b2553e2b9e800c78a8335ff25074cc0ab4c670772ad0387baaab434563a5f307285d856a8a6a49dfc923dd53dfdcaab4260c8
SSDEEP 768:raBW4jGeyZNfrlpfNRaaizj0sG0r3qBupXAyqA6Z1pz:7myzi1j0ROXAyqA6Z1pz
TLSH
T1C753C7126B941E39E52DC63A4AE7E7303BFBE4162B63D79F1310626E1C67344AD30E25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebcfefe5-9e3d-4b03-9b54-92e87cd4be7b.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ebcfefe5-9e3d-4b03-9b54-92e87cd4be7b.extra
Size 10KB
SHA256 7b185ad4d1861ba18804327007247ea24c1fc49b95326161a2da3bdeb492965b
MD5 987b125ff7deb6d212bcf7aff4d471bd
SHA1 e510c197de85495d3d4caec81001c6c2a7c09519
SHA512 839057f2e4b3157a013a4706ce0334a16ca491730d87a599cf8863f3cc2baad4128760b54323605a63c361d122c0e5a84e99dd9ea3be940d6e9570f553696e44
SSDEEP 96:S7WCL2T0CY6pw6FFFdW6H0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7amcBvtILI5qwt:ShLehFLG7uvZ8RLtxsPpwltTfoS
TLSH
T16E229553878724B79D5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebcfefe5-9e3d-4b03-9b54-92e87cd4be7b.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ebcfefe5-9e3d-4b03-9b54-92e87cd4be7b.extra
Size 10KB
SHA256 06eb58875c4af2e9984dd6e0a602311fbe15b74eda8cca6437a5ab5ec80f7e66
MD5 d2c12e0f1cefdf2d349fd3096928bca6
SHA1 d9b19e8439983ad31c18ba73806076daba333c2d
SHA512 068fb2b2a4edcbc8fc3627cefdb89ef079b3fc893b8b0f08d68f120c9002e5fbbe9e7c36666b50b4e62950b1e3710ced9e2cb672dbedf22848ef372f151bb223
SSDEEP 192:ShL4cFaiR4pmnTYapdVxzPjWBHk4TofKNdal1TfoibLbUxIa:eL4cFaiFz1LWBHk4T3aPAiU
TLSH
T1B832F831081CD837E7D66C8DFB392D3AD66D7B1A00E67CAC40CCCA99C1A5478A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f7889f88-6dcb-4641-9d09-845ae87fe8c1.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f7889f88-6dcb-4641-9d09-845ae87fe8c1.dmp
Size 66KB
SHA256 0d80c2999d6f1ffd57b397d596dece0b1df2b16c78b502c0fd4d583635063069
MD5 d8ace773f318111a41fd6b77d984e243
SHA1 609c916a69a12689fb4422c7231c3a9f9aa438b7
SHA512 b4b66429968b7e8a8be6ad738bec1d8377d71c1388b130a0a93a4dc3a0711f8ceb0349696b39f13267c2674c29a1a4d85ac514a9c30ac906fdbff80a2d5261cf
SSDEEP 768:UbBlApQEEjahl3WEV+T37E41iARl0EBupXAyqA6Z1pz:7B7SLE4tR7OXAyqA6Z1pz
TLSH
T1CB63981AABD40871F92A067AD5E7F7303BFBE41967A3934B2210A77E2C673506D31E14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f7889f88-6dcb-4641-9d09-845ae87fe8c1.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f7889f88-6dcb-4641-9d09-845ae87fe8c1.extra
Size 1KB
SHA256 865cd74e62c7e6decc5007a7b5121ba07101c726c6b07ce37437c96b3026976e
MD5 0f54186806f05db294657c3caf17a521
SHA1 9be732cca478e391c5823e9b1b9b502490a15ba6
SHA512 28a55b6d93c6079f491b4cdbd4eb8aaed0c03a1a4d2def9c26482d09b13290142185d5ae597077952c51e80bbf146fbef4ddafd1efe0f28b15a27055287daa13
TLSH
T17231A2F3C1AC2D5389674A88B23A1303CA99B33740D31D0C25CE0B48828E5DD9666AC3
MD5 SHA1 SHA512 TLSH

Submit Download

f7889f88-6dcb-4641-9d09-845ae87fe8c1.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f7889f88-6dcb-4641-9d09-845ae87fe8c1.extra
Size 3KB
SHA256 2f5f9ef203ec7773b6cde12f55ced857a265e6bf30f7362363df48b83c20fdec
MD5 02777b5a10ae08ad64771606250e7c87
SHA1 4d900038d3f061577a5a69958d47a44e8707a882
SHA512 d6f244ef95b17bfcc1b615608c8ca2063a02c90fa7c55d71138a311bca300b586c77857a87941f1ecd85f21480160e0aae34fb63866c4ac8e56410bf24a2fbe3
TLSH
T134810071109CE8375AEE5DCEB3376D1E899EB35998622E8C51CAC7AC0578CF46387183
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 dd399e6b91abb56b47aa0bd0e0982a3e3d671ee979f1a14ea5fc9032275f39be
MD5 c0540eaf486cb0c702006feaba22fcaf
SHA1 020210d2a821a1a5f44bb3f512ed0fbfc82e2662
SHA512 888179fd32fb05cc4298a974caec40ab60f3486706f67369317e4eb54223f1a16436875e7eae24cb9e8ecb8070ca41fbaf1b548ea2dac5f018cfed22dd8d2a4d
SSDEEP 192:GOv5zbowby0yjgybHY1d66JozGzgCl6mc0d:9bowby0yjjHyd66JozGzgC1j
TLSH
T112E11D64EB28863FC448427BCCA60F510F35395BE84E7F1535ADA0082D5B2DE7A8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 7fc16632c1876c47063e453c3e5852f6a3478299a904648205e758cd1962f486
MD5 31fe1549bf499a654a3df004053aab76
SHA1 e7a66b4c854a71b3d31e808323a72c3d4fde1885
SHA512 93b86390e0dcf6cd8591e139456de3699e5aaaba809b041de65a7ef52b221880269ace12c96b68073b9cad92b7e3c5e2d182cc74f2f4e48c9a82b522821f2efb
SSDEEP 192:VOv5zboPjZy0yjgybHY1d66JozGzgCl6mc0d:KboLZy0yjjHyd66JozGzgC1j
TLSH
T188E10E64EA29863FC408027BCCA61F510F39395BD84E7F15359DA0182D5B2DE7A8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 51254aa6ff98bbeb3a374f21b58e095b82ba5bfa220961db6d82d1e2e4d292c2
MD5 9d91fa2d1f04bc3330e5f5073ead30a4
SHA1 31a79da99c9c75533fb13eca957de89311772c4d
SHA512 47be206a52c5b71318d441ee01fd8de1c8b78adc860bd6a42c57b858a7abcf03a7b6604886f293d95e950a94efcd1b1a4b1976906aeb2712ab338f16f468ce50
SSDEEP 96:ESdF95/7bkW60rcPyUR6txbWHFGQFVmFhF7FtFNY/dd66JozGzgClKtmc0d/UK:EOv5zbowCyjfy9mY1d66JozGzgCl6mcM
TLSH
T1DFC10E64F629863FC408423ACCA21F404F39355BE84E7F2A36EDA4582D5B2CD768D0BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\events\events
Size 1KB
SHA256 de786a803846a3b9a106dfb0dfa6a28ce384afc61afcab5cddd87128ec5defda
MD5 ef61082104abd84a4c7ad1dd9ce6418a
SHA1 8229266747ac82904208e3365addbc4736b57791
SHA512 def27f4c185c55be5570cbc5bdb213cb31418a0b91e66aef81fcefe45bc2aa9220902a8e32d3bc356cbc59e19a444e3c60e2e3012d206a6718b07604d53ee42b
TLSH
T1A221379C7EB88DABAC9BE2DCF440028E53514E4A04C75D430E42DE8DCDD5FD9316A47A
MD5 SHA1 SHA512 TLSH

Submit Download

014e1077-d558-4ff6-9c9b-0dc68169e4f1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\014e1077-d558-4ff6-9c9b-0dc68169e4f1
Size 883B
SHA256 dc919a0d260ebe9c942a6a70d8c45dfac845e4ae6c1067db7a430b4fd170b960
MD5 64a7a94417bc1865ce9da51ff3d52733
SHA1 a9679976a6cb3a144b48e55aec09fe827d2b0ef3
SHA512 3d05d4956ab8e4b409545add215d604f0377abf0141d44e3feed87c27b3e6ca7abf48685286d7581d0c4ae99334e1dd400277bd1908fd61d3fa0577ddb6ba1bd
TLSH
T19811DC80A731B9A2CD78934A8465770287F4651380CB84143EE15D1809BE51EE76B30A
MD5 SHA1 SHA512 TLSH

Submit Download

12283c44-9b9c-4973-9079-2989e0fbcb9a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\12283c44-9b9c-4973-9079-2989e0fbcb9a
Size 3KB
SHA256 543e7eb78dae9c992a79fd1a9ee116be555feda102683e0927946c7168a10a44
MD5 46949a632052898fddd1155bc791dbf3
SHA1 8f9ba57726cb31121d1afd16a78421bf3169f618
SHA512 164c3e25a19b77545ce8a4ada7b8f7af2f5a2bd794159c4c96429f97884d3ba4504a2f79026b9cc4fcc0d894a23c3917c0ae66e8de0429f88b4a122eaece68f6
TLSH
T1426146611668E9738FECA140A3376D458EEE33CF54470FDD21A58DB842F9468478B35B
MD5 SHA1 SHA512 TLSH

Submit Download

12ce8ca9-e8f9-4573-bb89-bf04a217504a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\12ce8ca9-e8f9-4573-bb89-bf04a217504a
Size 3KB
SHA256 a282dcfd313445f117686c18ff3eb64b0bb056a37432ce11adb069dba5db601c
MD5 c638e1ea27338e30d032dce08ffa714d
SHA1 33b4f74fae1d7f3a713d1466696283afdcf0a005
SHA512 962ed7f766515c60f05c48c03934c2e2e5c4d99e7494a4fade626fe437b948cf95bcfc5e66af2399c5ae42fbd7a982dd4dad14ae3c0bedb387ea2b8e113fa6a7
TLSH
T13B6154611554A9738FEC6141A3376D458EDE33CF584B0FDE21998DB842F8468478B36B
MD5 SHA1 SHA512 TLSH

Submit Download

3865d0da-67bb-4a3f-8857-16af4921dbac

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\3865d0da-67bb-4a3f-8857-16af4921dbac
Size 235B
SHA256 2ccdf51b42d864dce7a86991fc460aa86ca46fec019c722efb7ddf66beab1d54
MD5 16cda99ea46d9371708f0e63b25a8874
SHA1 c20561ebff54f43731d7247a9841d3da1b6b8a6c
SHA512 6a027e5a529901a1e2ffd5b9fddbebfa1c715789b4c1db2d156c963364970b6c950e74b1c003ae5348d4db6eba6dab262fe0ac27ed72461dba575a96cfb2231a
TLSH
T1CDD0978014E8632C48281F02F0E02AC67169CC3321B47C20E9A1403C9AFCDC442A288B
MD5 SHA1 SHA512 TLSH

Submit Download

a45a4802-5cc6-41a0-bddd-80c3c5879c85

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\a45a4802-5cc6-41a0-bddd-80c3c5879c85
Size 3KB
SHA256 a7d0f74c963eb55a229f51e20c5b9f58753618205a130562bfe478c5284a2c5e
MD5 706c79d149a81acfd38120a8f59449ef
SHA1 befef0307c2f985d05a5b2bcb6d962aa14713b9d
SHA512 fbede1902260258d424b3caaa4fb63f0de32040864b21d51a10cc68b3f637658b70b7f4e636a562f049d7a3abe6d43a3f635035deec456322fa47fca1239de4f
TLSH
T1F66152611668E9738EECB045A3376D858ADE33CF584B0FDD21A9CD7842B8468478B25B
MD5 SHA1 SHA512 TLSH

Submit Download

ba9701f9-098e-4a96-a820-20348fc7ec08

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\ba9701f9-098e-4a96-a820-20348fc7ec08
Size 235B
SHA256 9eae911b509a28053d380cc0f6e1498b6693a56220e0ca26f45ba51ceb571960
MD5 439ce0c2c9971ef6c2726c929b1e0d34
SHA1 061542f51cd02c53f3154e2c79f1b9d56e1d7ffc
SHA512 c556132915f746a4ab6adf2cfbc8d094b8baa74199c8cda35950baf11c974b174c13ba455c943278adbafc48edad742a8e32f0d5b28c15796960e410c7af1f6d
TLSH
T10CD097802498A3AD08105F07F0A06AC6B05C8C3310649820D65519789BBAEC8011180A
MD5 SHA1 SHA512 TLSH

Submit Download

d0ad07ab-bf5c-495c-8f98-313eb016142d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\d0ad07ab-bf5c-495c-8f98-313eb016142d
Size 2KB
SHA256 04cf6401aad4827b727588df314a7cd72a480af198bd26bcd59cf8368e3bc050
MD5 1e311796699227669c8fdf6be2530697
SHA1 a29c8c30b4c93add335115d38e7bca6fc188e12b
SHA512 a00d4a0116cdf31af2bd37e8e6f5cc073c767ced921c9148db3bf32d43b1f541a0a5417e0a096e0e86f69afb3756b48ac6870d8cb1023e44cf3cdf7a02af597d
TLSH
T11941115836784C7BDCDAF29DD492278A97B4891300C72C432E91DF0D8C963EA776A52E
MD5 SHA1 SHA512 TLSH

Submit Download

d0d4461b-1432-4b4c-99b8-57497979f9c8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\d0d4461b-1432-4b4c-99b8-57497979f9c8
Size 896B
SHA256 e5f3d3f12a7df52455d498037aeae57989ec8e7074d23cffcf817d20bd1b942b
MD5 95bb4bde2ec189e483d637552621568d
SHA1 b591cafb3e5bf90d4fe2963ec14bbf7337c7e8d0
SHA512 ebb635aef1f39651dd5d13da6ce9c3904230e0349d913ad0761f951f8349d5306db4aca38958be9d173416d62a4b08b7006126708019f635895c1f46b355f921
TLSH
T144111090A724B8B2CC68C39791A17B4247E47523D0CB4D147DE18A28086F11AA7A770A
MD5 SHA1 SHA512 TLSH

Submit Download

d4f499f3-c739-4f77-8bbd-03831fa6b02b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\d4f499f3-c739-4f77-8bbd-03831fa6b02b
Size 3KB
SHA256 a98d36ee58be25f5ac95ecc13c2136d76f72f1dff3d63a3eaf7f178f57c6ff69
MD5 859649d92206899b2adbbdb17d2c6564
SHA1 5dbd4334377377abcc5f03dfd02dd025788f0364
SHA512 d913b2bf1b043748fcb0426903affbc812b8fc56672dc4fb53ee3156fc0d861c93df3fde6ad5043c3726ff2efbf16a43245c3781a8c9a035416a172fab56ff88
TLSH
T1EA6172211668A9338FECA044A3376D558BDE33CF584B0FDD21A9CDA842F8468478F35B
MD5 SHA1 SHA512 TLSH

Submit Download

d58aa2fb-ec1d-429a-9813-5ffd90f482ee

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\d58aa2fb-ec1d-429a-9813-5ffd90f482ee
Size 16KB
SHA256 a7f2bdf6a75ad5386fa85e60fe634b62bbb77799f2c30cc618fef0c697a962c1
MD5 690b4b2a790ddc192f00a8074d6de368
SHA1 e8fc0a426e86eb3203321da186a02fe1fc4612ac
SHA512 39bf65602a1c45b27a78f5a1940f9c27f46f4c27ab0cfdabea9447441e7eb6c73b1297db2ea0f7b3fe30a2311c7f9c0b981957d7a754f861470021d7b53c9c49
SSDEEP 192:WVSnK5cneppalc7jznyyw4QlT5i5YrZsWxaJL+3VbRBmzlJE97WA3c30aAZB+113:fKCniTWASVbRBmxU7WA3cUZQvv
TLSH
T19A72D916682045BA8291E368D4FDBFC3E6F538CB4C419FC99BE47D086DDE0AE112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e8d2dcfc-653a-4a47-97d8-a43f5aee5682

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\e8d2dcfc-653a-4a47-97d8-a43f5aee5682
Size 3KB
SHA256 ae2119913c56cc99e68772c1313f304a86262e829867e33723ca92062d51ad2b
MD5 3a0d5746653c2b33b6a9238b7a1654e9
SHA1 b314d9b742da04a3af4bf8d830dbcbbc458cb3aa
SHA512 ac71ad89962626b2a0baea8de299195ee3c3b00025f463114f47bba024585bda484ee30674dfa4d50bdc00e6c904ac63a6250c3605c28cf2c117b51487a12c2a
TLSH
T1386154611558A9738FFCA141E3376D498ADE33CF584B0F9D21A98D6842B8468478F36B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\prefs-1.js
Size 6KB
SHA256 26f6eb3a5eb800c9896dcf4244f2c8fb4c0436166b683dd055e684b35d7edc32
MD5 ede2a6e12da6655952da88dc766b4b1b
SHA1 6c930e6c7b9cc9b0bd96d77beb3e94af245e0d43
SHA512 63064cc712a6b8ad997a549745d9d010c66f5b54ba8dca3dc00007ef04aa5e3b26c0068f5b5e7757de003721151540a4b8d9f9edede9a941e38feb1e49273ae0
SSDEEP 96:xHNUTUr4qGqOfCyQf1zSDjSSl8pdv9jVn5HDg/GY9Bw88n8L4cnd88Lg:TnROfCyQfKSSGNMeaBw88Z9
TLSH
T175E14F789408CB6F74B677ACAC6888316AB2413BB7BF68C750B54484041CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\prefs.js
Size 6KB
SHA256 6c7b31ab6576d5162e6f95d4a09a722b9f03341e27ebc23e64ee7a6e0144088e
MD5 8efac1f38601e4aac31232cce4b72f73
SHA1 d7ad703430d5abd14ebb97a484f53b4da7031140
SHA512 5a218849552a7d59f88011c1ff1530feec91f10e91b67bf4290585e8797eebc82690053630cf0033ca7a7ca42a774b60396fb9e1270d153c44a0a337cff99136
SSDEEP 96:xHNUTUr4qGqOfCyKjcnjl1zSpNgNdSSl8pdv9jWn5HDg/GY9Bw88n8L4cnd88Lg:TnROfCyvBoKnSSGWMeaBw88Z9
TLSH
T11AE130789408CB7F64B677ACAC6888316AB2413BBBBF68D750B54484055CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/820-51-0x000001F9A1E90000-0x000001F9A1E9C000-memory.dmp

Download

memory/1428-21-0x0000000006700000-0x00000000067B2000-memory.dmp

Download

memory/1428-25-0x0000000007080000-0x00000000075AC000-memory.dmp

Download

memory/1428-26-0x0000000006B70000-0x0000000006B8E000-memory.dmp

Download

memory/1428-23-0x0000000006830000-0x00000000068A6000-memory.dmp

Download

memory/1428-1634-0x00000000089A0000-0x00000000089AA000-memory.dmp

Download

memory/1428-22-0x0000000006980000-0x0000000006B42000-memory.dmp

Download

memory/1428-24-0x00000000068B0000-0x0000000006900000-memory.dmp

Download

memory/1428-311-0x0000000005D70000-0x0000000006323000-memory.dmp

Download

memory/1428-20-0x0000000006620000-0x0000000006686000-memory.dmp

Download

memory/1428-19-0x00000000057C0000-0x0000000005D64000-memory.dmp

Download

memory/1428-1633-0x0000000008560000-0x00000000085F2000-memory.dmp

Download

memory/1428-1622-0x0000000006C60000-0x0000000006FB4000-memory.dmp

Download

memory/1428-13-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/1428-1621-0x0000000006C30000-0x0000000006C52000-memory.dmp

Download

memory/4620-2-0x00000227C7D10000-0x00000227C7D20000-memory.dmp

Download

memory/4620-11-0x00000227C7EF0000-0x00000227C7F12000-memory.dmp

Download

memory/4620-12-0x00000227C83A0000-0x00000227C84AC000-memory.dmp

Download

memory/4620-3-0x00000227C7D10000-0x00000227C7D20000-memory.dmp

Download

memory/4620-14-0x00000227C7D10000-0x00000227C7D20000-memory.dmp

Download

memory/4620-18-0x00000227ADED0000-0x00000227ADEDC000-memory.dmp

Download

memory/4620-17-0x00000227ADC10000-0x00000227ADCAB000-memory.dmp

Download

memory/4644-1-0x00000267EFF80000-0x00000267EFF8C000-memory.dmp

Download

memory/4644-0-0x00000267EFE40000-0x00000267EFEDB000-memory.dmp

Download