phantom_stealer | a1a64e53591cc747ca8a9b906bc83ea3d6394aba5fa6a0d7a4a4acc725407a5e

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/06/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
Size 1.4MB
Sample260618-pc8m7ahv91
SHA256 a1a64e53591cc747ca8a9b906bc83ea3d6394aba5fa6a0d7a4a4acc725407a5e
MD5 1348b61498226312efc6de0c4b30bee6
SHA1 c7a3c9f19bee1dcb92f7db25dda92a00ba73e226
SHA512 d4776d05b96073cbea3b2bbcda19f21fe00b887827587747f0daa9e70474e2f44d520e0e3fcb723ed13efff51914dfa7489b086896e427476619701c73cab206
SSDEEP 24576:JIFzrn0Az7LHPmMWsj8HmfDtO8pDhArGorxZnOkcPZaIF6lP5CZMX+vTKnCPTsBo:JIFzrn0SPmMxBOIdArRZOkUa9152TNbv
TLSH
T16765231D6348C167D0572F391E32F9B407768CDD4912D24A9FF9ADB73836BA22E007A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution phantom_stealer persistence spyware stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
bostonwindows.com
Port
587
Username
[email protected]
Password
n0b0dy_smtp_pass

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
bostonwindows.com
Port
587
Username
[email protected]
Password
n0b0dy_smtp_pass
Email to
[email protected]

Mutex

K5Y9KF1Z65G6782PSTBA

Attributes

anti_analysis
0
cb_enables_ssl
1
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 1 IoCs

resource	yara_rule
behavioral2/memory/1924-16-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4452	powershell.exe
1964	powershell.exe
2708	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
3232	ZKyNmFX.exe
3752	ZKyNmFX.exe
4908	ZKyNmFX.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
Key opened	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
Key opened	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ZKyNmFX = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\poiulrozalk.ps1\""	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	icanhazip.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1308 set thread context of 1924	1308	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	85
PID 3232 set thread context of 4908	3232	ZKyNmFX.exe	145

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\2ed65f6b-e1e9-4bb2-91ae-32d16f106654.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3756_13426258390262812_3756.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\2147cdb7-650c-4ea4-8d2e-28809916401a.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\948_13426258390391135_948.pma	setup.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZKyNmFX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZKyNmFX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
540	chrome.exe
5564	msedge.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134262583899620184"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{83CE7473-82A4-423D-B8FD-92CB534BB412}	msedge.exe

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
1308	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
1308	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
1308	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
1308	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
1308	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
1308	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
4452	powershell.exe
2708	powershell.exe
4452	powershell.exe
2708	powershell.exe
1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
488	chrome.exe
488	chrome.exe
1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
1848	firefox.exe
1848	firefox.exe
1848	firefox.exe
1848	firefox.exe
1848	firefox.exe
1848	firefox.exe
1848	firefox.exe
1848	firefox.exe
1848	firefox.exe
1848	firefox.exe
1848	firefox.exe
1848	firefox.exe
1848	firefox.exe
1848	firefox.exe
1848	firefox.exe
1848	firefox.exe
1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
3232	ZKyNmFX.exe
3232	ZKyNmFX.exe
3232	ZKyNmFX.exe
3232	ZKyNmFX.exe
3232	ZKyNmFX.exe
1964	powershell.exe
1964	powershell.exe
1964	powershell.exe
1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	1308	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
Token: SeDebugPrivilege	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
Token: SeDebugPrivilege	4452	powershell.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeDebugPrivilege	3232	ZKyNmFX.exe
Token: SeDebugPrivilege	4908	ZKyNmFX.exe
Token: SeDebugPrivilege	1964	powershell.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
488	chrome.exe
488	chrome.exe
1848	firefox.exe
1848	firefox.exe
1848	firefox.exe
1848	firefox.exe
1848	firefox.exe
1848	firefox.exe
1848	firefox.exe
1848	firefox.exe
5284	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1848	firefox.exe
1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 4452	1308	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	81
PID 1308 wrote to memory of 3608	1308	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	83
PID 1308 wrote to memory of 3356	1308	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	84
PID 1308 wrote to memory of 1924	1308	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	85
PID 1308 wrote to memory of 1924	1308	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	85
PID 1308 wrote to memory of 1924	1308	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	85
PID 1308 wrote to memory of 1924	1308	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	85
PID 1308 wrote to memory of 1924	1308	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	85
PID 2708 wrote to memory of 3232	2708	powershell.exe	89
PID 1924 wrote to memory of 488	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	90
PID 488 wrote to memory of 1128	488	chrome.exe	91
PID 1924 wrote to memory of 1128	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	91
PID 1924 wrote to memory of 1128	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	91
PID 488 wrote to memory of 2960	488	chrome.exe	92
PID 488 wrote to memory of 540	488	chrome.exe	93
PID 488 wrote to memory of 4516	488	chrome.exe	94
PID 1924 wrote to memory of 488	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	90
PID 1924 wrote to memory of 488	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	90
PID 488 wrote to memory of 2272	488	chrome.exe	95
PID 488 wrote to memory of 5020	488	chrome.exe	96
PID 488 wrote to memory of 1364	488	chrome.exe	97
PID 488 wrote to memory of 4416	488	chrome.exe	98
PID 488 wrote to memory of 4768	488	chrome.exe	99
PID 488 wrote to memory of 648	488	chrome.exe	100
PID 1924 wrote to memory of 4516	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	94
PID 1924 wrote to memory of 4516	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	94
PID 1924 wrote to memory of 540	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	93
PID 1924 wrote to memory of 540	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	93
PID 488 wrote to memory of 1476	488	chrome.exe	101
PID 1924 wrote to memory of 1128	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	91
PID 1924 wrote to memory of 1128	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	91
PID 1924 wrote to memory of 1364	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	97
PID 1924 wrote to memory of 1364	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	97
PID 1924 wrote to memory of 488	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	90
PID 1924 wrote to memory of 488	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	90
PID 488 wrote to memory of 5008	488	chrome.exe	102
PID 1924 wrote to memory of 5020	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	96
PID 1924 wrote to memory of 5020	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	96
PID 488 wrote to memory of 2156	488	chrome.exe	103
PID 1924 wrote to memory of 4416	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	98
PID 1924 wrote to memory of 4416	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	98
PID 1924 wrote to memory of 2960	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	92
PID 1924 wrote to memory of 2960	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	92
PID 1924 wrote to memory of 2156	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	103
PID 1924 wrote to memory of 2156	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	103
PID 1924 wrote to memory of 4516	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	94
PID 1924 wrote to memory of 4516	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	94
PID 1924 wrote to memory of 540	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	93
PID 1924 wrote to memory of 540	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	93
PID 1924 wrote to memory of 1128	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	91
PID 1924 wrote to memory of 1128	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	91
PID 1924 wrote to memory of 1364	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	97
PID 1924 wrote to memory of 1364	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	97
PID 1924 wrote to memory of 488	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	90
PID 1924 wrote to memory of 488	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	90
PID 1924 wrote to memory of 5008	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	102
PID 1924 wrote to memory of 5008	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	102
PID 1924 wrote to memory of 5020	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	96
PID 1924 wrote to memory of 5020	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	96
PID 1924 wrote to memory of 648	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	100
PID 1924 wrote to memory of 648	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	100
PID 1924 wrote to memory of 4768	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	99
PID 1924 wrote to memory of 4768	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	99
PID 1924 wrote to memory of 4416	1924	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe

C:\Users\Admin\AppData\Local\Temp\Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4452
- C:\Users\Admin\AppData\Local\Temp\Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe"
  2⤵
  PID:3608
- C:\Users\Admin\AppData\Local\Temp\Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe"
  2⤵
  PID:3356
- C:\Users\Admin\AppData\Local\Temp\Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:1924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfhzrgde.a44"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:488
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\wfhzrgde.a44 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\wfhzrgde.a44\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\wfhzrgde.a44 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffe0692c728,0x7ffe0692c734,0x7ffe0692c740
      4⤵
      PID:1128
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfhzrgde.a44" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1608,i,10191348134995753267,14302440844186888953,262144 --field-trial-handle=1928,i,768181744671809481,5149913943042396789,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:2
      4⤵
      PID:2960
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfhzrgde.a44" --force-high-res-timeticks=disabled --metrics-shmem-handle=1880,i,12950006687874495072,5446922119617528594,524288 --field-trial-handle=1928,i,768181744671809481,5149913943042396789,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:11
      4⤵
      System Time Discovery
      PID:540
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfhzrgde.a44" --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,14976840148717159340,18306572492702073324,524288 --field-trial-handle=1928,i,768181744671809481,5149913943042396789,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:13
      4⤵
      PID:4516
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfhzrgde.a44" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2840,i,2326660069052891181,4988253798635154589,2097152 --field-trial-handle=1928,i,768181744671809481,5149913943042396789,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:1
      4⤵
      PID:2272
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfhzrgde.a44" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2844,i,17434627918620970294,1916494130684217870,2097152 --field-trial-handle=1928,i,768181744671809481,5149913943042396789,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:5020
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfhzrgde.a44" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3128,i,1783083239073697664,9988624967523363405,2097152 --field-trial-handle=1928,i,768181744671809481,5149913943042396789,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:1
      4⤵
      PID:1364
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfhzrgde.a44" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3148,i,14688409319680476436,13514660952894286984,2097152 --field-trial-handle=1928,i,768181744671809481,5149913943042396789,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:9
      4⤵
      PID:4416
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfhzrgde.a44" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4328,i,16205960999392612904,18192837714803436557,2097152 --field-trial-handle=1928,i,768181744671809481,5149913943042396789,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:9
      4⤵
      PID:4768
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfhzrgde.a44" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4368,i,16278954697171155824,412491183584457196,2097152 --field-trial-handle=1928,i,768181744671809481,5149913943042396789,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
      4⤵
      PID:648
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfhzrgde.a44" --force-high-res-timeticks=disabled --metrics-shmem-handle=4408,i,4360065831706669926,11312619652558584566,524288 --field-trial-handle=1928,i,768181744671809481,5149913943042396789,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
      4⤵
      PID:1476
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfhzrgde.a44" --force-high-res-timeticks=disabled --metrics-shmem-handle=4512,i,8072779131649155132,15302662189492855035,524288 --field-trial-handle=1928,i,768181744671809481,5149913943042396789,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
      4⤵
      PID:5008
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfhzrgde.a44" --force-high-res-timeticks=disabled --metrics-shmem-handle=4528,i,1701446876206444435,5852553112793852016,524288 --field-trial-handle=1928,i,768181744671809481,5149913943042396789,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:14
      4⤵
      PID:2156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mhjxnulo.ryf"
    3⤵
    PID:432
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\mhjxnulo.ryf
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1848
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 2052 -initialChannelId {79e60141-7877-4326-be80-99b36386cf8c} -parentPid 1848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1848" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:2384
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2296 -prefsLen 27133 -prefMapHandle 2308 -prefMapSize 270279 -ipcHandle 2316 -initialChannelId {15df36f9-bcd2-4591-91f9-54e58b0a2023} -parentPid 1848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:4504
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ffd5682c-69c3-4cd6-95a8-25be84490b51.dmp"
        5⤵
        
        PID:1636
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2280 -prefsLen 27133 -prefMapHandle 2804 -prefMapSize 270279 -ipcHandle 2800 -initialChannelId {d4050630-4451-4925-9552-46413e6b412b} -parentPid 1848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1848" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:2608
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b3a8e6b8-5321-4bd8-a1c7-62833418fbc1.dmp"
        5⤵
        
        PID:108
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2800 -prefsLen 27133 -prefMapHandle 2916 -prefMapSize 270279 -ipcHandle 2888 -initialChannelId {aab9eaac-f1e6-42cc-98a8-4388f3fa9194} -parentPid 1848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1848" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:4712
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3936 -prefsLen 27323 -prefMapHandle 3940 -prefMapSize 270279 -jsInitHandle 3944 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3952 -initialChannelId {81829e6e-c7f6-4d97-9b9e-ad9d3552f787} -parentPid 1848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:4928
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1e9945f1-fcaf-4065-beda-b1bd5bc94d14.dmp"
        5⤵
        
        PID:3688
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2888 -prefsLen 27323 -prefMapHandle 4056 -prefMapSize 270279 -ipcHandle 4060 -initialChannelId {5ea8f39a-da54-4298-82c5-43dafe440c73} -parentPid 1848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1848" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:4408
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b5077e40-d4a0-4ac8-8871-68081673cc7f.dmp"
        5⤵
        
        PID:2372
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4380 -prefsLen 27323 -prefMapHandle 4376 -prefMapSize 270279 -ipcHandle 4368 -initialChannelId {78e01c46-52a0-49f5-9c47-f0dd4d32b38c} -parentPid 1848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1848" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 rdd
        5⤵
        
        PID:1360
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3380 -prefsLen 34822 -prefMapHandle 3384 -prefMapSize 270279 -jsInitHandle 3308 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2676 -initialChannelId {3c7578c8-6bd1-42d2-be58-8405f9c6e28b} -parentPid 1848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:2032
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 1648 -prefsLen 35010 -prefMapHandle 4924 -prefMapSize 270279 -ipcHandle 3364 -initialChannelId {b05db35c-c879-4347-8b4f-66c2effd4bb4} -parentPid 1848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        5⤵
        Checks processor information in registry
        
        PID:5860
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1380 -prefsLen 32900 -prefMapHandle 2328 -prefMapSize 270279 -jsInitHandle 4144 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4768 -initialChannelId {5b524d62-d53c-44bb-9bc7-4a9a8daf709a} -parentPid 1848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:5872
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4740 -prefsLen 32900 -prefMapHandle 4640 -prefMapSize 270279 -jsInitHandle 4652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3384 -initialChannelId {56667c92-ac86-4bd9-920e-54e73841d975} -parentPid 1848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:5880
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5552 -prefsLen 32900 -prefMapHandle 5548 -prefMapSize 270279 -jsInitHandle 5544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5536 -initialChannelId {8566d5b5-eed1-4b32-beda-fac8e6335f87} -parentPid 1848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:2868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffdf634c188,0x7ffdf634c194,0x7ffdf634c1a0
      4⤵
      PID:5308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1612,i,3948646998506067400,2493996985590558446,262144 --field-trial-handle=2020,i,5440928656085258130,10158127097122183561,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:2
      4⤵
      PID:5556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,15000153478281645376,3087869211444712845,524288 --field-trial-handle=2020,i,5440928656085258130,10158127097122183561,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:11
      4⤵
      System Time Discovery
      PID:5564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,8587698935878633257,6059896804330349475,524288 --field-trial-handle=2020,i,5440928656085258130,10158127097122183561,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:13
      4⤵
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3060,i,14593009885536621484,12605686275475278528,2097152 --field-trial-handle=2020,i,5440928656085258130,10158127097122183561,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:1
      4⤵
      PID:5704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3064,i,5104271426813600317,975673437100971381,2097152 --field-trial-handle=2020,i,5440928656085258130,10158127097122183561,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:1
      4⤵
      PID:1152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3252,i,7597924917110793687,10348144405794578682,524288 --field-trial-handle=2020,i,5440928656085258130,10158127097122183561,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:14
      4⤵
      PID:5744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3260,i,17795754300296845154,9384926958994947627,524288 --field-trial-handle=2020,i,5440928656085258130,10158127097122183561,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14
      4⤵
      PID:5836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3272,i,8355142479398369818,5230053489461254308,524288 --field-trial-handle=2020,i,5440928656085258130,10158127097122183561,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:14
      4⤵
      PID:6036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3396,i,17990808885479034424,7238105107898359370,2097152 --field-trial-handle=2020,i,5440928656085258130,10158127097122183561,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
      4⤵
      PID:2164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3408,i,5562379384157333703,17514899761755429751,2097152 --field-trial-handle=2020,i,5440928656085258130,10158127097122183561,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:9
      4⤵
      PID:2820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3436,i,12554500940124897752,12619592341655793162,2097152 --field-trial-handle=2020,i,5440928656085258130,10158127097122183561,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
      4⤵
      PID:2184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3460,i,8734753314759618096,8671212153004699762,2097152 --field-trial-handle=2020,i,5440928656085258130,10158127097122183561,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:9
      4⤵
      PID:1292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3488,i,16269867299035189747,16258313302917993089,2097152 --field-trial-handle=2020,i,5440928656085258130,10158127097122183561,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3500,i,13940519420944233085,9640802188880390258,2097152 --field-trial-handle=2020,i,5440928656085258130,10158127097122183561,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:9
      4⤵
      PID:4240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3528,i,4280186985152545226,8563575775710541899,2097152 --field-trial-handle=2020,i,5440928656085258130,10158127097122183561,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:1
      4⤵
      PID:3820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3548,i,11032248244112325709,7140772551374348530,2097152 --field-trial-handle=2020,i,5440928656085258130,10158127097122183561,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:9
      4⤵
      PID:4352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3568,i,16769737422041314305,14529589538234546823,2097152 --field-trial-handle=2020,i,5440928656085258130,10158127097122183561,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
      4⤵
      PID:1804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3580,i,13042578997744803381,16088202811735717375,2097152 --field-trial-handle=2020,i,5440928656085258130,10158127097122183561,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:9
      4⤵
      PID:2980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,12174493539819493929,17138335602983127345,524288 --field-trial-handle=2020,i,5440928656085258130,10158127097122183561,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:14
      4⤵
      PID:5232
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:6040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,1225127777649168935,13436848771966348675,524288 --field-trial-handle=2020,i,5440928656085258130,10158127097122183561,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
      4⤵
      PID:3884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,15779013203198835700,5323057009067168791,524288 --field-trial-handle=2020,i,5440928656085258130,10158127097122183561,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
      4⤵
      PID:5536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,9285966965383032514,15487877572222470404,524288 --field-trial-handle=2020,i,5440928656085258130,10158127097122183561,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:14
      4⤵
      PID:3248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,8257616259758732724,16339194109612805977,524288 --field-trial-handle=2020,i,5440928656085258130,10158127097122183561,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:14
      4⤵
      PID:5736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=592
        5⤵
        
        PID:2256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,11929195034511014965,6834657382065420800,524288 --field-trial-handle=2020,i,5440928656085258130,10158127097122183561,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:14
      4⤵
      PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,11929195034511014965,6834657382065420800,524288 --field-trial-handle=2020,i,5440928656085258130,10158127097122183561,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:14
      4⤵
      PID:5976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      Drops file in Windows directory
      PID:948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff7d63b04c8,0x7ff7d63b04d4,0x7ff7d63b04e0
        5⤵
        Drops file in Windows directory
        
        PID:964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        Drops file in Windows directory
        
        PID:3756
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7d63b04c8,0x7ff7d63b04d4,0x7ff7d63b04e0
        6⤵
        Drops file in Windows directory
        
        PID:1936

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\poiulrozalk.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Users\Admin\AppData\Roaming\ZKyNmFX.exe
  "C:\Users\Admin\AppData\Roaming\ZKyNmFX.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3232
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZKyNmFX.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1964
- - C:\Users\Admin\AppData\Roaming\ZKyNmFX.exe
    "C:\Users\Admin\AppData\Roaming\ZKyNmFX.exe"
    3⤵
    - Executes dropped EXE
    PID:3752
- - C:\Users\Admin\AppData\Roaming\ZKyNmFX.exe
    "C:\Users\Admin\AppData\Roaming\ZKyNmFX.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ZKyNmFX.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ZKyNmFX.exe.log
Size 1KB
SHA256 954f692df2fb645ad94c0d8a397f8a6776f13bd16d7a4974138fd0f0cb2895f3
MD5 2f13af6aee5f8bb7506e5bb1c5db5503
SHA1 f90001d0ddbcf42bdf726d15194c02968e4c6e27
SHA512 4dcd079e6707e6f087f2ecda602bf54e6e96c275385130d5512eb8da4061fe7d36c57eb32b833a6fb3bfc7860830af161f874f75f78dde34660a9de87b78669b
TLSH
T19D216B303231B5D84D422F5308586AC566FF0745BAB8DF6CB659235EDD2A047AF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
TLSH
T113415C303161A5D84D435B1205286ED5E3EF478AAFAC8F5CB569231DCD2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 784cf018ab364b852eb62cfd4b7ed9319179f0138251caa9b597f924afe151fe
MD5 634e0a0cafc2dc90f028f92405931cd1
SHA1 a284f400ee27fd0083bd4528711130f72c166d36
SHA512 c0b086ede46962df1868cb4e187af1f585f6b48edd67c8844e9f39a2c6aac4bae540375ea6f6147443ea1afa79fc442e16b7bcf984e67c03a0e46f2e0b902bbb
SSDEEP 384:aL3HhRSS1aDe+BbTVFRHEMESH3eNPjs2xtggN8yXo9U9J0u0iFzBX:krSSs7Bb/RPESsPj7xtg88ySU9J0u0yt
TLSH
T1E592D4AE711F22C3C89553B8E10B040FE8F2DE8D431A13D9BB2E9E7B89AC55E417D558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_s2qsq0ji.r5h.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s2qsq0ji.r5h.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb\Crashpad\settings.dat
Size 280B
SHA256 d9ac6cb8af35a7b86e545cf118d6467ad95420dbfc80b7ecf2bd62564293b5eb
MD5 cb08877d1c8a5289abffe5b285173132
SHA1 7d478bdbb0ff5c3ffaf58bca6b12323822499b1a
SHA512 ef71aa71240c597c7cce8d1dd7f3f02a9c1863488e4bd26b635d392d6a5a0c1c4a60b4e7655468430719b9a70082ff056b5c90ae40962bc1312609de229b0a26
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb\Crashpad\settings.dat
Size 280B
SHA256 4095367d01d84e5405b41a153c422960070a8d935052693fbec8feb1eb91ab32
MD5 7bcf9f1857b199d7edaff6a797785af9
SHA1 4169c4cc94b8679d808ddcd536143198ec93957c
SHA512 d75b5159409263e2e261da765dd68fd2551d7304a32a3d88d7387b218a87df538728672d79d3271996213924d6b5fd70a4c10903cd31d1fd23a4ad566c1e85a1
TLSH
T1D8D022C3FBCB0220C00222338E33F32038308802F0FA82020CCE00B00CE880E00AC8BC
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 b881fe61306b3f641b03b1dafc23bbcafd0af48833a87317d1ba789a164e4c15
MD5 a8de34674d78a4f778725079d2518246
SHA1 2e3e88e7a0adceea459998683a8dbfe4a03b4671
SHA512 2414edf91618f0eda6fbde1db16621a34c03fb4faa35c3ded0b0fab03d3b71927691963205e32d3d02db3a1132c1f9590d2566f9245c8e58e0e90722e1f1e81f
TLSH
T1F5E0D8B62EF70824ED6FA6E7687594D045467C558401AC4F615AB7D324B1316241AC63
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 57419d4d42ad44a68e2eaf387b956965b57b1ba18c233227846fdc6e8e2f9c64
MD5 36c93cadceb5cb2ea61e94c9ee4c61d3
SHA1 29a08a7fb5edbd1f60d4b9bb1d30fb807fec1979
SHA512 dfab8b2e0db8ffdb56f583ed9f14157c1652cad607f178bbd6504227e77005a932941100df27a9619666e71468e62da86150f94dbabac070adbe41712bda65ce
TLSH
T14BD02BB618A60810EDBF53F34C3190D041527C548946AC4F105DA7C334B03263413C63
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58c2ce.TMP

Path C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe58c2ce.TMP
Size 153B
SHA256 b2879e4f152f6f33a80f044f9c440d91cb913082aa7b03be6c0db2e9e61a0f46
MD5 60ec549817d6102b288ed13ca9e11296
SHA1 02fae907a557828ae9ffc38d610b37ed53a1f5f9
SHA512 e77aca4424c81a5f29f93de12e39c5dab2232f57e0f0d45739e3373e218bda72d7c10ee67f2184d2c3d50c885e188b726405aebe69a37c985fac88d2645813bf
TLSH
T19BC08CBB1A694800DD1A63D1403288D14253AC848994AC89011EBAC330302323026C21
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 e562b1c672c82da4274238079f2804159ace41813a3589ae1bfb5a428e8535ff
MD5 0a3a5cce15af38c18dbdeefc8d06bd82
SHA1 48943f7435b2830e528a31bbc0dadf68b8e5a13c
SHA512 a89d0ca612a3ca57c2ee0d6185762a0bd1289e57cde7f90aa5f821205c4d9bf64cfe3988a0e32bc72863fb0a502a784adbb6fabc9150cfc27ec33b39f44e4f12
TLSH
T100214E53B9B622C028FFA60C81D4955FFA4130B7B126643A7EF810D68966E405FBD8CA
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb\Local State
Size 14KB
SHA256 e10b21bf047f4da287adaf98b42e53b472705793a4a20360cdef8f619a9b2888
MD5 819c5f624440ace8fae7ab6dbec8ca7c
SHA1 aab32cd70fb2f5374722f21788b9aec78ad997ec
SHA512 63ba89569b55a40f94c8f300dfb81f35445ccbcd06cbbff05f85015206ce283d36cad06edff5c97bc95c618c64f84fa43adf670e3997558466089bbeb89f3887
SSDEEP 384:n2tNn/s3n9Sf8NtcnFbJCC/Pb9oRvR1x9f:2j+9U5hYC/AvR1vf
TLSH
T1AA625B321539ED3709E6A688F44A2F472EB424B3F4917F9DD5D8AB0C00CBBD81746E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb\Local State
Size 4KB
SHA256 457efc10015e67cd607630265a33ab3f3954360143c1bd1decf465683121762d
MD5 57d4b1d635fa2a72cc56747e4130b61b
SHA1 cbafe44838ecc868efda32ed15016816a9882c0f
SHA512 9442dc96df1e32f5424fe8b7200d83bfc2e05c26ea014ff3409a34642782685aacf9fc18ba806b288865c5e7f3afc0fedcb53e32fd6eff4f0055688a445baff7
SSDEEP 96:xqGNk0QsFf1c5H3IX58Frh/cInURoDotov7+DuBjTvVsjD50eUnpr5q4a:4GNMMc5NooDUwEO0D5qpm
TLSH
T18AA175726479EC3749F5BA44B89627936EA42133F885BF89D2D8160C00DBBD8270AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb\Local State
Size 3KB
SHA256 c0e96760a6d1221de5bfb7849084fa5e456c4d13ae348f8a369fde2c5d6827a0
MD5 30bf288c0132925bc0ab8f917835cfd3
SHA1 0208e23bfbc38aa28ad39ce21a11daa5c7871a56
SHA512 cc88de83f1735c8fcdf29007e756629b308bb0553dd2f20ccbe5f65471cdafb0cb086d9bd243c43029b7322c4db79792d9b15fb589b681ae5e22c66687db7fa0
TLSH
T12E8195726439FD3785F5B644759A2AA35E783173FD51AF88E1C8631C00DBBD82B0A827
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58b726.TMP

Path C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb\Local State~RFe58b726.TMP
Size 1KB
SHA256 cd98046fce4e22f0940c8b5429075dd3d6ba7c2d250de43ebddc4694a987004c
MD5 0fc30a6390cc593b9ae02cea08db4098
SHA1 761e73f393ec1f0ceb765097b222564331fce498
SHA512 48c8f50a38d5e8128fddfd0c6f7713c88aeeca88b76ebb3878c044057584439862a64f37f5aca01763ba7d08d41e98d0d754dd0932b5768bc4a0c58b4b5ab06d
TLSH
T1DC3153B374BD7D77E4B0A646724A7F531E342132F1916A8841DD161C01E7EDC621AC3B
MD5 SHA1 SHA512 TLSH

Submit Download

23dcc327-8d8a-4c84-b8c5-63b3713ad717.tmp

Path C:\Users\Admin\AppData\Local\Temp\jljayazz.hxb\extensions_crx_cache\23dcc327-8d8a-4c84-b8c5-63b3713ad717.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

poiulrozalk.ps1

Path C:\Users\Admin\AppData\Local\Temp\poiulrozalk.ps1
Size 1KB
SHA256 36a3f0a06919da05a7bb080c0c44bfd3baf9e3ad664ec6a7e1d0976897589e57
MD5 865d9f7febd4754c579c8abe61026bc6
SHA1 7fddada55947a56fb210a0b5f5efd4ec73ef6d15
SHA512 478b27cc8b2e5562ffe0ddd747b3d037db5e16fd2155fc46feda8541785cbe892fb65ddf1b1681b1c672133462e5e16cdc399cc38b8bf15fff0336db0ee3b468
TLSH
T1C711A04B8E4543D5442807F04A2375CD715EA1CB2BAF008089ECF8EDB36BD67786ADE8
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\wfhzrgde.a44\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

efabffce-9ed8-49f4-84e9-1246ce824abf.tmp

Path C:\Users\Admin\AppData\Local\Temp\wfhzrgde.a44\Default\Network\efabffce-9ed8-49f4-84e9-1246ce824abf.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\wfhzrgde.a44\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\wfhzrgde.a44\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\wfhzrgde.a44\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\wfhzrgde.a44\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\wfhzrgde.a44\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

1e9945f1-fcaf-4065-beda-b1bd5bc94d14.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1e9945f1-fcaf-4065-beda-b1bd5bc94d14.dmp
Size 62KB
SHA256 7b68d6586a7cc5244c30558b5bb2e5467a0119860ba941f2ce5514db259af7b0
MD5 e72041cb6202f0dbb75ea7c8a4f1166d
SHA1 c3c98898b2451d595622c14cd67fdae718bdc053
SHA512 d89f3c82d214832d527a108fdc58561a6cd7958463918718547160ce4849085e7eedba42e685c6711d78acccead110c672b9c53885f3b3a5013fc286ce574cd2
SSDEEP 384:xnJdyws/WH/s0pgzLLlMA9CCgUSVvaMj3uKhaV96XMEBqn1:x9sOHkFLLc9Z+QX7B
TLSH
T13153D756B3900833E56A9B741BF76B543BF2F8150793431F226553EAAC673446CB2F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e9945f1-fcaf-4065-beda-b1bd5bc94d14.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1e9945f1-fcaf-4065-beda-b1bd5bc94d14.extra
Size 10KB
SHA256 aef642940dfaafc7f4ecc1eaf11cae9f6668c7958a81f765b3757b840a33c456
MD5 1791e3e0ec24d98a7e3c863e14c83d54
SHA1 b98118b529ace14934947bf44ca295f35818d242
SHA512 b4f058e8ce36a4fd84eaafcf204f35cc8d037dd2b6a74052cce08dbdb1435d7c7ce0403f10ab3256598af9383b840847522ddd059f6ba21d70450ca7a9cb6885
SSDEEP 96:STWC9KTvfY6pw6lFFdtH0Rh7CsevBb1d0fjMLlIrLlhTLlaXv7a4utILfcBCqwvp:S5ALFbG7uvZ8rLuxsP5wlCifo41
TLSH
T189228213874724B7AD4198C4BC30AE7C45EC6FAA61F958A802CD4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e9945f1-fcaf-4065-beda-b1bd5bc94d14.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1e9945f1-fcaf-4065-beda-b1bd5bc94d14.extra
Size 10KB
SHA256 74a599fc48313d370228794642bc75e20ac2e7afb37fa24051ebb8d86f058a20
MD5 7cdc59c8f345f1b349b1cc346ffc5b58
SHA1 55ced6cf73e211d9f31e0b7a6c17cd111eff92db
SHA512 089daef621822a1014610b35803a13b3a3fd0f36a1451a9effe1f918517fa35b23fc79e67c180e456685e4b0a2f686953dea7219a64a67f8559078d84008d628
SSDEEP 192:S5McFQiR4p4DnTYapdVxzP9WBHg4T/fKNtalKifo4ZbLMtqfn:iMcFQi5Dz1lWBHg4TmaDA4ZMa
TLSH
T15222E721081CD837F7D7AC8DFA393E3AD66D7B1A00E6785C40CDCA8AC2A5478A779453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3a8e6b8-5321-4bd8-a1c7-62833418fbc1.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b3a8e6b8-5321-4bd8-a1c7-62833418fbc1.dmp
Size 64KB
SHA256 4ef8fb46fbbb5fa6cd8e12feb25a1f100ad9a6f851f606306e7469b6f10c9811
MD5 c76976311d397fad3ad1726b9b8dca42
SHA1 3c1f04acedc9dd5cae95871f06f868f0cfa83f55
SHA512 0cd859ca262f18a9a8cf8bce6e21d2501f404302a9375938856f7598817ba10c52f3afd34296006a8f5e70721e394d0f1f0fb03c4258e2f365da54bbf42ece1c
SSDEEP 384:KroUH+Jxhiu2jyCqnM4fiTGmeL+0oSKSqbrkXMEBqn1:KJH+JB2jJP4+nprkX7B
TLSH
T19553DA26A7902833E96D57741BEBBB053BF6E8241793832F866452FA1C673C4EC31B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3a8e6b8-5321-4bd8-a1c7-62833418fbc1.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b3a8e6b8-5321-4bd8-a1c7-62833418fbc1.extra
Size 10KB
SHA256 e83100159013a5426c474258175748a69ad757bee887c369f7976f7691e00938
MD5 ea8a602d8d93aa6ead81e60c8729586f
SHA1 09c4827ecb7b4b2681f9ad886dff9799961debe3
SHA512 debcf8b1941f3c7ef5174d21ad0de4eddef3c09f55c68e4085dbf74dd6e1f4a52d00b10a777d3a1710965d662bddce02e2deddfc4a191cd256a70f09b71b5377
SSDEEP 96:STWC9rTvfY6pw6lFFdtH0Rh7CTvBb1d0fjMLlIrLlhTLlaXv7a4utILfcBCqwvEx:S5BLFbG7WvZ8rLuxsP5wlqlfo4
TLSH
T129227213875724B7AD4194C4BC30AE7C45EC6FAA51F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3a8e6b8-5321-4bd8-a1c7-62833418fbc1.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b3a8e6b8-5321-4bd8-a1c7-62833418fbc1.extra
Size 10KB
SHA256 5a9a732d89f9285c3d9e6f9579cf78768ca1faaa0e50ecb65f7832bd779c78f8
MD5 ad123db20b3746e81969a24a181066c3
SHA1 43cd356f3444ba2eb2198fd48a2edf8f5c1ae40b
SHA512 32ffb03872aa20ce857bbca818de080ab13ee662e3484d9e29cab66c65a18e53d9561e34e327dd9abb9c5d837708ac14e7c2d468cf6831e2035bc0f04f1a42bc
SSDEEP 192:S5jcFQiR4p4DnTYaVdVxzP9WBHg4T/fKNtalClfoIbLh8tFn:ijcFQi5D/1lWBHg4Tma8AIh8j
TLSH
T1D422D921081CD837E7D7AC8DFA393E36D66D7B1A00E6786C41CCCB4AC1A5878A779553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b5077e40-d4a0-4ac8-8871-68081673cc7f.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b5077e40-d4a0-4ac8-8871-68081673cc7f.dmp
Size 64KB
SHA256 c62ce460d8debe75989f71ffb377e983b2d132cfe0c6653bc89b5b0f591abc8b
MD5 8704f6c779ef4e0ff8febf9f93003a95
SHA1 bfa5301e214aafa8a77298c9a066391737f99227
SHA512 75aea31fa1b5d2885d533b792f286f7833fe94af2b91f07e34cd90195a7321b6973600206e6c8f7377340b1706363b2ae3c99e5181a67b6a4886db0f568229f3
SSDEEP 384:KvdB4npvSExbNweOdn8cZKqd0ex+ypsAdvSnsCOSKliW7sVMC8XMEBqn1:KCpurEyC3hksVMJX7B
TLSH
T12B53EA26A3804822E56A57752BE7AB053BF6E82507934BDF06E4D1FA1C633647D30F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b5077e40-d4a0-4ac8-8871-68081673cc7f.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b5077e40-d4a0-4ac8-8871-68081673cc7f.extra
Size 10KB
SHA256 bf90c490408335e1e9aff81ec310cecfe87bc82395aa10402a8614a4b964fe56
MD5 839deca69380e7e8814b62ea3141b7e1
SHA1 0ad2d2fe708f8eeb6039d038619f3a5e9e03c391
SHA512 e8a32bc817ebd242772c723459c4289b644cf823d9e0227b35fa4175bc4c75fc52ec19643803818afca6351b54a2b33f5cb6da010d42af426d47a423116a05a2
SSDEEP 96:STWC9u3TvfY6pw6lFFdtH0Rh7CsevBb1d0fjMLlIrLlhTLlaXv7aw8utILfcBCqN:S54DLFbG7uvZ8rLLxsP5wlKtfoy
TLSH
T1DF227253878724B7AD4194C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b5077e40-d4a0-4ac8-8871-68081673cc7f.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b5077e40-d4a0-4ac8-8871-68081673cc7f.extra
Size 10KB
SHA256 da958b49568b4fbf848cc5a701b7e609ae4ec004d3d0e81efcf6bca4280ae467
MD5 6d3e0a3dce854a24d1fa402ed8115083
SHA1 d40bc904d2688059c0f6c64393a650dbfae8686b
SHA512 854244de1aabfa7054691a73e6e00453232e54fd5fee5ed030ab73f4a382dfca48a754579b416dff51fa3d8d7c7409b40e8272611dc70f5488de22bc69b83c4b
SSDEEP 192:S54VcFQiR4p4DnTYapdVxzP9WBH14T/fKNtalytfoCbLctAn:iscFQi5Dz1lWBH14TmaMACcK
TLSH
T19132E921481CD837F7D7AC8DFA393E3AD66D7A1A00E6785C40CCCB4AC2A5878A779553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffd5682c-69c3-4cd6-95a8-25be84490b51.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ffd5682c-69c3-4cd6-95a8-25be84490b51.dmp
Size 65KB
SHA256 43096e9df913aa1f24c00202d01e91c2bf3e154e3acf4c453a5fd7958b8d26ec
MD5 0880816baaa2a00104fdc67fb34afda9
SHA1 ab91e548d487ef0e6927a902863c86dee87c7b3e
SHA512 31a8855058bd8cc65d9815cb8888361869181865aaa071fe95beb39c77535d45aab31ee7c904344a247bb2b64300e50591bec4cec6d6a67e0d669736756684db
SSDEEP 384:db2U4oPbVPQYJdZkVwg8F2YINl8gFJ2ZH0JR5ddE361XMEBqn1:dkojhoFwH07y38X7B
TLSH
T10B53C516A7C00922F53927745BE7AB043FFAE8154BA74B6F062476FA9CB7315AC30B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffd5682c-69c3-4cd6-95a8-25be84490b51.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ffd5682c-69c3-4cd6-95a8-25be84490b51.extra
Size 6KB
SHA256 05a2ff9718d090a7ee9c948253133768480734e8819dd3f3919af7b2cfc6cd8e
MD5 d373caf6f3934c15084693a21c85f7ab
SHA1 bf58dbe77fb2e2e01467c71047af1e9242078ca9
SHA512 065c8984ce442f83be779fcd662c6bbc0afc77980ade1def8642c4b55be8b0bd6ab199f3b10dac3dcf90209a1e23efbbb7eb4141127fcb31e45c72be44fc641d
SSDEEP 96:STWATvgY6pw6lFFdtH0Rh7CTvBb1d8Kfo3:StsFbG7WvZUKfo3
TLSH
T11AD12152431728FB9E4284D9AD346E7D19DC5EEA50F61C6843C60E09BE9A4F42FF90F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffd5682c-69c3-4cd6-95a8-25be84490b51.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ffd5682c-69c3-4cd6-95a8-25be84490b51.extra
Size 7KB
SHA256 1ca5cbe3dd1718f7ae170da97253fb1ecd1e510b3ea9c5e5b6adf0da2a253a26
MD5 0ecc7691eb41f7d9f0534eedb2f319d1
SHA1 03103deb5b2226a7b994eaaee336a8677d70a390
SHA512 71ff1de6bc8fb1d03a48c84d48811e62b1d29da133497e9391a2cb2be3f75fd7a887e73a5f136b600bb50883562a71147549e34fd34fc76f8befd3b1d80e54fe
SSDEEP 96:STWWAo6KdJPQiyQ974pT0DnZDkwYaNQBv9QCGlQrQ9rQgAQbGYnQMRWUKfo7bLPL:S4cFQiR4p4DnTYaVdDKfo7bLYtqn
TLSH
T11BF16425001CD8679AD7AD9EE33A7D3A999DB21654D33C5C81CEC71C42FA4B8B78A142
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

store.json.mozlz4.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\crashes\store.json.mozlz4.tmp
Size 6KB
SHA256 af1d74741d0a88127b8e6772026bd8d6afe2ba8bbdd1729d93943f62aa28d75b
MD5 011651fdee5f9a9bcc9aa141fae38fb3
SHA1 f4e5a2075b7bcefa87107ea14645f7c2dc61fa00
SHA512 71a43180ca603e7cd89d0cd51f869b24a4ce0a5cf6dfe7ca633b22b799f61678d2875cc4e07a0ebefc22a2ec1bc798518aabb08737e2660b8567de44f52eab86
SSDEEP 192:iaf56b/113aE2DAs78GbDAcSxHmM01NLNxIVvWwzD:iuwb/HqR78lmMkQvxD
TLSH
T18DE18E63CD40BE921A912436B0C5F74593522E3724AADBCD3CE777994EB0BA04734BC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 8ed3dec7f4122270c95a8afdb8d7a192ff310aafcbc37a416f1c659e076c2dda
MD5 1d3afd57068384f3483314609079c51e
SHA1 59748930856ee3f53a3bd320aa0747d52e5ff0a9
SHA512 e9a6853841b11876057761dc2eb36d9a38aeb41adf9a0871ea431ac16b31a2f96071791eb5886637e0d7b0cb61387cae7f0bdef68ebe8b1c29e36ece93cf36f6
SSDEEP 192:8i1d66Joz0dzgCl6mc0dcOv5zboH+bLayjOM:8sd66JozQzgC1jRboebLayj
TLSH
T179E10D68EA29863FC408123BCCA61F501F75348BA84F3F1931AC654A2D5B2DD7B8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 95d84d26797b81da175beeb9206d6930e7458cb0e6c4df6b0e7d708dca15d36b
MD5 4c17a7addc6e4e0dd2ec0e202c90a773
SHA1 618727ede0075859f5cfa7341405fe8357e8b86b
SHA512 b193f6ea4ddb52fde56dd13377ee4b8e7a89c60a7911400220b987789d0c14fed1d4259c138b785f4e7a8e7eea0e7b935b5e23616e04c958f0b28be33e1b2297
SSDEEP 96:XFP2Fx5DFxMFx5xG/dd66Joz0dzgClKtmc0d/UUJPSdF95/7bkW6QXjrcELayURE:Y1d66Joz0dzgCl6mc0dzOv5zboobLayj
TLSH
T194C1DD68E629963FC448423BCCB60B501E76389B984E3F1931DC344A2D572DDBB8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 aea9a0a9e99d7cba7faba7edcb1fdd3bd16710e98b2ec70535e3ccbf0607c14a
MD5 64ed582ecc4230462d4f2bf8c0580f12
SHA1 6383791cf8c5c6780a1612f0b8d3416ffcbbf871
SHA512 57a541db8e7da4e989f76b477520ab362574658123dd150824a59dbc84221f4535b99abcbd78da089585d3abfdbb8c5175d95214e5f71a154154f4b3179dce4a
SSDEEP 192:TA1d66Joz0dzgCl6mc0dcOv5zboH+bLayjOMN:T6d66JozQzgC1jRboebLayjR
TLSH
T172E10D68EA29863FC408123BCCA61F500F75349BA84E3F1931AC654A2D5B2DD7B8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 3b3aa5f50ad21dcfda5fc78b44dbd440517b8ef7376927cd710c487ce63d9159
MD5 d669c73340216d741c7d93f1368d96e5
SHA1 9f3d28ea42bb694bc4be4b96424a3f8aedfc0a1b
SHA512 3bbb4b0e55770f4b3fb81619256e7249fb3dfcd9ee3546a78b11e4a15c2f58f995e3dcdac182d9480692b1548b5b3b4c6091a5f170895b930f04666ec63c55f9
SSDEEP 192:bOv5zboH+ZLayjSMUb1d66Joz0dzgCl6mc0dz:EboeZLayjMZd66JozQzgC1jd
TLSH
T1F6E10DA8EA29863FC008027BCCA61B440F35389B984F3F1971AD75492C572DD7B8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\events\events
Size 1KB
SHA256 f0db8fb90b5e954216ccd0139553aa9d4d8585bfd80444bb77d0dbe7cb92f1bc
MD5 42b14a236aa9a919d46f34f67846cae2
SHA1 60e43f2c759e6d0e91910ec085dbad51ebb331e5
SHA512 6c560500a452141844724c215dbfca161a2b2edbaa5eb9e581bed1619ebd1507ba3ba8c97b2305b9fc1bf5181a8b99c0cae478fe1b2d0ec543206b14a85261de
TLSH
T10221379C3AF88D6E98CBF39C7441218E53564E06449B1C474D12FE8ECED1ADA326E83C
MD5 SHA1 SHA512 TLSH

Submit Download

018ed4e2-b308-4ac8-8ee6-fa356e4d7e7a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\018ed4e2-b308-4ac8-8ee6-fa356e4d7e7a
Size 3KB
SHA256 6e92359cedecf08126f77fe59cabb042982854d2413e96696950693b6e3bddd0
MD5 2f6dd72845fb9729707c88f09ac8e401
SHA1 b741acdcd2d4fbeb094e09c76cfa3070b986d8c9
SHA512 5d39d79bf1edad14a1759e4a328ef1ed24c0edaecae9d1c06e0c06285a1686cfaa769733b9071aa3efdcdf5c84048c38ebab4d5f2ffe6f7af8b09f971fcdbc20
TLSH
T16E616610491869738BFCA004E33B7B848EEA338B58931B8D656A8E6443E8478578B34B
MD5 SHA1 SHA512 TLSH

Submit Download

1c3e6b24-356a-4635-86c7-94b11385b568

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\1c3e6b24-356a-4635-86c7-94b11385b568
Size 3KB
SHA256 95541af599366931d3f29e5ed0b9808d0bed0ab0d84c014a63741ec15331704c
MD5 c3e59ff9fe68c4b3f9aaa79ccdad9b32
SHA1 1b5a401c79194fb65da7953cbe3c09b77841ce35
SHA512 bb0824a1649a3933ad1063c8cc6c336db5453275e6d9593a8219ae94ec92a1c46bcc7d81d9e31bda509fe93f600dfaae4b66ee21a666cc49459dd4d34cb1295a
TLSH
T1BF618860491875734BECF405E33B7B54CEDE33CB48871B89256E8D6442F84785B8B25B
MD5 SHA1 SHA512 TLSH

Submit Download

4b1f1a8a-4a62-45f8-8201-e65db72c16c1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\4b1f1a8a-4a62-45f8-8201-e65db72c16c1
Size 883B
SHA256 17460fe7e800c623c212f40ade9546b44a0d1e344a37d922127556a5378d931c
MD5 bdfa7e84dfb3a5a0b1ff1f367fafd8dd
SHA1 2f663822715caeb3b20e75d728bbf2f88c41db93
SHA512 3327157a2f00b26f17e793d2f30b0170f03aee9109a1e68700434daa3513994671affb9a3e0175d6677c9a0ee03701163e16db923f2ffb072d00d1ddf81b5443
TLSH
T16211D9D0D531B8F3CC68E20FCAA6B7014AE4B52380CA55143DA56E050C6A92EE76A30F
MD5 SHA1 SHA512 TLSH

Submit Download

5cfaaa13-6412-4b37-bb87-86cf8e9653b5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\5cfaaa13-6412-4b37-bb87-86cf8e9653b5
Size 2KB
SHA256 90bd373ce6aec19e141dfcb065b261ad8c366dfe841e62cb6e976bb5127cad9d
MD5 6751c36b0c1693f64138e22e0a70a45b
SHA1 42d0c1bb7d4e0a6e105a4806227bef730e056c0a
SHA512 7ecca411a3e70f8797025b15db0be39e7dc633ee4eb387e8ca76be89d4dfebb90fe86040eeed6ee54d6fe64104f3362baa6be06e0864ccaa4dd06c7da17bedd5
TLSH
T1AA4121EC34B89DB79CEAF68DE482234E5764865300C22C432D56EF4D8C9669D736E42B
MD5 SHA1 SHA512 TLSH

Submit Download

91d684e1-4084-4ad8-8d36-c1bf26a90d90

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\91d684e1-4084-4ad8-8d36-c1bf26a90d90
Size 235B
SHA256 e72d966b38274680f09f5bc7ef1ab097d5b61e779879f701570bc244b147c5a8
MD5 4a52892e8dcd54dd0175feb32cc35e4f
SHA1 3cfdd03fdcedd03909435ecf3139d0dd7a4bdb89
SHA512 31c56f8c606d69370a41d38900ac7241118384360099a6834304256068cafd6b1bf209babc9b882f31cd41b952945728fc1625879de49548b4812aab5687cbe0
TLSH
T1E7D0978024ACA72C08144F03F0A029C370894C332478A820DA910034ADB9ACC022292A
MD5 SHA1 SHA512 TLSH

Submit Download

a44a1164-f5aa-4ae2-9925-82e3b4f3959f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\a44a1164-f5aa-4ae2-9925-82e3b4f3959f
Size 886B
SHA256 194963e1d9196d1532e62908174ef95576eb80420086bbd56a92e78628890769
MD5 5fcd08fb369f99f2c584ab97993ea9f6
SHA1 d0250f9cb93fbc7edab795d7631a793ebc1b152c
SHA512 cebfe84fc2e1eb9e06d71ff03444a822a8602d147331dc63817a7c5e0222336583fe81782b980aa66d2f54ddef1ffc168d916a928a87ef4fff7b6d3c57ee22c4
TLSH
T1D7110480D970B4B3C928914F98A677418AE0702380CB19047D956E050CAA56EE76570B
MD5 SHA1 SHA512 TLSH

Submit Download

a94913ab-8241-43ef-834c-267f481acfe2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\a94913ab-8241-43ef-834c-267f481acfe2
Size 2KB
SHA256 d6241beae56c46b00b85ff807b9f2035ad23f35f1cdb1ed7ed8dc7a8dac29945
MD5 f5633e3426ca085211e55dc606133495
SHA1 bbbe49378c210a33dfcaeaa5071ef514f48854be
SHA512 a1aba28c5256139305e6365e8ceba2e4b9648b94eb079f477ca0a26db41e3066a55b16feca12d8bc232d44390bfef1e17227f74bfb20ab4e008cc64965ce8938
TLSH
T1C551866A8060D8BEC479B31ADD2537828BF2140B408F190EAEECAF0B157FC5E9358615
MD5 SHA1 SHA512 TLSH

Submit Download

aa69494d-1991-47f0-baea-d657dc142709

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\aa69494d-1991-47f0-baea-d657dc142709
Size 235B
SHA256 a3c0d322370a98a9e1fbcea5c7b3bf794a04df04e7dab44e0068a0244a78b0c4
MD5 43fe5c5d219e0ba80b30857ab203c826
SHA1 9be26846759bcfbedcafb8fa5a800abe567e6374
SHA512 ce9882ebfd4fc9bfa4b3b329b3b95d9892e5bd4e2a4a74912633d323dfa9ac4feeb29f4ee2fac3c6d1b5346e5595bf155ccf710b61dfd3b9b209b9dc2abb5d99
TLSH
T182D097801498676C5C080F0AF0E028C630544C336D709820D9A19338CABC9D802A182E
MD5 SHA1 SHA512 TLSH

Submit Download

b195dc2b-292b-4fd8-9e74-8109d70e8f9a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\b195dc2b-292b-4fd8-9e74-8109d70e8f9a
Size 3KB
SHA256 9da04a96f01d9d5797c2998e49327db34c1c2109239b274dedeeb6eb733262c3
MD5 2e4199dd5e969233686bcf98dfbb97a5
SHA1 3ee758fb26e4a77e3be757e047ce4e396743207c
SHA512 ba5f875ed8f6a7fba14fd014ba6a66c543771ee3811938b232a8eca048b9839d8941e20b0941ffeba00b242b85fba623af480e330b2d0d893acdd057d980bed1
TLSH
T1D76146210914A5738FECF505E377BF448ADE33CB5C831A89265A8A7442F8478578B35F
MD5 SHA1 SHA512 TLSH

Submit Download

fc2902c6-3151-4b4a-a105-72660ee83935

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\fc2902c6-3151-4b4a-a105-72660ee83935
Size 3KB
SHA256 7b30b9456ce7a7ea392a25997390ae34f95b5e734a2d4d967badb246ab647c88
MD5 58711b49e7610b565523566f3f0c9ab1
SHA1 9b5f8875593a94337da0c12a5e26735aa9dd2afc
SHA512 79e04451796c537e02d65f6959f15a27a29bbb14ba5274b35b39c2c734b504fe1342a7a793c5ad34c4c8f9d4536789e24cc0392f8d6dd12726c07b44759a933c
TLSH
T178615521441869738BECE044E37B7F848DDE33DB58871F8A656A8D6442E8878578B24B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs.js
Size 6KB
SHA256 606b97343df542cafa8632a444ec0c37f9153cbeead48fdd726032a703b28a15
MD5 87f3715ef851941a9ae607480953abdd
SHA1 08557624d16f06bd583c8d36790fedc10cdf5372
SHA512 1c46efae93295a46e742d01c5f350972f2fd9280281c0114be1bc057a99d9d45ee43b0581ad4af60a5c32a1b1068c7abb862d06ad85ef0f35d683649498b51e8
SSDEEP 96:xHcUTU1qGqQfA151zS/SSlZdv9j8nJH9zzBw88H8L4cnc1qGq:C4RQfA15CSSW9zzBw88e
TLSH
T165E12F789408CB6F74B677ACAC6888316AB2413BB7BF68D710B55485054CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.5MB
SHA256 a1e6eeb4239d612904ac36a1789233fdd0d5d3a9e9fc494c7c0e3740c16cec41
MD5 f50f7d0fc4e717aee929ef66eda55e4a
SHA1 9e441aeffc4a56e606aed75e8cf0d7b59b9d02f3
SHA512 2a63e93a749615b4a515e2cadde1a7ff34feef0697c635bf17a951526a38a8545a4c2eeff19e9b793f3b33499887a88b6767de24fc04d747d7fa9742452d97fd
SSDEEP 49152:gIbfpQBfzagT0lbDoYsO1g/iHbZMClFT+tDaglO8:nbfpQBfzag81SiHbZz/TW2CO
TLSH
T1612639E860D1A257F3814073B64553EB21FFD00C6037DE084BA956E9A4B8CDF9E16B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZKyNmFX.exe

Path C:\Users\Admin\AppData\Roaming\ZKyNmFX.exe
Size 1.4MB
SHA256 a1a64e53591cc747ca8a9b906bc83ea3d6394aba5fa6a0d7a4a4acc725407a5e
MD5 1348b61498226312efc6de0c4b30bee6
SHA1 c7a3c9f19bee1dcb92f7db25dda92a00ba73e226
SHA512 d4776d05b96073cbea3b2bbcda19f21fe00b887827587747f0daa9e70474e2f44d520e0e3fcb723ed13efff51914dfa7489b086896e427476619701c73cab206
SSDEEP 24576:JIFzrn0Az7LHPmMWsj8HmfDtO8pDhArGorxZnOkcPZaIF6lP5CZMX+vTKnCPTsBo:JIFzrn0SPmMxBOIdArRZOkUa9152TNbv
TLSH
T16765231D6348C167D0572F391E32F9B407768CDD4912D24A9FF9ADB73836BA22E007A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_installer.log

Path C:\Windows\SystemTemp\msedge_installer.log
Size 126KB
SHA256 6fb7f2f621e8197badd8a62e8f7fca5d5e543a16b27b9f337845837307106b1a
MD5 0dbc686157b4d2b038ff98bf8aff5859
SHA1 5beaf08226fa4e5e3a8f96e144ee00efa3e01732
SHA512 0d3c4569a25e5b1d72a709ed5e3560a70dbb5e839b3904a3e213bca1ed3200d73c507edd57551e94cb5eb97a7d9dd7b2c4d3d3a2a99f0860f2a618beda593f5f
SSDEEP 3072:FfvbHEezCH413Eq2EtJkS4hLvfwFx+BTqRfA:Ffvbt3Eq2Et+hLv4Fx+BTqRfA
TLSH
T161C344503F2642FB2B44AEBF16C33B3966BE1283D1C41BE53E599444F1C69B6113F4AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/948-1801-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Download

memory/1128-85-0x000001EE3EAE0000-0x000001EE3EC52000-memory.dmp

Download

memory/1308-8-0x00000000071A0000-0x00000000072F0000-memory.dmp

Download

memory/1308-7-0x00000000051D0000-0x00000000051E0000-memory.dmp

Download

memory/1308-6-0x00000000052A0000-0x00000000052AE000-memory.dmp

Download

memory/1308-5-0x0000000004F10000-0x0000000004F1A000-memory.dmp

Download

memory/1308-1-0x0000000005490000-0x0000000005A36000-memory.dmp

Download

memory/1308-2-0x0000000004F80000-0x0000000005012000-memory.dmp

Download

memory/1308-0-0x00000000002E0000-0x0000000000452000-memory.dmp

Download

memory/1308-3-0x0000000005020000-0x00000000050BC000-memory.dmp

Download

memory/1308-4-0x00000000051D0000-0x00000000051E0000-memory.dmp

Download

memory/1924-63-0x0000000006770000-0x00000000067E6000-memory.dmp

Download

memory/1924-65-0x00000000067F0000-0x0000000006840000-memory.dmp

Download

memory/1924-20-0x0000000006560000-0x00000000065C6000-memory.dmp

Download

memory/1924-16-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/1924-69-0x0000000006510000-0x000000000652E000-memory.dmp

Download

memory/1924-67-0x0000000006FC0000-0x00000000074EC000-memory.dmp

Download

memory/1924-57-0x0000000006640000-0x00000000066F2000-memory.dmp

Download

memory/1924-19-0x0000000005880000-0x0000000005890000-memory.dmp

Download

memory/1924-400-0x0000000005880000-0x0000000005890000-memory.dmp

Download

memory/1924-62-0x00000000068C0000-0x0000000006A82000-memory.dmp

Download

memory/1964-1640-0x0000000007580000-0x0000000007595000-memory.dmp

Download

memory/1964-1572-0x0000000007210000-0x00000000072B4000-memory.dmp

Download

memory/1964-1526-0x0000000005B60000-0x0000000005EB7000-memory.dmp

Download

memory/1964-1544-0x0000000006540000-0x000000000658C000-memory.dmp

Download

memory/1964-1565-0x0000000071180000-0x00000000711CC000-memory.dmp

Download

memory/1964-1587-0x0000000007540000-0x0000000007551000-memory.dmp

Download

memory/2708-35-0x0000019ABDDE0000-0x0000019ABDE02000-memory.dmp

Download

memory/2708-44-0x0000019AA4F30000-0x0000019AA59F2000-memory.dmp

Download

memory/4452-59-0x00000000079E0000-0x0000000007A76000-memory.dmp

Download

memory/4452-54-0x0000000007610000-0x00000000076B4000-memory.dmp

Download

memory/4452-21-0x0000000005550000-0x0000000005572000-memory.dmp

Download

memory/4452-15-0x0000000002D70000-0x0000000002D80000-memory.dmp

Download

memory/4452-14-0x0000000002D70000-0x0000000002D80000-memory.dmp

Download

memory/4452-13-0x0000000002BF0000-0x0000000002C26000-memory.dmp

Download

memory/4452-22-0x00000000055F0000-0x0000000005656000-memory.dmp

Download

memory/4452-29-0x0000000005F10000-0x0000000006267000-memory.dmp

Download

memory/4452-37-0x0000000006410000-0x000000000642E000-memory.dmp

Download

memory/4452-38-0x0000000006460000-0x00000000064AC000-memory.dmp

Download

memory/4452-45-0x00000000069F0000-0x0000000006A24000-memory.dmp

Download

memory/4452-18-0x0000000005760000-0x0000000005D8A000-memory.dmp

Download

memory/4452-53-0x00000000075E0000-0x00000000075FE000-memory.dmp

Download

memory/4452-46-0x0000000070D70000-0x0000000070DBC000-memory.dmp

Download

memory/4452-55-0x0000000007D90000-0x000000000840A000-memory.dmp

Download

memory/4452-56-0x0000000007750000-0x000000000776A000-memory.dmp

Download

memory/4452-58-0x00000000077D0000-0x00000000077DA000-memory.dmp

Download

memory/4452-60-0x0000000007960000-0x0000000007971000-memory.dmp

Download

memory/4452-68-0x0000000007A90000-0x0000000007A98000-memory.dmp

Download

memory/4452-61-0x00000000079A0000-0x00000000079AE000-memory.dmp

Download

memory/4452-64-0x00000000079B0000-0x00000000079C5000-memory.dmp

Download

memory/4452-66-0x0000000007AA0000-0x0000000007ABA000-memory.dmp

Download

memory/5976-1854-0x0000000000E30000-0x0000000000E31000-memory.dmp

Download

memory/5976-1745-0x0000000000E20000-0x0000000000E21000-memory.dmp

Download