phantom_stealer | 2bb8102520f01a3b242a66e164ea24597a7eab7bacf789e59e3264e175b9d4d7

Analysis

max time kernel
298s
max time network
206s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/05/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Instant Transfer - 260514208656.vbs
Size 1.2MB
Sample260525-rmqw8sdz21
SHA256 2bb8102520f01a3b242a66e164ea24597a7eab7bacf789e59e3264e175b9d4d7
MD5 806502e36c4feacefd927eae002425bf
SHA1 b9b9a28d5ed8c9126ea4a77ea7b52497a03a2e7c
SHA512 2691edf9788fdd02d5579a3d37821dd2eff8b63da7e7756940aca31e87ef57c90830043af34411692fdce44cf047cf3316d9eac150b1620dfed4b178390a22a8
SSDEEP 24576:2YH1NumlVZ3nlAfrOlQCzdzocA/LJWSNedl4qchAy4vZb7L:vVrAS5dKJW94/RGL
TLSH
T1304523214F48DD9D7708E138DE5F37511BE08EC28478A6E34BE1848A256AF6F79B7039
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution phantom_stealer persistence stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

Mutex

1YA6UHTISPAQ669J8KKQ

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
1

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 1 IoCs

resource	yara_rule
behavioral2/memory/4244-36-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

Executes dropped EXE 1 IoCs

pid	Process
1640	MSBuild.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSBuild = "C:\\Users\\Admin\\AppData\\Roaming\\MSBuild.exe"	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4580 set thread context of 4244	4580	powershell.exe	84

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4580	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
800	4244	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2828	chrome.exe
2616	msedge.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
4580	powershell.exe
4580	powershell.exe
4244	MSBuild.exe
4244	MSBuild.exe
4564	chrome.exe
4564	chrome.exe
4244	MSBuild.exe
4244	MSBuild.exe
4244	MSBuild.exe
4244	MSBuild.exe
4244	MSBuild.exe
4244	MSBuild.exe
4244	MSBuild.exe
4244	MSBuild.exe
4244	MSBuild.exe
5420	firefox.exe
5420	firefox.exe
5420	firefox.exe
5420	firefox.exe
5420	firefox.exe
5420	firefox.exe
5420	firefox.exe
5420	firefox.exe
5420	firefox.exe
5420	firefox.exe
5420	firefox.exe
5420	firefox.exe
5420	firefox.exe
5420	firefox.exe
5420	firefox.exe
5420	firefox.exe
5420	firefox.exe
5420	firefox.exe
5420	firefox.exe
5420	firefox.exe
4244	MSBuild.exe
4244	MSBuild.exe
4244	MSBuild.exe
4244	MSBuild.exe
4244	MSBuild.exe
4244	MSBuild.exe
4244	MSBuild.exe
4244	MSBuild.exe
4244	MSBuild.exe
4244	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4580	powershell.exe
Token: SeDebugPrivilege	4244	MSBuild.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
4564	chrome.exe
4564	chrome.exe
5420	firefox.exe
5420	firefox.exe
5420	firefox.exe
5420	firefox.exe
5420	firefox.exe
5420	firefox.exe
5420	firefox.exe
5420	firefox.exe
3952	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5420	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5212 wrote to memory of 4580	5212	WScript.exe	80
PID 4580 wrote to memory of 3368	4580	powershell.exe	82
PID 3368 wrote to memory of 4152	3368	csc.exe	83
PID 4580 wrote to memory of 4244	4580	powershell.exe	84
PID 4580 wrote to memory of 4244	4580	powershell.exe	84
PID 4580 wrote to memory of 4244	4580	powershell.exe	84
PID 4580 wrote to memory of 4244	4580	powershell.exe	84
PID 4580 wrote to memory of 4244	4580	powershell.exe	84
PID 4244 wrote to memory of 4564	4244	MSBuild.exe	88
PID 4564 wrote to memory of 1156	4564	chrome.exe	89
PID 4564 wrote to memory of 3924	4564	chrome.exe	90
PID 4564 wrote to memory of 2828	4564	chrome.exe	91
PID 4244 wrote to memory of 3924	4244	MSBuild.exe	90
PID 4244 wrote to memory of 3924	4244	MSBuild.exe	90
PID 4564 wrote to memory of 4160	4564	chrome.exe	92
PID 4244 wrote to memory of 1156	4244	MSBuild.exe	89
PID 4564 wrote to memory of 2912	4564	chrome.exe	93
PID 4564 wrote to memory of 3016	4564	chrome.exe	94
PID 4244 wrote to memory of 1156	4244	MSBuild.exe	89
PID 4564 wrote to memory of 5416	4564	chrome.exe	95
PID 4564 wrote to memory of 5304	4564	chrome.exe	96
PID 4244 wrote to memory of 2828	4244	MSBuild.exe	91
PID 4244 wrote to memory of 2828	4244	MSBuild.exe	91
PID 4244 wrote to memory of 4564	4244	MSBuild.exe	88
PID 4564 wrote to memory of 3792	4564	chrome.exe	97
PID 4244 wrote to memory of 4564	4244	MSBuild.exe	88
PID 4564 wrote to memory of 3052	4564	chrome.exe	98
PID 4244 wrote to memory of 4160	4244	MSBuild.exe	92
PID 4244 wrote to memory of 4160	4244	MSBuild.exe	92
PID 4564 wrote to memory of 724	4564	chrome.exe	99
PID 4244 wrote to memory of 5304	4244	MSBuild.exe	96
PID 4244 wrote to memory of 5304	4244	MSBuild.exe	96
PID 4244 wrote to memory of 3924	4244	MSBuild.exe	90
PID 4244 wrote to memory of 3924	4244	MSBuild.exe	90
PID 4244 wrote to memory of 1156	4244	MSBuild.exe	89
PID 4244 wrote to memory of 1156	4244	MSBuild.exe	89
PID 4244 wrote to memory of 724	4244	MSBuild.exe	99
PID 4244 wrote to memory of 724	4244	MSBuild.exe	99
PID 4244 wrote to memory of 3052	4244	MSBuild.exe	98
PID 4244 wrote to memory of 3052	4244	MSBuild.exe	98
PID 4244 wrote to memory of 5416	4244	MSBuild.exe	95
PID 4244 wrote to memory of 5416	4244	MSBuild.exe	95
PID 4244 wrote to memory of 3016	4244	MSBuild.exe	94
PID 4244 wrote to memory of 3016	4244	MSBuild.exe	94
PID 4244 wrote to memory of 2828	4244	MSBuild.exe	91
PID 4244 wrote to memory of 2828	4244	MSBuild.exe	91
PID 4244 wrote to memory of 3792	4244	MSBuild.exe	97
PID 4244 wrote to memory of 3792	4244	MSBuild.exe	97
PID 4244 wrote to memory of 4564	4244	MSBuild.exe	88
PID 4244 wrote to memory of 4564	4244	MSBuild.exe	88
PID 4244 wrote to memory of 4160	4244	MSBuild.exe	92
PID 4244 wrote to memory of 4160	4244	MSBuild.exe	92
PID 4244 wrote to memory of 5304	4244	MSBuild.exe	96
PID 4244 wrote to memory of 5304	4244	MSBuild.exe	96
PID 4244 wrote to memory of 3924	4244	MSBuild.exe	90
PID 4244 wrote to memory of 3924	4244	MSBuild.exe	90
PID 4244 wrote to memory of 1156	4244	MSBuild.exe	89
PID 4244 wrote to memory of 1156	4244	MSBuild.exe	89
PID 4244 wrote to memory of 3052	4244	MSBuild.exe	98
PID 4244 wrote to memory of 3052	4244	MSBuild.exe	98
PID 4244 wrote to memory of 5416	4244	MSBuild.exe	95
PID 4244 wrote to memory of 5416	4244	MSBuild.exe	95
PID 4244 wrote to memory of 3016	4244	MSBuild.exe	94
PID 4244 wrote to memory of 3016	4244	MSBuild.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Instant Transfer - 260514208656.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:5212
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\6CEA2A7F.ps1"
  2⤵
  - Suspicious use of SetThreadContext
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fylzmbqq\fylzmbqq.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2C4B.tmp" "c:\Users\Admin\AppData\Local\Temp\fylzmbqq\CSC1F6A006283AB4B27934A93CA945BDFBB.TMP"
      4⤵
      PID:4152
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:4244
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\g04tctie.zal"
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4564
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\g04tctie.zal /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\g04tctie.zal\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\g04tctie.zal --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffb91c9c728,0x7ffb91c9c734,0x7ffb91c9c740
        5⤵
        
        PID:1156
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\g04tctie.zal" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1620,i,1607843097892308749,8692596033464403707,262144 --field-trial-handle=1920,i,4539055049816913228,11203981130768332314,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
        5⤵
        
        PID:3924
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\g04tctie.zal" --force-high-res-timeticks=disabled --metrics-shmem-handle=2016,i,10205175841124092688,5172652363959797268,524288 --field-trial-handle=1920,i,4539055049816913228,11203981130768332314,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2828
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\g04tctie.zal" --force-high-res-timeticks=disabled --metrics-shmem-handle=2160,i,9385491762549089628,8455849115644425421,524288 --field-trial-handle=1920,i,4539055049816913228,11203981130768332314,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:13
        5⤵
        
        PID:4160
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\g04tctie.zal" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2892,i,17853005161196808642,3509143549946562385,2097152 --field-trial-handle=1920,i,4539055049816913228,11203981130768332314,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:1
        5⤵
        
        PID:2912
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\g04tctie.zal" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2896,i,1649581724076929273,13770125095964695887,2097152 --field-trial-handle=1920,i,4539055049816913228,11203981130768332314,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:1
        5⤵
        
        PID:3016
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\g04tctie.zal" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3048,i,4920611041562405230,15132692538796240218,2097152 --field-trial-handle=1920,i,4539055049816913228,11203981130768332314,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
        5⤵
        
        PID:5416
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\g04tctie.zal" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3060,i,5918310394866427391,5787093831975188733,2097152 --field-trial-handle=1920,i,4539055049816913228,11203981130768332314,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:9
        5⤵
        
        PID:5304
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\g04tctie.zal" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4024,i,17761418504974042334,11296351509757656443,2097152 --field-trial-handle=1920,i,4539055049816913228,11203981130768332314,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:9
        5⤵
        
        PID:3792
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\g04tctie.zal" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4136,i,11276582916051612048,57839787493980632,2097152 --field-trial-handle=1920,i,4539055049816913228,11203981130768332314,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
        5⤵
        
        PID:3052
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\g04tctie.zal" --force-high-res-timeticks=disabled --metrics-shmem-handle=4472,i,8112805413592856587,509820509231551856,524288 --field-trial-handle=1920,i,4539055049816913228,11203981130768332314,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
        5⤵
        
        PID:724
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\g04tctie.zal" --force-high-res-timeticks=disabled --metrics-shmem-handle=5128,i,6129243938148083281,8245773016539800938,524288 --field-trial-handle=1920,i,4539055049816913228,11203981130768332314,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
        5⤵
        
        PID:356
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\g04tctie.zal" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5228,i,10341884491035824849,4529256145825133908,2097152 --field-trial-handle=1920,i,4539055049816913228,11203981130768332314,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
        5⤵
        
        PID:3728
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\g04tctie.zal" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5252,i,3608082851627258218,7578410992276447514,2097152 --field-trial-handle=1920,i,4539055049816913228,11203981130768332314,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:1
        5⤵
        
        PID:4732
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jt0z5tku.qtf"
      4⤵
      PID:5320
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\jt0z5tku.qtf
        5⤵
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:5420
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27097 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {a8af8fab-30ce-49e5-a583-6846842eb8b2} -parentPid 5420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5420" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        6⤵
        
        PID:2096
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2124 -prefsLen 27133 -prefMapHandle 2108 -prefMapSize 270279 -ipcHandle 2456 -initialChannelId {30199509-b8b3-4cbb-bc20-e23e9f85bb09} -parentPid 5420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        6⤵
        
        PID:3196
      - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ca5ebf35-41b4-4946-a6b6-047a662635cd.dmp"
        6⤵
        
        PID:4596
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2200 -prefsLen 27133 -prefMapHandle 2780 -prefMapSize 270279 -ipcHandle 2812 -initialChannelId {6512215d-bea5-4f1e-a4e1-fb35a75d69ff} -parentPid 5420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5420" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        6⤵
        
        PID:3588
      - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8365f3fa-ac40-48a5-a5be-3c617b0f815e.dmp"
        6⤵
        
        PID:1560
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2960 -prefsLen 27133 -prefMapHandle 2944 -prefMapSize 270279 -ipcHandle 2984 -initialChannelId {5e289d9d-21d4-4d9f-8caa-e82f0adebe82} -parentPid 5420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5420" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        6⤵
        
        PID:5644
      - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\26af201a-6b5a-4e3d-b3bc-ef959bcbfe4f.dmp"
        6⤵
        
        PID:4128
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2980 -prefsLen 27198 -prefMapHandle 2984 -prefMapSize 270279 -ipcHandle 3256 -initialChannelId {ccfab5db-fda3-4c52-b839-04b71d2e07c5} -parentPid 5420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5420" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        6⤵
        
        PID:1336
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3620 -prefsLen 27323 -prefMapHandle 3624 -prefMapSize 270279 -jsInitHandle 3628 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3832 -initialChannelId {e42822b7-d3ce-4d3d-b1a8-e4b6a1252fcc} -parentPid 5420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        6⤵
        Checks processor information in registry
        
        PID:5724
      - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\05676694-5f02-4a8e-adbb-4ce409168e9c.dmp"
        6⤵
        
        PID:5948
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3568 -prefsLen 27323 -prefMapHandle 3624 -prefMapSize 270279 -ipcHandle 3592 -initialChannelId {67932275-94a0-4778-99e6-254c894722cd} -parentPid 5420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5420" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        6⤵
        
        PID:3612
      - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bf0e0f4c-e5e8-4697-bee2-04f6dbc52f0d.dmp"
        6⤵
        
        PID:4912
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2888 -prefsLen 27323 -prefMapHandle 3212 -prefMapSize 270279 -ipcHandle 3616 -initialChannelId {8a9f43ba-1101-407f-8f3d-326c9dd545eb} -parentPid 5420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5420" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        6⤵
        
        PID:848
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3136 -prefsLen 34822 -prefMapHandle 1488 -prefMapSize 270279 -jsInitHandle 1928 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2656 -initialChannelId {2befdf14-7561-44f5-992a-8992854a1cab} -parentPid 5420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        6⤵
        Checks processor information in registry
        
        PID:3240
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5084 -prefsLen 34929 -prefMapHandle 5080 -prefMapSize 270279 -ipcHandle 5008 -initialChannelId {258f50c5-a964-433a-9273-27f7a966b8cc} -parentPid 5420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        6⤵
        Checks processor information in registry
        
        PID:5536
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4884 -prefsLen 32819 -prefMapHandle 4876 -prefMapSize 270279 -jsInitHandle 4868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4852 -initialChannelId {e2da3a38-dd77-40d0-b14c-cc1730ef623c} -parentPid 5420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        6⤵
        Checks processor information in registry
        
        PID:4276
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5280 -prefsLen 32900 -prefMapHandle 5064 -prefMapSize 270279 -jsInitHandle 4960 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5360 -initialChannelId {15b7795d-8ff5-4934-a345-2a0132e60656} -parentPid 5420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        6⤵
        Checks processor information in registry
        
        PID:5788
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5536 -prefsLen 32952 -prefMapHandle 5540 -prefMapSize 270279 -jsInitHandle 5544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2844 -initialChannelId {705a5c88-2dd3-4064-b56f-697866bfa574} -parentPid 5420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        6⤵
        Checks processor information in registry
        
        PID:5432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy"
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:3952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffb8ffec188,0x7ffb8ffec194,0x7ffb8ffec1a0
        5⤵
        
        PID:3024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1524,i,1200200020786447163,14326350126456254736,262144 --field-trial-handle=2148,i,847272686372480245,6578275818607670873,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:2
        5⤵
        
        PID:336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,2786870425505548911,3261988179153539852,524288 --field-trial-handle=2148,i,847272686372480245,6578275818607670873,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,16949071720280559205,15545106829328739250,524288 --field-trial-handle=2148,i,847272686372480245,6578275818607670873,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:13
        5⤵
        
        PID:796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,18377685685800391587,6263503734082382821,2097152 --field-trial-handle=2148,i,847272686372480245,6578275818607670873,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
        5⤵
        
        PID:724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,2778664271693453912,13671034208365082731,2097152 --field-trial-handle=2148,i,847272686372480245,6578275818607670873,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
        5⤵
        
        PID:2628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,11055397789965139327,4608112005904188329,524288 --field-trial-handle=2148,i,847272686372480245,6578275818607670873,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:14
        5⤵
        
        PID:5084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,8792055258181806062,1364890316919701903,524288 --field-trial-handle=2148,i,847272686372480245,6578275818607670873,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:14
        5⤵
        
        PID:1136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,10824376315912735217,8997373787154699676,524288 --field-trial-handle=2148,i,847272686372480245,6578275818607670873,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:14
        5⤵
        
        PID:5820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3832,i,16384210533519905184,4820987207128962756,2097152 --field-trial-handle=2148,i,847272686372480245,6578275818607670873,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:1
        5⤵
        
        PID:1492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3860,i,14280833084231782497,16231416126308168916,2097152 --field-trial-handle=2148,i,847272686372480245,6578275818607670873,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:9
        5⤵
        
        PID:5968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3892,i,6333423562926667167,16906165520736784470,2097152 --field-trial-handle=2148,i,847272686372480245,6578275818607670873,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
        5⤵
        
        PID:5008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3936,i,17642418007632341946,3173424641891098266,2097152 --field-trial-handle=2148,i,847272686372480245,6578275818607670873,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:9
        5⤵
        
        PID:2512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3944,i,1789102409660433758,12294284407592258815,2097152 --field-trial-handle=2148,i,847272686372480245,6578275818607670873,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
        5⤵
        
        PID:5436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3964,i,6802061615049165512,15966551727175345120,2097152 --field-trial-handle=2148,i,847272686372480245,6578275818607670873,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:9
        5⤵
        
        PID:788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3984,i,13210506740804866363,12685877942497174103,2097152 --field-trial-handle=2148,i,847272686372480245,6578275818607670873,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
        5⤵
        
        PID:2128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4004,i,12414901948042645266,11044237816675558444,2097152 --field-trial-handle=2148,i,847272686372480245,6578275818607670873,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:9
        5⤵
        
        PID:5540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4016,i,10710117136414826762,8164497509671850732,2097152 --field-trial-handle=2148,i,847272686372480245,6578275818607670873,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
        5⤵
        
        PID:5580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4028,i,10219238737084267282,5548986681525058090,2097152 --field-trial-handle=2148,i,847272686372480245,6578275818607670873,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:9
        5⤵
        
        PID:5628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,5752394708860190678,12349642606559570828,524288 --field-trial-handle=2148,i,847272686372480245,6578275818607670873,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
        5⤵
        
        PID:4436
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        6⤵
        
        PID:1036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,9158464481785793041,1196236397129669325,524288 --field-trial-handle=2148,i,847272686372480245,6578275818607670873,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
        5⤵
        
        PID:4764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,322097422048037620,9224118441526535385,524288 --field-trial-handle=2148,i,847272686372480245,6578275818607670873,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14
        5⤵
        
        PID:5268
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=596
        6⤵
        
        PID:2672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,3821097142723936232,9043562287726650334,524288 --field-trial-handle=2148,i,847272686372480245,6578275818607670873,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:14
        5⤵
        
        PID:756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,16974299841229433610,413619942934685039,524288 --field-trial-handle=2148,i,847272686372480245,6578275818607670873,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
        5⤵
        
        PID:4544
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,17615483798162939841,6564219965050600764,524288 --field-trial-handle=2148,i,847272686372480245,6578275818607670873,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
        5⤵
        
        PID:4528
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 2412
      4⤵
      Program crash
      PID:800

C:\Users\Admin\AppData\Roaming\MSBuild.exe
C:\Users\Admin\AppData\Roaming\MSBuild.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4244 -ip 4244
1⤵
PID:5060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6CEA2A7F.ps1

Path C:\Users\Admin\AppData\Local\Temp\6CEA2A7F.ps1
Size 1.2MB
SHA256 25a5a75b2df4fdacc078e80a120b03191fa009817690dd07327563d62ab68c31
MD5 47bb12b7ca2fab8b87eea52fe7a119f8
SHA1 f3da14b6cf33278db962968d9d2fcd6d60e3f1f5
SHA512 fb08b582284678e67ac7d7e7a45c53a8897a7a1c648620814ffae0b60032bb369d6dde6a2d116788055f5c156f2f5c2554579af2d7d3a5eaf5f0a96c4d8eedb6
SSDEEP 24576:YYH1NumlVZ3nlAfrOlQCzdzocA/LJWSNedl4qchAy4vZb7V:NVrAS5dKJW94/RGV
TLSH
T1094533128F88AC5D870831386A5707561B908BC6846D77D30FE195DB3ABDFA3B67703A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES2C4B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2C4B.tmp
Size 1KB
SHA256 76f010e390cca68ec71c8450fb5bc21dae7941f0cb752ea2b7e152ff0ea4164e
MD5 21b5f1e7277b5109312f85ed6d1b324e
SHA1 127e46fba4810cb2c6afde2e15ea4becbe4dc671
SHA512 2c384d6a7f8ada2ff7bd219ad7ba58fcd034b85f9a471da4944efef8183cd39acdf4b9af34d2ab09497f612b7b338feaba05a762c47060229f7fca0203e6fb83
TLSH
T152218C0583E8471FF4734B3179F6272B9234FE68EF61935B894042282C51504EEE0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_elup0utd.hzs.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_elup0utd.hzs.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

a22d13f7-e842-4b4a-b00c-208cdfcc25f1.tmp

Path C:\Users\Admin\AppData\Local\Temp\a22d13f7-e842-4b4a-b00c-208cdfcc25f1.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fylzmbqq.dll

Path C:\Users\Admin\AppData\Local\Temp\fylzmbqq\fylzmbqq.dll
Size 5KB
SHA256 c8a93804b80e25f344ec92aab1313dea4878c051aa2482d8ff18d7cf37ded5f6
MD5 f4dd158d96836c2de5c730ae7352c4aa
SHA1 1134209cf5c300ed6621ca9d74be30593b0b57a5
SHA512 978aa8d7a66b1fe52628ee0c6116482f339693c480966e08fcad9767d209f6922d4bbb516e83aee6d45162d51b865aacb6470ef0f3252ee723f937befe057686
SSDEEP 48:6KnjY3k8xLJpXsOVXWZY/Mc8FfxO3vhpzmmIfib1gbmgDngdJEpjBcVYoB1ulKB2:vYZx9pXsO8370pkr5mYXkK
TLSH
T1B1C17311D7DC1293F86B073CADE31B12DB70A8914B3B875B0DE5A21A7CABB741A31760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\g04tctie.zal\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\g04tctie.zal\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\g04tctie.zal\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\g04tctie.zal\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 ccefdc2d816137b5954b591e8954c392e0cf27388fef2e437991e3999d9ad3d8
MD5 efa437b6fe5031994d5917a91c19990f
SHA1 d46a1115227ead4e92346b600c28e9ac72cce96f
SHA512 ab52261f15a3f21728b41b4765da5ec6c9e71051b720204ee2decf6f09ac8a0c9a5c12313d921f232f1e698a7425d34415eca8db21a37f423535806bcdf238bb
TLSH
T1F3310AC7644047BA52EDDAF37F6B0C57DC12210107D4A440599F56E17FEEEC86015478
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\g04tctie.zal\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 bff87e21fa845d8ce3c266db6d904e9c7a3bf9fc2b95a1f1a5ca375f3fdb045a
MD5 097f67b0d583db3f8487ac27379c7eae
SHA1 18acf62fb9bc4e95899c4597cd72de66b6bef763
SHA512 0b6b323fa14e5b0dd6bb87fce791bbd0b7a867988d8332385ba76a35d93d4dd5b67f6be9be5a69fbdcd5da68c30bc840712daa83b9a0187b727d963dc9a9a045
TLSH
T15E514C54BEF34CB2EBC67C7254E65BF5A564C1E62D407A0C86B9CA1245BDD410CCD003
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\g04tctie.zal\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 3KB
SHA256 abe4eaa1a6fa423bcef61b423dc72386a9cf1968b1041de5270c56a7780254ad
MD5 8e589c60e0ba95ca1b178bad0a8298db
SHA1 d981cd3f9eb63636471e3bd4c0fd7585460ad6fd
SHA512 e8c7b5d340e698f3b1b42d6c3b7653b666e0add095611c00f502782928eb788070ca977b54b42f9515127861e55138a3cc0f02540f0bc2e44694fb0ea595ee34
TLSH
T196517D1B4B8AC56A0E53770E02E57ED454996C569EF383CC2106E7C0081A99F43EBBE7
MD5 SHA1 SHA512 TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\g04tctie.zal\Default\Web Applications\Temp\scoped_dir4564_408625654\Icons\128.png
Size 5KB
SHA256 63be4dfbc222f0c026579113af9aa7dea61e78a166ab9af053b46c1e172240ff
MD5 9cafc16ce8040254ec411cc5a8f954f2
SHA1 0d9841be48e134edf43c7ef970d24ddf852d155e
SHA512 aa1e0ac8d0647ee6c0b481e671b20fc68ff253dc72748b2aaf22f15bd8decd2b9723b16f8cd4c19d9a250abaa8d517101bad6ebfed7fd3a90ceefce02c1b3b75
SSDEEP 96:ALdfTPsPOWpgaNHQxO20qtLppvSFLtGaoFuPhQd1YDzpsE60tkuuAaw:m16NHQgoLjvSVtY2h6CDzpsErVu0
TLSH
T119C17E55555D711FD09D157110AF4A0F31A7E2AAC3785720C97E1BD0F88DE4603A3EB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\g04tctie.zal\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\g04tctie.zal\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\g04tctie.zal\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\g04tctie.zal\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy\Crashpad\settings.dat
Size 280B
SHA256 f299786f4d30f2d1821a64ecd037e031bd9d8a9fca8ece21dd6fbef250d14654
MD5 27a4704a013c757f74ea0edff5dbaa4c
SHA1 894124063aab3b1442c7b0d6453339b53fc162b3
SHA512 973501852fa1125dce75f902cc844dd087574646ecd601b10d6451a1794047584364728059a34566806d94558af36651e66bf9a0b23674a4b5d9a747b3b110a1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy\Crashpad\settings.dat
Size 280B
SHA256 4b76898e6c65756aad9aa91e222ad50d8096f6198eba4ee558e54e411daf63aa
MD5 62cf20c91ec7582087d1436e866c9da8
SHA1 25b307fcb0bfb4fa0a4596786c4dfa7bb602c8b1
SHA512 176e610afa997fc38b902b59e4cfadd15e065bf85494cba0be0c8c42c328c2e1f43578e6d512ac09133f00c1b64c3031ac4f02cabcb12829539c61379e635db0
TLSH
T17AD022B3BA200028E0E3303B00F0C30080ACC83002CCF2AC0C2000803AC0830C00B0FC
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 1cbc5df762408ee01ac7aefe3491d1ea8c7cd27d83ef793b64b92c6e21bf5fcd
MD5 70bedf2644df297b47a7b3b1f13e085b
SHA1 65e35a7cb99323fd2b903fd6733852502c5d42c3
SHA512 c5e1f503433a9ec3bd3ff5d9553aa912c951a5ba9c69d2c81d62a27c1c2990268427e29899882b090825cd7b8656080d74d0b9589f340ecc9aff61f76e8ee29e
TLSH
T157D02BA708E60870FDBFDBE31C76409505027CB4A948EC5F102D71C360712677916C74
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 373B
SHA256 68095e1f9eb13ee7ba41cfd858cd41b4c23507a6ef97cd38cdf3f6a8a84faa2e
MD5 c2502a9dafe197bcca4eec77c88e3c80
SHA1 7f43788f0f6ca86459dacd38f7214b087759f906
SHA512 83aa941f132f06e8ce0f9babb29aff58c6e926d76156929bd69204897e31140ab8d3521eb441d157d20689f86fd358645b2abc75af1afc99ad8e1e7bda286902
TLSH
T1BDE0C07319F70820FD5F9BE61D3100A605017CA4D504EC4F102A72C360B1255280FC32
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5871b0.TMP

Path C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe5871b0.TMP
Size 153B
SHA256 928d295f6dae138856d351dbf362d362614a39748ff8f7292f6aacb9a3b04fa1
MD5 719525d4bc90c5673cab2fb8ba521bda
SHA1 ea0abbd3bea3b5c98bc73e9a6ea8fd8bdac8aecd
SHA512 4170a0d72c2a7354165ccae5a4e5108460fafd10f2ff4afeb22d5b0a050f59e5caaa2b45601067742e450d136ec001c7deeb9f776854fedf1c8a69de46d9bfa7
TLSH
T117C08CB728AA0410EB5B8AE34432449842123CA45980AC59002EF1C37030132B122E20
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 4aaf004dd46124f6dd4e436496db239eb91bed1485bcc74f9a08592799b87159
MD5 6734e7523e8731d5bc27679aef6dd682
SHA1 1348622fe5ba0998d6266c6778ac6437751d083e
SHA512 88802b9149451ea1974445ab0739212abe1123efc032f94e73f1062ec65dcd3c3c7d37467716b369d2802ef14aa8686e3a32218554c52668bb4b65a391043194
TLSH
T15621CE227AB70641387F268882F695174B4130F530946C3BB76891F50F26E315EFE7C9
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy\Local State
Size 3KB
SHA256 8417dd082de53c25a60c38f2d15ce6f36b381d84ff9aba4d6197a4dcf51f1829
MD5 d922eb2de44352436228352fe5c60f9c
SHA1 a4a283c43b0e63ee276804386726f8a9cbfcd5fa
SHA512 1babae433a10076c10561405cdb2ae3651d1b555833550b9c2cd834e643f5c725b2bee83be06ee850523499014585a2ccb001463a048dcdea385701a9ff38383
TLSH
T1B381B9725828EC3346E56945B5893793AE7C34B3DD91EF94E6D4930C04DB34C3B0A827
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy\Local State
Size 4KB
SHA256 cf0afb73b8b3c46d2406e2a06946df302b2e0b9d380e0253bfc5f801b50dba4b
MD5 ed0d33da5805fa1677e110ea3e323c02
SHA1 c9f4743f940c07f423f1eb42f8a2ecc72e618fa7
SHA512 bc1b809b9491792ede223df24543c8d90081b6bbabb9c4dd918f7ec7447ac670b5ce0d39312dcbed9eed165716389b7b96c83c2afa2dad4c9833952039e71bb2
SSDEEP 96:KqGNkKQsFfDQTCRV58Frh/cInURoDotovxt/DMBFgvxH5r0eUniHq9q4a:BGNSZnooDUwj7Ag5rqi5
TLSH
T15DA1B6725838EC234AE6A945B5CA3743BFB83073E984BF98E6D8570C04DB3883706817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5864b0.TMP

Path C:\Users\Admin\AppData\Local\Temp\z2wher3f.5cy\Local State~RFe5864b0.TMP
Size 1KB
SHA256 62e7c12bee88c80ae5e7ec672762f757f5ed46dfe2493a23c08f10412eedda73
MD5 17cb9a72a6b9bd64164090c0986f60e2
SHA1 cbbc708b6edc9cd59a9961ae4693ad82be75c1e7
SHA512 65d8dc680e30625cf9df356f842e8bf3eae91c5f8886c92cafe83032559c57bdef719f9f277a7d6fc4c239699290e9b22da2c1b776e4e9fd8192ed5bab0add37
TLSH
T14F317372AC686CB3B8515A47F34A6B176E386575C2E0AA8851EC870E05D768C321AC3B
MD5 SHA1 SHA512 TLSH

Submit Download

MSBuild.exe

Path C:\Users\Admin\AppData\Roaming\MSBuild.exe
Size 256KB
SHA256 0da56bd07a486818b7735761001cc1d3ca5af645f369a3c206bcb6719fefff06
MD5 d10a3cfcc08aae3a7234498f213cf89e
SHA1 ccae4469a3a05fcb6e7af33019ca5357e5406dda
SHA512 90a4a68b45113360d732ccac7698c74aa550c05d9883d287b808982800fce1a24abf69cf06b0f017babd647cafd3ca10aa894c59e6dab8ba1ff34c639bdf6427
SSDEEP 3072:sa0t0yH5wCwie3NnQNLpj/Wnqvsw2XpFU4rwOeNubZSpf02RFirx2ux5a88:70ny3nnKpqnZRXf2p02bilrvU
TLSH
T1E4446A0163ED4615F6FF1AB0B8B056158B76F957E862D35E388CA1AC0F73780EA60763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05676694-5f02-4a8e-adbb-4ce409168e9c.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\05676694-5f02-4a8e-adbb-4ce409168e9c.dmp
Size 66KB
SHA256 b4862a81810cb74d74bfffab74bd0a99ee7caf905fdadcf2c310bc6b3da12484
MD5 be06e12b20f2d9e5974a15804445d7cf
SHA1 1152d1b117900b326ec4eb687d9a8726ef410ef9
SHA512 4a3d2adb7f2b98b76d1458f1d256243005297b6ec7bb06539a3c18ca71fbb9477691415ae5e94cb8af57dbd928d14e30af4526f6529251795326c324cf629e8c
SSDEEP 768:z4raX54/pu954/pui54/pu9IqyL/xI9kc8fi9:k454/pu954/pui54/pu9Ii9kc8K9
TLSH
T19E63B932D7D018F2D4A5CB7A58E7EB163BF2E6190B53431F161442AE9C673CA6C70E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05676694-5f02-4a8e-adbb-4ce409168e9c.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\05676694-5f02-4a8e-adbb-4ce409168e9c.extra
Size 10KB
SHA256 cf8aff00ab356743e0e1a13916c4378e0be3e4114888a0c51b42cc833d41ae5d
MD5 07b1ae44d85efd8281e8ab2074dc6652
SHA1 f5d0acc3e25880ce2633ce44e4e4afd0c986dc45
SHA512 cd7e34929ba2af71eb6e0af0e8b6d73f418705ec43a0dfaa3cac06e72f39f3a84969c829b663d10e72d7639f6a5fbb7f02497f8e1f00c797bfc3f88dd5b666af
SSDEEP 96:STWCyfToKtY6pw6lFFdtH0Rh7CsevBb1d0tjMLlIrLlhTLlaXv7ayutILfcBCqwl:S5yLzpFbG7uvZ8JLQxsP5wldafo3
TLSH
T149228353879724B79D5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05676694-5f02-4a8e-adbb-4ce409168e9c.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\05676694-5f02-4a8e-adbb-4ce409168e9c.extra
Size 10KB
SHA256 f52fa79730419c8ac4469f384dc67b0413936ff3c2671a4ffd97f752b7d14902
MD5 161ecfa2f17140e3f24a5fe91af11f2d
SHA1 c2e3b9ba02865deab3b0d42bfab2983100a87e35
SHA512 c86393acda76445acaac8f91283d656326f856f5b16bc14aacb480ba3b8d9d4a58d8c698ea505eb87156b99f009e1fd64138be7307ac0743e1ed2de2418b5e23
SSDEEP 192:S5y/PcFQiR4p4DnTYapdVxzPjWBHY4T/fKNtallafo7bL+Pl:iy/PcFQi5Dz1LWBHY4TmaqA74
TLSH
T15322E821491CD837E7D7AC8EEB3A3D3AD66E7A1A00E6786C40CCCB49C1A5478A779453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26af201a-6b5a-4e3d-b3bc-ef959bcbfe4f.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\26af201a-6b5a-4e3d-b3bc-ef959bcbfe4f.dmp
Size 60KB
SHA256 502fda24ca4ddb0357233d6cadd0a8f1a0f53463e615e6b5c92547cb5688b49e
MD5 c98fe6e9e02ed4bb0f7ea26331d4195e
SHA1 e23c57776e4d5cba9b531a967f59e7591f685e6c
SHA512 cfe72a76f4e23288953b2206d1f324d492d628f7b79abb1edaf95d90d8fa9320d9176f578b912356ef1ad59d96f233481fa9ff058af3c2480d8ff0199e7fd3d6
SSDEEP 384:Y3ASNDelNjE1M4MrMeMRAPbNXOBWNjEupWOkmmke6qQBQQsiQnOyYScV:Y3AflGM4MrM5yPbdOM98OYkzPsi9
TLSH
T1CB53BC0257D80432D13AEB719EE76B023BF6D4182B938B9F138551FA6C67BC0AD70E65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26af201a-6b5a-4e3d-b3bc-ef959bcbfe4f.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\26af201a-6b5a-4e3d-b3bc-ef959bcbfe4f.extra
Size 10KB
SHA256 1e102d51cba18f8ae8f2be38699f5b6bf9cf3e91577d3f740a502abec4d4b718
MD5 cf9a63b6801853045d0b52d290266b64
SHA1 74a0142f2c93fc5622478d22723daaea9678b00e
SHA512 e35d79d4227723e2195d8b965aae1761a7e267065a1cee99d60ac2f6fe6bc6b76a847ddd00a8496902a78caa0c46ec7f4f63823196cddba00243a864752af307
SSDEEP 96:STWCqToKtY6pw6lFFdtH0Rh7CsevBb1d0tjMLlIrLlhTLlaXv7avwutILfcBCqwe:S56zpFbG7uvZ8JL+xsP5wlpi8foeY
TLSH
T1BF227213879724B7AD5194C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26af201a-6b5a-4e3d-b3bc-ef959bcbfe4f.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\26af201a-6b5a-4e3d-b3bc-ef959bcbfe4f.extra
Size 10KB
SHA256 40586a2ab08b8ac04fe261d30998ba76495f8ec761653e449b3560fc023d9996
MD5 57d783e1704073de562aed842d120ac3
SHA1 f21c2e8615b05b41d66a6d4343d96c07eae32a33
SHA512 281e0245cc0ad89606f0c1c69be355e23776a2aec2f3095cca2a817e0af49031b55c46bd51943576e5aeedd8a11d96a8f8b5004ace21fdcdada98e5b1cdc70c5
SSDEEP 192:S5aPcFQiR4p4DnTYapdVxzPjWBH84T/fKNtalhi8foeobLnil:iaPcFQi5Dz1LWBH84Tma3Aeog
TLSH
T17322D721481CD837E7D6AC8EFA3A3D3AD66D7A1B00E6786C41CCCB49C1A9478A779453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8365f3fa-ac40-48a5-a5be-3c617b0f815e.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8365f3fa-ac40-48a5-a5be-3c617b0f815e.dmp
Size 62KB
SHA256 c753d38ab95b245fdce28e0e508625e6c83b56123bdef9fb0eb65b44a481120c
MD5 546bf819bacd4fdc7f49eb2a33c64c8d
SHA1 a7e6ec57ae8990b7550d0eee1db0e98d510891f1
SHA512 15b0d81c108e5521a79fd6fd7a1674fa9419c7d9ea9d516bcbecf075a98488778610a8612b1212747c840ce377b72bf9f633f47f9c7275e7199bf5b1989fd242
SSDEEP 384:sOS8Dc2ElpzJB++zYW1lAJJlMhEZpmOEBF774HiQnOyYScV:sOXE/rL11cJuEUYHi9
TLSH
T1D553761253EC0CB9D6298B3458EBEB1A3BFAF41007A3935F1714A6BA5D633C46C70E65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8365f3fa-ac40-48a5-a5be-3c617b0f815e.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8365f3fa-ac40-48a5-a5be-3c617b0f815e.extra
Size 10KB
SHA256 45d37f9b7b0967c38bf3a0fbe5805826cf49ffd97837819a8f5191bd2a15f66a
MD5 9eebcfb3ef98ceada624dd44784ebd05
SHA1 765f2517e7761eeb867932bfd8f9d0ff69b64a43
SHA512 cd88ed91976da27ad33a10243ee97a7dca285f8209dcc0e20edf55956bbcfcb0334b7f618997dacd930f00e40bf7874dd0e266e6f9d607319ca04c20316a8024
SSDEEP 96:STWCbToKtY6pw6lFFdtH0Rh7CTvBb1d0tjMLlIrLlhTLlaXv7aEutILfcBCqwvE/:S5PzpFbG7WvZ8JLixsP5wlPxfob
TLSH
T119227213875724B7AD5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA4A8F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8365f3fa-ac40-48a5-a5be-3c617b0f815e.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8365f3fa-ac40-48a5-a5be-3c617b0f815e.extra
Size 10KB
SHA256 5ed719c54e7ab54d62a7f163994045ebca3104508bd01543c2ba19951abc0d5a
MD5 51b5cb387831712cb87f234aca53257a
SHA1 19192f56c3e47822d72f5154cc2349617b36c33c
SHA512 a8ffb995018d197a9b21b3cbd0fef5d5297a893f13f8e413051c910bb098f75b261aff4008c079766da0a1b73150f12653ca6db23816b0814fa4bdf84c21b3db
SSDEEP 192:S5TPcFQiR4p4DnTYaVdVxzPjWBHA4T/fKNtal3xfoXbLDEQl:iTPcFQi5D/1LWBHA4TmaLAXQ2
TLSH
T17822D821481CD837E7D7AC8EFA3A3D3AD66D7A1E10E6789C40CCCB49C1A9474A779453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf0e0f4c-e5e8-4697-bee2-04f6dbc52f0d.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bf0e0f4c-e5e8-4697-bee2-04f6dbc52f0d.dmp
Size 66KB
SHA256 1c8ac758afacd11e7e74feacb3d3ce9c3ae13d8c2c66610a9f9da24c9f8a7500
MD5 3dd287087fa8fd0785d99cc1de501e72
SHA1 5f65ab8b830aad8ef77833498815be8d057ef28c
SHA512 a91307adc41bcd7a9e0d33f05e0233f35598d5f70d8f06a20a0dd6e3d057f15149f3f611d706a0f4af52f1daa2cad911fd598b8fa6b2858a84f3ebf5128d4cf7
SSDEEP 384:/bP/d2RPGVtnVj65xGRD1R8BmfAWFn//Wo8AShqDmrZ8q1iQnOyYScV:/bd2tGvf6BbZPi9
TLSH
T189638717A7E00876D52B8B3418E7BB5337F6E9140BB7876F360452BA5C633D06CB0AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf0e0f4c-e5e8-4697-bee2-04f6dbc52f0d.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bf0e0f4c-e5e8-4697-bee2-04f6dbc52f0d.extra
Size 10KB
SHA256 cc706e50e1663b9c2ad46d07b6ead5e8a2a51ff1fc7ffe8c94d55b74f6f352a7
MD5 2d1205e9c633d9a6e104fc5105131c77
SHA1 37d34c27fe02adbeaf514c014a14b7703aa7c1e4
SHA512 ee54c108aebeb4e17779fbcc49ea395ac6aa8ba308d67690435666744d3df2504277cc1076f1da9da35bacca9e4607851c7df7b50c177211a2ff9a88b09f2367
SSDEEP 96:STWCXlUToKtY6pw6lFFdtH0Rh7CsevBb1d0tjMLlIrLlhTLlaXv7aKutILfcBCqj:S5XlIzpFbG7uvZ8JLYxsP5wl5Bfo/
TLSH
T199228213875724B7AD5194C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf0e0f4c-e5e8-4697-bee2-04f6dbc52f0d.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bf0e0f4c-e5e8-4697-bee2-04f6dbc52f0d.extra
Size 10KB
SHA256 c00be3279de2d8e96fe26f59d22fbf6cabb39f75b395e8afdbedd7a8ca0ebfd9
MD5 0f3bf4688f80441c395eb5521e2474c0
SHA1 c647463748f041dd84a0b93621bc0666fb45419e
SHA512 7eafaadcf5f28c21bce390a423bbec2c7849c389b906e0b1872511ec3bab1625cf2c8728a0162ffe439ade1065de443d37427b3031ac42eea7e2f9f663ec41a5
SSDEEP 192:S5XlEPcFQiR4p4DnTYapdVxzPjWBHs4T/fKNtalhBfozbLcZl:iXOPcFQi5Dz1LWBHs4Tma5Azg
TLSH
T18632E721481CD837F7D7AC8EEA3A3D3AD66D7B1A10E6789C40CCCB49C1A9478A779453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca5ebf35-41b4-4946-a6b6-047a662635cd.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ca5ebf35-41b4-4946-a6b6-047a662635cd.dmp
Size 66KB
SHA256 cd50d602e7ea4d6dc1b0ba8d40775ea732a7655c194ad206722dc9a99a3a53e4
MD5 6f4980f076c0d8ba51587fee65916da4
SHA1 217aac3c2a9322956b169efdfcdc9a30de6c9c93
SHA512 3333531d6ee49bfceca386353c4e683d3f80fb6425191620edfe19be4d7c0299b7f2d19ec039255f470d4a6b4698a428793ef8ce365a17d08d3d934c77607365
SSDEEP 384:APA/sWqeHSbOmpxIaW9rvJqb7qC1Z33VmEq4GiQnOyYScV:APZWsEaWPU75q4Gi9
TLSH
T1ED63A812A7D08835D529973978D7ABC27BF6F4110B53931F02485AFE1CA33D8AC71AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca5ebf35-41b4-4946-a6b6-047a662635cd.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ca5ebf35-41b4-4946-a6b6-047a662635cd.extra
Size 1KB
SHA256 5fce32abf381d1a286d40668b863d1014d9a77c6b8bee834009f027b9273ebc1
MD5 5152659f46bb323fdf73e8678f9d54d5
SHA1 adf9b879aa5cc92480cad9632a3b66c8822659d0
SHA512 5dff7747d84a8626c03c3ab849d68c56c6a1e917a228d16b86705c1ca30c987030d05ac382dde683b672a67d952c7863156cd35c3ee6e6652c56112142854847
TLSH
T13E31A2B381AC2D2299578989763B1702CA9EBB2344D25C4C38CC0B0C818E4ECD3A69C3
MD5 SHA1 SHA512 TLSH

Submit Download

ca5ebf35-41b4-4946-a6b6-047a662635cd.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ca5ebf35-41b4-4946-a6b6-047a662635cd.extra
Size 3KB
SHA256 1f6b1e1b0af96e337d662a69e7a13f124aa1c4787aed305b742a1ebe804a08ab
MD5 affd6aaefbed3c3a63a05bc01b7c45e2
SHA1 7f43053ef9d2012d740c49b2d0a561103ce4470f
SHA512 1a987f80f6a44b6e2477445f79a6f69790f3ccbc2ed92074deb6b6929bcb68cfd5bfb0de9ec04c0f1996113ed2f766d173c06f74666e99deeac2acfd6bcb3da3
TLSH
T115810331415CD9776AAE5DCAB337BD1DDD9FB31998A1398880CAC71C41A8CB0A786183
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

store.json.mozlz4.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\crashes\store.json.mozlz4.tmp
Size 6KB
SHA256 d189ad2a7f4094292f1e5354605fc2df629ff8842a3e6e58644e76e9d98f52f3
MD5 361156575c0bd1e2b8642c7635ccb7bd
SHA1 f0c34df57ac42ea68f764a590aedae2d9e7cf2af
SHA512 263841a77210f0f82172d23bb35f6deec079273dcf907ec224ffc1ad0d28f8e35cf8216113a985dfb36173a9b742a094ee86460a9d45304857efb6baa1cda26f
SSDEEP 192:YKsZMu6UjKX0vX8rSjWA3WhHSeWzYmStTW+hISHfOmc:Y9uHrlAGhou7c
TLSH
T1D5D19F63DADCDBA39A704A1570219F4423224E2760E8C957FC5EB7C58AF1CA01F9C789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 dedd10ddc1fa190a2d9461a9da76efa7b26c1c6c9b1651f11778dd75e341e1e6
MD5 21a8679bd04d22eeca55a14c5a8d52b4
SHA1 46da90dd7793ec34127050736e43b203d097bd4c
SHA512 1bf9494543606ee59d16adbbf8d542bf5816a8ab78b523f2fd91306d9f64a1592d1c0c2bc18dbddd39a6141492e23dbbec4259ebb351870f03564db0c9ce022f
SSDEEP 192:P1d66Joz0dzgCl6mc0dtOv5zboZZHVyjvMN:dd66JozQzgC1jUboZZHVyje
TLSH
T13AE120A8E729863FC448027BCDA21F410F39399A984E3F19319D64082D572EE368E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 0b828278b3e0d941c2eb7ae429247c6554e1e05d4745f331f6475dfc22b6fa44
MD5 0caa815c1fbaf61f4e25bc2cc26125e0
SHA1 9a50a6cfca1c6a93dc6e685a33ab1fb022c938ce
SHA512 24c256d9e369eb0da674fe20ed6731fc5a3e7b3d02274ac32041e5b089d4e7f47140a62377c387e00ab69b512215ca19f5ed654a59ee446b532cd0159ce716cb
SSDEEP 192:tOv5zboHEZHVyjvMTI1d66Joz0dzgCl6mc0dz:CbokZHVyjkid66JozQzgC1jd
TLSH
T1D6E11FA8E629863FC408027BCCA21F414F35389B984E3F19359D640C2D572EE76CE27D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\events\events
Size 1KB
SHA256 7aa7a06802517fef61b62cb03165bac3f63587aa2840f4265ff071d4f13e38a6
MD5 07caa227e1947e24ea31a43740d1e8f4
SHA1 ed6f0751f33c5707f7030aae7447309537e7f679
SHA512 1b0b36d3adb88d45d6daa1a82832616b20517eaa5412220279b1df1d7de8a457a14e6f1e3a535b9de3abfc2c4de34db09bd64cbcc69322a6527fed3bf57b9ef2
TLSH
T11C21A95C7DB84DABAAD7E29C7441068E53518E07158B1C930D12DE8DCEC4AD9326E4BD
MD5 SHA1 SHA512 TLSH

Submit Download

5de7242f-6358-4d07-a324-96e31918da55

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\pending_pings\5de7242f-6358-4d07-a324-96e31918da55
Size 3KB
SHA256 0933459ad109db5be22b3e596a51658d41801bbb945e2f44ff617db2e1cac74c
MD5 22aae72611f38c8d4cead50afe02c403
SHA1 7eb5b09f0c48062cfbf656d8880d2d39b388b825
SHA512 0c32cbc63396a30dc2c51875fd50c94f2718b1fea9b158656622efdde306961dce31f80a87bd19c1d077c3ad8f4f3b10d26f9d0513aae8b7d7bae48c0aae90dd
TLSH
T1D26145219558B9738FECA145E337BA44CFEF33CB58830F8A55598E2442E846897CF25B
MD5 SHA1 SHA512 TLSH

Submit Download

86169350-7235-4174-8f70-234afab0e8a4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\pending_pings\86169350-7235-4174-8f70-234afab0e8a4
Size 3KB
SHA256 c573caad8551bc5ff103f83eff639f61b3acc449a5ed0491c9ea7075664def98
MD5 62e1b14ddde0a098c8023e9338f97c55
SHA1 afddea3d6f0e1df4ec7fe9affaff84f6834464da
SHA512 db3273ad9e0b53b0c8cedd96b2fa382b1451717f8a67bf4b4ee7fdabd59d37aa86dd6d9539a8e4160836eb916b7a3e5d371829f0cec97e8d08a4b4514407d91d
TLSH
T1126163219654B9739FECA441F337BE84CFEE33DB58D20A8A11598E2442E847857CB25B
MD5 SHA1 SHA512 TLSH

Submit Download

8fa1ec67-4893-43c4-8bb1-f195d5dde2a7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\pending_pings\8fa1ec67-4893-43c4-8bb1-f195d5dde2a7
Size 2KB
SHA256 a5bad0ef39dd371c1daaf2f29cba707daa0098689e368354906ce4ec0f24e0be
MD5 0fa7f48d68fd2495a6ace882eb80bc56
SHA1 588ff489c32b08d5b9bedec14ddefe370c7d8c06
SHA512 edfa30db6776f75e215656125a354f90a1e52c27eaa9bc0463c082f63304e54a6a665ef6806cbc2b60c1e4488212e2c9210eec5f0bf8a003f5346f3add9537b7
TLSH
T1F841635C75798CB74FDAE18DD482238E4B608A1340C71C831E61EE4CCD9669E73AE16B
MD5 SHA1 SHA512 TLSH

Submit Download

9418d6f4-0256-4a28-8878-17f01f7e75e1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\pending_pings\9418d6f4-0256-4a28-8878-17f01f7e75e1
Size 235B
SHA256 d70152d9182b3fea70e52034b3820f6d8ab709772a52c33c327df290d84c785a
MD5 1c7e666cba1595beaadd5d40d615eb89
SHA1 a546aff1683d658d078a9525a9ecdba64674f9cf
SHA512 79ce682fbe1bd87d98323c56337614a0a1c6845d0ef8dbbd737780020e0f33c231b1fb5cba9e4081d21682c9a52a28479ed452b62ff4f67db5a4874487ca395c
TLSH
T12AD0979068A8675C08140F07B0A438DE304ACC3354719824C99012788EFCEC9826295F
MD5 SHA1 SHA512 TLSH

Submit Download

95dd775c-24f6-4c8f-b9aa-998c451b908a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\pending_pings\95dd775c-24f6-4c8f-b9aa-998c451b908a
Size 16KB
SHA256 bf82cd24564d73b7a9cb882ca9b2a28877bec51e8d008e2c8312bd8263352671
MD5 1c99138a4bc8e35e895e11bab88ab04f
SHA1 6700e929f66d22d433e220e4905ceaf1a242fb30
SHA512 e317b3d441bdb83fe447cf7948dd6d5867bbcee659edb80d7a3923b786ce9981c5da3eb2955c8018525a2cc43a3d4a094284cffd173ba3fbe280bbfce69e9b2a
SSDEEP 192:Q/7VRw7c71urdyf1Dju4dbymr3vN074CfyjpSS/RKw/z2vIKCNH4MdtY19BMP:ihu7cZus9G4uyVSS/RKw/kIKk4niP
TLSH
T1C072DA56242045BA8251E36895FCBFC3E6F528CF4C419FCE9BE4BE0869DE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c67a0206-b086-44ba-bfd6-3ab3d48df4d7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\pending_pings\c67a0206-b086-44ba-bfd6-3ab3d48df4d7
Size 883B
SHA256 0e42befc8a836a04fc87526fe9c9ee57ad8b8131c53f1ab325460225a28f0770
MD5 84fd24c128d931e412989ef5a45b1612
SHA1 f064522d6c4b98064ac354b3d10646d66a18ea2e
SHA512 d47e3f45e9cc0a14d1d5d63ff7e7d26cb4cef33ffcdef44dc1bb19290f3f2a53f2109785417b4d50cf0b3b134101baebd9c945c2e8e7dd88343b1b0afc0e4ea7
TLSH
T1961104C2E635F5B3CD7CC14B89917B124FE4712380CD55182DA05D144DBE92E736A30B
MD5 SHA1 SHA512 TLSH

Submit Download

ce96561e-87aa-4354-986f-629019ef48ed

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\pending_pings\ce96561e-87aa-4354-986f-629019ef48ed
Size 3KB
SHA256 363a299a6c4f9957a3fa13ce12a909cf0b1f039b5e92edeb8a410ef11e73f653
MD5 94a25e71a0b24c0728b4376010077529
SHA1 74d1495dd05fe28598a1a2e8321b7552949bfb89
SHA512 952879caa22e9067aaa79711da6cd2923c48b6cb9e675e7e8a687ada047f3b519c249d572eed8c33926e90b63f763cc434db5e7dabc5b07e6d92c88967dda770
TLSH
T1E3613321955869738BFCA041E337BE45CEEE33DF58830BCA55698E2442E8478578F25B
MD5 SHA1 SHA512 TLSH

Submit Download

dab9a3c2-e7d1-4849-a35c-6ce788acb11a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\pending_pings\dab9a3c2-e7d1-4849-a35c-6ce788acb11a
Size 235B
SHA256 476e4dffd06e057ba3426fbaac8e6082c8ba8443158755f80797dd3e1c2c43e3
MD5 7aaab964e784bd0f6963f14cb40e8f19
SHA1 08dc98ac14e09396798d7a369ad26385bbcf3a45
SHA512 6bacd7efbc4cb83bbc46062e568f031030f4623ffb21ead4956918a2db03a768e6540517a68e8c327e9892503e4622dc1fa63deebca45b1000e29491f4a65d63
TLSH
T195D0238454CC336E08140F03F0E068C730898C3318B4A820DAE24E349EFFDD80311837
MD5 SHA1 SHA512 TLSH

Submit Download

dc3a9a44-961e-498c-843f-1b08633e65ac

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\pending_pings\dc3a9a44-961e-498c-843f-1b08633e65ac
Size 886B
SHA256 2456b617323c38bfa4642b567aa245c09e3088a6422ee60259c7a874d892e17a
MD5 672a58c1c57f53b316d1bea719eb2476
SHA1 b3b25e07b95223ba3ae8b2f05d348af668df4f5b
SHA512 c3e267397a81f8f9814f060a7a1763e42fdfc1bf64b2962971946f85ad71159025a5897cf0b0564d281ab3c21a8762578d2f87bd300fa7b7a1d1d3832484611b
TLSH
T11E110095D631B5B28DB8D28BC6F17B428FE4716380CA4D182EA05A084DEB56E63A6707
MD5 SHA1 SHA512 TLSH

Submit Download

e5d7f0f7-dbfa-4a0c-88cb-d9325575edff

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\pending_pings\e5d7f0f7-dbfa-4a0c-88cb-d9325575edff
Size 3KB
SHA256 eeea739946df3db24b8b0f030b32204a3db94ea2abb290bc38873682b25e35a1
MD5 6c35bb5fd195b36e3e0fa70f384b252b
SHA1 00da6f1fb7926e95cc90692f984bb498404508cd
SHA512 cf0d76e51985d60c397cea68dca391c995cb5acc9a397991ed98ee7c6113bf4cca9f8ab5fda631fd3de34ad255d65883bb72df9649ca94624a1f79fbc1d1dbe8
TLSH
T1B06162214558A9739FECB081A337BE51CEEE33CF18C20ACA11599E2443E84745B8B25B
MD5 SHA1 SHA512 TLSH

Submit Download

e6e207db-e94c-4581-a238-7cd59233b882

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\pending_pings\e6e207db-e94c-4581-a238-7cd59233b882
Size 3KB
SHA256 1779d231dc7e0b074237c0d858ca72af3de055f3ba27e7797fbb03af832e88a7
MD5 e3cac0e452600297fce758eec4589cb3
SHA1 30acab40f3f3ae3118ad7a01bf5e9b49bd479659
SHA512 5edaf847a9893f4dab45d8fdc34e14fe4f4b23fb3391cac7896c7f786830fc10a637e7cf9d7504d00f982d47ae3619c2ecadfb72f31d43695e7f9d5283eda6dd
TLSH
T1C9617521856879738FECB041E377BA44CEEE33CF58821BCA5569CA2442E8474678F35B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\prefs.js
Size 6KB
SHA256 c19eaa95d688ad8dd03be1175093a673ddfc08f63858713afe25668a01c95ce2
MD5 30162e2c80f3f52b46696a736d3beb67
SHA1 995789dd0a8b8da1cc5947f3939969b1352346be
SHA512 93d776b301b7e5dfbe1bc41d26c37c15ac2242bfc9b9e700c28646912e1d1cd010efb3824e3d3ffcdfe9fdd28dbb3d051b658e516d286ed77d5e8e0b46bde219
SSDEEP 96:xHcHUTUJqGqzfBt08S1zS0t3SSlqdv9j+nrH1WknMBw88H8L4cnzu1:eHERzfB6Vnt3SSVNMBw88p
TLSH
T175E11F7891088B7F64B677BCAC688C315AB2013BBBBF68D750B55484054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC1F6A006283AB4B27934A93CA945BDFBB.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\fylzmbqq\CSC1F6A006283AB4B27934A93CA945BDFBB.TMP
Size 652B
SHA256 795bf2892af794f61e5623ebec3d742616f24e907874cc3060d6dd0b1e321aab
MD5 7cb0113ab7f2f82cd33b425b345ded3f
SHA1 6bfc283e67ef253f0a8ce3f383ec53b0247abe4e
SHA512 bc9b6009c16641b0d0dfb5e302e68945d8090efdfd501cfcd86dc9fb623edb9303f8e5fd4703c9c9bb1e2cb36a817acbf67816bf37f380e212b29a2d35703655
TLSH
T1D3F05E0963F8421EF0F34F30BDF653A395A8BD65DE3293ED1880031928A49108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

fylzmbqq.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\fylzmbqq\fylzmbqq.0.cs
Size 3KB
SHA256 9578f1935441fa1f73ff75db335d4a8693ca649925853908d83e6e4b8a3838d7
MD5 e77027a3d1f4e8d99e8aaac444f615a1
SHA1 12d313fa966c5e0c37c30fa4d056f220d3062349
SHA512 44038a7674713e57557a33d9c1da9a3986eb5e720fe4fe7a3a1a11c3fad781fd60f7fda25ca1dfb3ca1831ef9040adb0a99da0ac3180fc605ec059a2d64b0727
TLSH
T1EE71DF3C5346976258761119FA81A1CEE70310732AFF5A2039FD83626F7B109E176B2E
MD5 SHA1 SHA512 TLSH

Submit Download

fylzmbqq.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\fylzmbqq\fylzmbqq.cmdline
Size 369B
SHA256 e2cb0c53f56dcbbb25542f7e40d36a3b5ed823474498a6c4039448d139f6462e
MD5 b75e74bb165c49483052b8f5f64855f4
SHA1 df42d4f3fc5ef2944943a511c77bc32d85ec2183
SHA512 2774e2ed3c9b5bf28c26e3f10d54b9fef5db7ecbe2cc727d7f154b3d5ababed7686af9c3052da815f3854e61353998412c3609c6a96bbc81d7c4c8f1ba5580cf
TLSH
T152E0C06B4396C2FD8DDE1817216AC7BCC27217436B403F84D480484ED11700077D1B45
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1640-52-0x0000000005240000-0x000000000539A000-memory.dmp

Download

memory/1640-50-0x0000000000740000-0x0000000000780000-memory.dmp

Download

memory/1640-51-0x0000000001170000-0x000000000118A000-memory.dmp

Download

memory/3924-79-0x0000028397800000-0x0000028397840000-memory.dmp

Download

memory/4244-36-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/4244-56-0x00000000067D0000-0x0000000006820000-memory.dmp

Download

memory/4244-1631-0x00000000074D0000-0x0000000007827000-memory.dmp

Download

memory/4244-42-0x0000000006620000-0x00000000066D2000-memory.dmp

Download

memory/4244-37-0x0000000005E00000-0x00000000063A6000-memory.dmp

Download

memory/4244-58-0x0000000006B00000-0x0000000006B1E000-memory.dmp

Download

memory/4244-57-0x0000000006FA0000-0x00000000074CC000-memory.dmp

Download

memory/4244-54-0x00000000068A0000-0x0000000006A62000-memory.dmp

Download

memory/4244-55-0x0000000006750000-0x00000000067C6000-memory.dmp

Download

memory/4580-34-0x0000000006250000-0x0000000006258000-memory.dmp

Download

memory/4580-14-0x0000000005730000-0x0000000005A87000-memory.dmp

Download

memory/4580-44-0x0000000006EE0000-0x0000000006F02000-memory.dmp

Download

memory/4580-19-0x00000000061C0000-0x00000000061DA000-memory.dmp

Download

memory/4580-18-0x00000000074B0000-0x0000000007B2A000-memory.dmp

Download

memory/4580-16-0x0000000005C70000-0x0000000005CBC000-memory.dmp

Download

memory/4580-15-0x0000000005C30000-0x0000000005C4E000-memory.dmp

Download

memory/4580-43-0x0000000006F50000-0x0000000006FE6000-memory.dmp

Download

memory/4580-7-0x0000000004FB0000-0x0000000005016000-memory.dmp

Download

memory/4580-6-0x0000000004F40000-0x0000000004FA6000-memory.dmp

Download

memory/4580-5-0x0000000004EA0000-0x0000000004EC2000-memory.dmp

Download

memory/4580-4-0x0000000005020000-0x000000000564A000-memory.dmp

Download

memory/4580-3-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/4580-2-0x0000000002780000-0x00000000027B6000-memory.dmp

Download

memory/4580-1-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download