phantom_stealer | 526b7a0818ae4823ecd17ba12a14114eba90ea5f6100e569b6cf60a95a70e9f7

Analysis

max time kernel
299s
max time network
38s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
REMITTANCAE COPY.jpq.js
Size 4.4MB
Sample260629-tpqqcshv7x
SHA256 526b7a0818ae4823ecd17ba12a14114eba90ea5f6100e569b6cf60a95a70e9f7
MD5 11f15a1ebef7db1f191da4c3f7d24f8c
SHA1 244248290a03d895c5df88fbc177d6e7540a2d6c
SHA512 9dc30fe35911b6d6521ecea60899e383fe8de453806b630880115ff918d33a6c7d6282227688784245d51ca4ff91eaa67e2067a08ec0b0bf7beadd74b52d28ec
SSDEEP 49152:FrCKYHhTaf0LL2cy7sAlFsRWAz3GWOFmAYzm3RKqV40YfLxQke1c:M
TLSH
T19626F1118AC42FA5CFAD5B1C90FE160EE3F00A8E9416698AEB33BD46FFE750451171B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution phantom_stealer persistence stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
exczx.com
Port
587
Username
[email protected]
Password
at_I45@TzhxT=U},
Email to
[email protected]

Mutex

4BI8FC7UM2M71VZJVS1V

Attributes

anti_analysis
0
cb_enables_ssl
1
debug
0
keylogger
0
start_delay
0
startup
0

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 1 IoCs

resource	yara_rule
behavioral2/memory/3844-28-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1844	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	icanhazip.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1844 set thread context of 3844	1844	powershell.exe	94

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4588	chrome.exe
2124	msedge.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	aspnet_compiler.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4600	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
3844	aspnet_compiler.exe
3844	aspnet_compiler.exe
3844	aspnet_compiler.exe
6008	chrome.exe
6008	chrome.exe
1844	powershell.exe
1844	powershell.exe
3844	aspnet_compiler.exe
3844	aspnet_compiler.exe
3844	aspnet_compiler.exe
3844	aspnet_compiler.exe
3844	aspnet_compiler.exe
3844	aspnet_compiler.exe
3844	aspnet_compiler.exe
3844	aspnet_compiler.exe
3844	aspnet_compiler.exe
2704	firefox.exe
2704	firefox.exe
2704	firefox.exe
2704	firefox.exe
2704	firefox.exe
2704	firefox.exe
2704	firefox.exe
2704	firefox.exe
2704	firefox.exe
2704	firefox.exe
2704	firefox.exe
2704	firefox.exe
2704	firefox.exe
2704	firefox.exe
2704	firefox.exe
2704	firefox.exe
1844	powershell.exe
3844	aspnet_compiler.exe
3844	aspnet_compiler.exe
3844	aspnet_compiler.exe
3844	aspnet_compiler.exe
1844	powershell.exe
1844	powershell.exe
3844	aspnet_compiler.exe
3844	aspnet_compiler.exe
3844	aspnet_compiler.exe
3844	aspnet_compiler.exe
3844	aspnet_compiler.exe
3844	aspnet_compiler.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1844	powershell.exe
Token: SeDebugPrivilege	3844	aspnet_compiler.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeDebugPrivilege	4600	taskkill.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
6008	chrome.exe
6008	chrome.exe
2704	firefox.exe
2704	firefox.exe
2704	firefox.exe
2704	firefox.exe
2704	firefox.exe
2704	firefox.exe
2704	firefox.exe
2704	firefox.exe
3168	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2704	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5984 wrote to memory of 1844	5984	wscript.exe	87
PID 1844 wrote to memory of 3576	1844	powershell.exe	89
PID 1844 wrote to memory of 5032	1844	powershell.exe	90
PID 1844 wrote to memory of 4920	1844	powershell.exe	91
PID 1844 wrote to memory of 3680	1844	powershell.exe	92
PID 1844 wrote to memory of 5556	1844	powershell.exe	93
PID 1844 wrote to memory of 3844	1844	powershell.exe	94
PID 1844 wrote to memory of 3844	1844	powershell.exe	94
PID 1844 wrote to memory of 3844	1844	powershell.exe	94
PID 1844 wrote to memory of 3844	1844	powershell.exe	94
PID 1844 wrote to memory of 3844	1844	powershell.exe	94
PID 3844 wrote to memory of 6008	3844	aspnet_compiler.exe	96
PID 6008 wrote to memory of 3196	6008	chrome.exe	97
PID 6008 wrote to memory of 4668	6008	chrome.exe	98
PID 6008 wrote to memory of 4588	6008	chrome.exe	99
PID 6008 wrote to memory of 1568	6008	chrome.exe	100
PID 6008 wrote to memory of 992	6008	chrome.exe	101
PID 6008 wrote to memory of 1536	6008	chrome.exe	102
PID 6008 wrote to memory of 2980	6008	chrome.exe	103
PID 6008 wrote to memory of 3372	6008	chrome.exe	104
PID 3844 wrote to memory of 1568	3844	aspnet_compiler.exe	100
PID 6008 wrote to memory of 5176	6008	chrome.exe	105
PID 3844 wrote to memory of 1568	3844	aspnet_compiler.exe	100
PID 3844 wrote to memory of 4668	3844	aspnet_compiler.exe	98
PID 6008 wrote to memory of 2092	6008	chrome.exe	106
PID 6008 wrote to memory of 2832	6008	chrome.exe	107
PID 3844 wrote to memory of 4668	3844	aspnet_compiler.exe	98
PID 3844 wrote to memory of 6008	3844	aspnet_compiler.exe	96
PID 3844 wrote to memory of 6008	3844	aspnet_compiler.exe	96
PID 6008 wrote to memory of 848	6008	chrome.exe	108
PID 3844 wrote to memory of 4588	3844	aspnet_compiler.exe	99
PID 3844 wrote to memory of 4588	3844	aspnet_compiler.exe	99
PID 6008 wrote to memory of 428	6008	chrome.exe	109
PID 3844 wrote to memory of 3196	3844	aspnet_compiler.exe	97
PID 3844 wrote to memory of 3196	3844	aspnet_compiler.exe	97
PID 3844 wrote to memory of 1568	3844	aspnet_compiler.exe	100
PID 3844 wrote to memory of 1568	3844	aspnet_compiler.exe	100
PID 3844 wrote to memory of 1536	3844	aspnet_compiler.exe	102
PID 3844 wrote to memory of 1536	3844	aspnet_compiler.exe	102
PID 3844 wrote to memory of 4668	3844	aspnet_compiler.exe	98
PID 3844 wrote to memory of 4668	3844	aspnet_compiler.exe	98
PID 3844 wrote to memory of 2092	3844	aspnet_compiler.exe	106
PID 3844 wrote to memory of 2092	3844	aspnet_compiler.exe	106
PID 3844 wrote to memory of 6008	3844	aspnet_compiler.exe	96
PID 3844 wrote to memory of 6008	3844	aspnet_compiler.exe	96
PID 3844 wrote to memory of 848	3844	aspnet_compiler.exe	108
PID 3844 wrote to memory of 848	3844	aspnet_compiler.exe	108
PID 3844 wrote to memory of 4588	3844	aspnet_compiler.exe	99
PID 3844 wrote to memory of 4588	3844	aspnet_compiler.exe	99
PID 3844 wrote to memory of 5176	3844	aspnet_compiler.exe	105
PID 3844 wrote to memory of 5176	3844	aspnet_compiler.exe	105
PID 3844 wrote to memory of 428	3844	aspnet_compiler.exe	109
PID 3844 wrote to memory of 428	3844	aspnet_compiler.exe	109
PID 3844 wrote to memory of 3196	3844	aspnet_compiler.exe	97
PID 3844 wrote to memory of 3196	3844	aspnet_compiler.exe	97
PID 3844 wrote to memory of 2980	3844	aspnet_compiler.exe	103
PID 3844 wrote to memory of 2980	3844	aspnet_compiler.exe	103
PID 3844 wrote to memory of 3372	3844	aspnet_compiler.exe	104
PID 3844 wrote to memory of 3372	3844	aspnet_compiler.exe	104
PID 3844 wrote to memory of 2832	3844	aspnet_compiler.exe	107
PID 3844 wrote to memory of 2832	3844	aspnet_compiler.exe	107
PID 3844 wrote to memory of 1568	3844	aspnet_compiler.exe	100
PID 3844 wrote to memory of 1568	3844	aspnet_compiler.exe	100
PID 3844 wrote to memory of 1536	3844	aspnet_compiler.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\REMITTANCAE COPY.jpq.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:5984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File "C:\Temp\ps_PKkaPGDOaVlw_1782749660126.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:3576
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5032
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4920
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:3680
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5556
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:3844
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hqmotvol.icz"
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:6008
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\hqmotvol.icz /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\hqmotvol.icz\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\hqmotvol.icz --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff99142c728,0x7ff99142c734,0x7ff99142c740
        5⤵
        
        PID:3196
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hqmotvol.icz" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1648,i,8203944738242210192,14754608245205808757,262144 --field-trial-handle=1884,i,15626761138210717651,15577578916685499827,262144 --variations-seed-version --mojo-platform-channel-handle=1880 /prefetch:2
        5⤵
        
        PID:4668
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hqmotvol.icz" --force-high-res-timeticks=disabled --metrics-shmem-handle=1960,i,8473918471712944900,8110558904581086786,524288 --field-trial-handle=1884,i,15626761138210717651,15577578916685499827,262144 --variations-seed-version --mojo-platform-channel-handle=1968 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4588
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hqmotvol.icz" --force-high-res-timeticks=disabled --metrics-shmem-handle=2104,i,423092036455886869,3720056201701079825,524288 --field-trial-handle=1884,i,15626761138210717651,15577578916685499827,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:13
        5⤵
        
        PID:1568
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hqmotvol.icz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2932,i,6613730827876289643,3138146083500004321,2097152 --field-trial-handle=1884,i,15626761138210717651,15577578916685499827,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:1
        5⤵
        
        PID:992
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hqmotvol.icz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2936,i,7093420743292349558,10062037639860860124,2097152 --field-trial-handle=1884,i,15626761138210717651,15577578916685499827,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:1
        5⤵
        
        PID:1536
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hqmotvol.icz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3184,i,15487013380530370264,6103256306416422079,2097152 --field-trial-handle=1884,i,15626761138210717651,15577578916685499827,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:1
        5⤵
        
        PID:2980
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hqmotvol.icz" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3212,i,198665356901250010,14335189991855731222,2097152 --field-trial-handle=1884,i,15626761138210717651,15577578916685499827,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:9
        5⤵
        
        PID:3372
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hqmotvol.icz" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3952,i,17911805645589885439,543442741560656980,2097152 --field-trial-handle=1884,i,15626761138210717651,15577578916685499827,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:9
        5⤵
        
        PID:5176
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hqmotvol.icz" --force-high-res-timeticks=disabled --metrics-shmem-handle=4208,i,5985042445214022363,9809455169024895492,524288 --field-trial-handle=1884,i,15626761138210717651,15577578916685499827,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:14
        5⤵
        
        PID:2092
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hqmotvol.icz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4364,i,7089807242459399655,17401345738827385057,2097152 --field-trial-handle=1884,i,15626761138210717651,15577578916685499827,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
        5⤵
        
        PID:2832
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hqmotvol.icz" --force-high-res-timeticks=disabled --metrics-shmem-handle=4644,i,6719648899681322220,11174406371122251703,524288 --field-trial-handle=1884,i,15626761138210717651,15577578916685499827,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:14
        5⤵
        
        PID:848
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hqmotvol.icz" --force-high-res-timeticks=disabled --metrics-shmem-handle=4748,i,17635936848306367906,18118348232099619732,524288 --field-trial-handle=1884,i,15626761138210717651,15577578916685499827,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:14
        5⤵
        
        PID:428
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\opsel2kd.aqf"
      4⤵
      PID:2672
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\opsel2kd.aqf
        5⤵
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:2704
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1940 -prefsLen 27097 -prefMapHandle 1944 -prefMapSize 270331 -ipcHandle 2028 -initialChannelId {a214d259-4ec6-449e-9db5-7dab211c23d7} -parentPid 2704 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2704" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        6⤵
        
        PID:2836
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2220 -prefsLen 27133 -prefMapHandle 2300 -prefMapSize 270331 -ipcHandle 2288 -initialChannelId {5ed4144c-fe2d-4837-808d-36eb390d4fd3} -parentPid 2704 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2704" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        6⤵
        
        PID:2172
      - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a353f06a-8f9c-49a3-a214-b483b0e064cc.dmp"
        6⤵
        
        PID:4336
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2796 -prefsLen 27133 -prefMapHandle 2800 -prefMapSize 270331 -ipcHandle 2664 -initialChannelId {a7610d1c-21ac-43f5-84f2-d5d6710f1bd3} -parentPid 2704 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2704" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        6⤵
        
        PID:900
      - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3d5e6060-cd14-4f40-9dc5-971c0795aff2.dmp"
        6⤵
        
        PID:1472
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3032 -prefsLen 27133 -prefMapHandle 3036 -prefMapSize 270331 -ipcHandle 3044 -initialChannelId {51693c0c-55f5-439f-9ac3-b752d92531d8} -parentPid 2704 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2704" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        6⤵
        
        PID:2816
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3904 -prefsLen 27323 -prefMapHandle 3908 -prefMapSize 270331 -jsInitHandle 3912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3920 -initialChannelId {debd2edf-f23a-4d6c-abe0-4352cbe859a7} -parentPid 2704 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2704" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        6⤵
        Checks processor information in registry
        
        PID:1416
      - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1e87e0c9-4c0d-4df5-ae36-5ca9a442cfbd.dmp"
        6⤵
        
        PID:2876
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3620 -prefsLen 27323 -prefMapHandle 3616 -prefMapSize 270331 -ipcHandle 3960 -initialChannelId {7223de76-c67b-4b44-95a2-4944054b4531} -parentPid 2704 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2704" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        6⤵
        
        PID:2456
      - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2567be95-4e81-4600-99a4-e844586f1f44.dmp"
        6⤵
        
        PID:5624
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4108 -prefsLen 27323 -prefMapHandle 4124 -prefMapSize 270331 -ipcHandle 2008 -initialChannelId {0a368e19-2281-463d-8b7f-1405ba72f4e0} -parentPid 2704 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2704" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 rdd
        6⤵
        
        PID:5988
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2848 -prefsLen 34822 -prefMapHandle 3184 -prefMapSize 270331 -jsInitHandle 3012 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2604 -initialChannelId {d8e6402f-a7ee-4202-98fa-30d32a241cb2} -parentPid 2704 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2704" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        6⤵
        Checks processor information in registry
        
        PID:6088
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5012 -prefsLen 34929 -prefMapHandle 5016 -prefMapSize 270331 -ipcHandle 3284 -initialChannelId {d55ca124-6a45-489f-87aa-8dea82db5aba} -parentPid 2704 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2704" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        6⤵
        Checks processor information in registry
        
        PID:1588
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2708 -prefsLen 32871 -prefMapHandle 4828 -prefMapSize 270331 -jsInitHandle 5272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5280 -initialChannelId {44c793b0-f6a5-4733-9ec2-c2554eb2b0a1} -parentPid 2704 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2704" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        6⤵
        Checks processor information in registry
        
        PID:3916
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5408 -prefsLen 32871 -prefMapHandle 5404 -prefMapSize 270331 -jsInitHandle 2708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5272 -initialChannelId {21fda62d-ad23-4efd-a125-3b60931326fd} -parentPid 2704 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2704" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        6⤵
        Checks processor information in registry
        
        PID:3248
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5308 -prefsLen 32871 -prefMapHandle 2720 -prefMapSize 270331 -jsInitHandle 4820 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5484 -initialChannelId {1e7e2fcf-4f78-489c-8291-7cd6268dff66} -parentPid 2704 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2704" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        6⤵
        Checks processor information in registry
        
        PID:1524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj"
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:3168
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x324,0x7ff98dddc188,0x7ff98dddc194,0x7ff98dddc1a0
        5⤵
        
        PID:1708
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1748,i,3540038347315037457,13665507640421771941,262144 --field-trial-handle=2260,i,7876780603089300840,13883571891502187987,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
        5⤵
        
        PID:4288
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,8704095651572473794,14030678156213676210,524288 --field-trial-handle=2260,i,7876780603089300840,13883571891502187987,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,5629172745625918339,13796074774893112229,524288 --field-trial-handle=2260,i,7876780603089300840,13883571891502187987,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:13
        5⤵
        
        PID:6048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3216,i,13669472982315502243,7659971451263466781,2097152 --field-trial-handle=2260,i,7876780603089300840,13883571891502187987,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1
        5⤵
        
        PID:3272
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3220,i,1950804648789097005,2963948041333673585,2097152 --field-trial-handle=2260,i,7876780603089300840,13883571891502187987,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
        5⤵
        
        PID:2540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,4043758445520274518,13031393777451180259,524288 --field-trial-handle=2260,i,7876780603089300840,13883571891502187987,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:14
        5⤵
        
        PID:2848
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,7040246206731187451,10887677419298081725,524288 --field-trial-handle=2260,i,7876780603089300840,13883571891502187987,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:14
        5⤵
        
        PID:3628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,1483817484497864890,10645827363049890149,524288 --field-trial-handle=2260,i,7876780603089300840,13883571891502187987,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:14
        5⤵
        
        PID:1244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3764,i,9451122546387270604,9725839857409069640,2097152 --field-trial-handle=2260,i,7876780603089300840,13883571891502187987,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:1
        5⤵
        
        PID:2924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3800,i,5730211177879134262,12986692590442001505,2097152 --field-trial-handle=2260,i,7876780603089300840,13883571891502187987,262144 --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:9
        5⤵
        
        PID:5036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3836,i,13359704366833843688,4967268428310393004,2097152 --field-trial-handle=2260,i,7876780603089300840,13883571891502187987,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1
        5⤵
        
        PID:2256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3876,i,17151317561513554480,15482391367622752886,2097152 --field-trial-handle=2260,i,7876780603089300840,13883571891502187987,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:9
        5⤵
        
        PID:1072
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3912,i,18236398795402216681,15785208443097705646,2097152 --field-trial-handle=2260,i,7876780603089300840,13883571891502187987,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:1
        5⤵
        
        PID:5376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3940,i,17747267407818944917,15904262072809961040,2097152 --field-trial-handle=2260,i,7876780603089300840,13883571891502187987,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:9
        5⤵
        
        PID:5612
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3980,i,13739674250682955137,152107462271016914,2097152 --field-trial-handle=2260,i,7876780603089300840,13883571891502187987,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:1
        5⤵
        
        PID:5644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4016,i,17180466163885026594,6570896573881055362,2097152 --field-trial-handle=2260,i,7876780603089300840,13883571891502187987,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:9
        5⤵
        
        PID:4828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4060,i,17967429063758092346,7359343609031409976,2097152 --field-trial-handle=2260,i,7876780603089300840,13883571891502187987,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
        5⤵
        
        PID:3028
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4076,i,18207981807613071822,4313521770488667772,2097152 --field-trial-handle=2260,i,7876780603089300840,13883571891502187987,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:9
        5⤵
        
        PID:2864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4180,i,10116163688286082548,13959687720735012772,524288 --field-trial-handle=2260,i,7876780603089300840,13883571891502187987,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
        5⤵
        
        PID:2464
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1152
        6⤵
        
        PID:4560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,15436139072699164094,1079246428442248273,524288 --field-trial-handle=2260,i,7876780603089300840,13883571891502187987,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
        5⤵
        
        PID:5960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,17115652977520564344,7149219729918742304,524288 --field-trial-handle=2260,i,7876780603089300840,13883571891502187987,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:14
        5⤵
        
        PID:4740
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=628
        6⤵
        
        PID:4136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,8703377823043403422,18147753838865878203,524288 --field-trial-handle=2260,i,7876780603089300840,13883571891502187987,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:14
        5⤵
        
        PID:3796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,16894979852377828217,15277606740951981215,524288 --field-trial-handle=2260,i,7876780603089300840,13883571891502187987,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
        5⤵
        
        PID:6096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,8766246794030539029,6135394803595523849,524288 --field-trial-handle=2260,i,7876780603089300840,13883571891502187987,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
        5⤵
        
        PID:5872
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,7042377346416557912,13262991478740512832,524288 --field-trial-handle=2260,i,7876780603089300840,13883571891502187987,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
        5⤵
        
        PID:4948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,7042377346416557912,13262991478740512832,524288 --field-trial-handle=2260,i,7876780603089300840,13883571891502187987,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
        5⤵
        
        PID:5924
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im wscript.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ps_PKkaPGDOaVlw_1782749660126.ps1

Path C:\Temp\ps_PKkaPGDOaVlw_1782749660126.ps1
Size 3.2MB
SHA256 078ea0db652b8e84dfa4e1f31c7e8b8fb16b1a6153da43b9726a3199e0abf924
MD5 9b3bf587f9307abdf705b197d9761635
SHA1 757c3b479cf33f554ad3de27223aab95e9e13538
SHA512 b31805fdda39cac9459b060d1ef5e2fd9582faec9e001f787e39f78cb267c0f8f6d68fc794760b38c108982ffdd74748a8e21582bb247e7d217a06b87e4bb559
SSDEEP 49152:pN4nhKMebs1d7n3priWRbxJ5H8Pemn610ids5uNygrL5a6wqoR7:h
TLSH
T12BF533B0BFE86EBD45A4D33957BF2E3812E54F16C059B0DBA16610C3548FF858317A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj\Crashpad\settings.dat
Size 280B
SHA256 28e9647415d5485f2e692165d740c237ee37f77d4219c9fcf2744ed15d119096
MD5 9b559a8cb81c500243abf134c3a4de67
SHA1 bf001fef8b13c94be5e0c4d936a0b01c663ffead
SHA512 d4a957385f70dcc068e810ccc7e8e4652e2e38557dbc87a8cc1851168b254833539fc86f9dbd5994ba1cd680393a10138d56a5369f5155af7319528deb9c9d10
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj\Crashpad\settings.dat
Size 280B
SHA256 8390f003bb41ed70648d8194da1513090dd230b98395c519b5b0a78d633099f7
MD5 cc156eb6ebdddefe21808470a20258b5
SHA1 ef2d60418002b3885bc36dfacd9c2d4ccd09a768
SHA512 9da2261841c0885a40ba19effa512f546c064e086b092e5db55e6dfd286efdead53053105cee1664c25a7fc120c2cc55163c8c753a929e33b99b9144e269df4d
TLSH
T1EDD02230F3F0AA8CE302E33030F883808CA0B8C00B0A800000030A000CFC2F0B8CA000
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 9f5d12e346d517b8314ab24f15a3baa667cd88f5cf9cda49e55031948580551d
MD5 f9043f33b7e3b907e913c3c59bc336b2
SHA1 8e79cec5ea3a22d872134f6bb64ddf4f53d155a7
SHA512 375e713b011a0817576f7719f8fb71a529733aff0a5a7861558e7d4c9ccfbc7cab0880cb5059f5db14de973f5a0933ba16ca497bd9afb2db5d3fc9d109c16b1b
TLSH
T19DD0C2E62AB50418DEBF9AD27472519441027C558948EC89011D739350F12563817C95
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 fd365fe800abc34f9701ecc1856b6c7293e9a9afe0bdd020279fe28abfcca418
MD5 355221ec9976eca0be221e35bb04addc
SHA1 2736439d56e0682a2ccf22680e789788c92afc06
SHA512 45224802220dcb9925d509d84b111838cced9cc0c37ed23a9edbef8abfd3313dd02d61d2da0c4b8357b5a69c652cb10069989387a4d0bf9f82de8afd35578d3f
TLSH
T1B9E06FB62FF21814EE7FEAD6347250880A427C84C408FC8F811AB2D710F2245388ACA5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58de26.TMP

Path C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe58de26.TMP
Size 153B
SHA256 6c271226ad123b53513fa9af76cb17532cca4e50ded57b459d9d4a7911adc2e5
MD5 3590e4cb2739b1e1a6051b0fb6e79138
SHA1 5ace612c0fa75f90a65f0370d42fbe2a5f6ee67e
SHA512 5123b69c5a004e425bf2f5907aee461b26f9de47f3f590c3d9f4b4ae522b35b12fbe71be0da122f1581862d3de49ae4f3f9f3445f690e424cfc066e2539150a5
TLSH
T1A5C08CB71E740404DA2A92D2117218E882127C898944EC89401E72C320B02A2782BCA0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj\Local State
Size 3KB
SHA256 93218194c8af0eb8553223cb1bb7d4d152ace4b1424b6b6f63a1a42ff3a1749f
MD5 75aaea7b9614498041916004c1956890
SHA1 3c171cfaa693efb67034fd8caaffc4776570494a
SHA512 2a63d0055733dd7f7fb88e2dcbca2b50606838970032f4fa07417577892713b7f82e2a9fa856b7e93be39d4dfd09dac3e82db288ee656b911f61a333cec4cb0d
TLSH
T12581D7727434EC2756E59644B98A36939E7430B3ED15EF94E6E9630C05EF34C2B0A83B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj\Local State
Size 4KB
SHA256 90fa6eb304809560839ae4f1c8570549604e388ceae76d0439a95fd2e8fea755
MD5 72a72a840171732a94976a335fc6975a
SHA1 50373209b720efb445195cef5258ac22641ccbe7
SHA512 69838a43b51991eb45a818dbbce87ea5602a25350263fa88d33e36ec7fce650cdcdb92bd383d11df03ef704998ad048a65344e001749578a76e1eee5a8283968
SSDEEP 96:sqGNkPwQsFfYsTY8i58Frh/cInURoDotovNobDfBuKvQhFaAzt0eUnNFCq4a:3GNEWrooDUwKpyztqN1
TLSH
T1F4A1B9727434EC271AF5E904B9CA3752AEA43073E855BFD8D6E9170C05DB3882749C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58d387.TMP

Path C:\Users\Admin\AppData\Local\Temp\4q21mz1l.qnj\Local State~RFe58d387.TMP
Size 1KB
SHA256 c94ad32a8ddb430558e0c600cd0d23390d9452438e259ed4b683994e406c7180
MD5 edc793a5e3da63177d9a32945340361f
SHA1 17345e04923a76cffe7015e2ff051933900351b9
SHA512 be6b0efc28a0086f86d5fe4cbf7812f76556dd0a74a7e01b118da2a78ac4e53fa943a86b9854fed6ae719ad520c406458aceaaf2c396fb514607bc7e0351b2fa
TLSH
T12F317372B9342D3BB9A08745768EAB175E706032D165A98492ED260C07EB6CC6619C3F
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_4yjgtpft.cyw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4yjgtpft.cyw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\hqmotvol.icz\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\hqmotvol.icz\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\hqmotvol.icz\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\hqmotvol.icz\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\hqmotvol.icz\ShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\hqmotvol.icz\ShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\hqmotvol.icz\ShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 1fe4ea4ddf649aba316a8db54de3b5726edca605dc5d4a59c4de9a49cf0feb92
MD5 1521b815f56b5f04feacb16775d7114c
SHA1 e259c5fe6f4d218b0228618bce3460cb113f6392
SHA512 68057b18fda60400398964da836cf9234fc9e4c32d08a72d4cf6dd8ea91d8460dbec53337eddc60d64256b5b56897cf7256f7f48a75df8af041ac903e49b01ba
SSDEEP 48:b1RdO5nMeZk4vdJ9zCNYGDdLXuHspB8RdO5nMeZk4vdJ9zvYGogdLXuHZ52R:byvJoxuMnjvJvQIu5a
TLSH
T103911E106FE50946F2F3ED7295737B12AB7BBE195A088A0E048552090C71B08C6FEFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e87e0c9-4c0d-4df5-ae36-5ca9a442cfbd.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1e87e0c9-4c0d-4df5-ae36-5ca9a442cfbd.dmp
Size 76KB
SHA256 11f7b89b93b5163cf50c75e789ecbe20f4eac73b94b5a14543c00bffb8d5ed1b
MD5 35b5dddfe1348133cf47e3556b709755
SHA1 d37c88072711d1757705b375a9cc89dcfe833394
SHA512 fa716cfcbf6260eca1cc444b667aecedafab3482d904d73231852d8a8dc174feab5db03ef5063c163e8bf7553ab7fe1dda09b69d7cdb190a507b5084cd1b548a
SSDEEP 384:LDk3Pd3VtuXEsMkF5Wk06+wOaNtbWm4ClESAPakAVrfkYEGKYKU65T39idv:83Pd335kFgBy9XkAVrfGL9idv
TLSH
T1067383225790883ED1368F3B5BE7B7053BFAE81E0B93A35B4654816EDCA37846D31E11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e87e0c9-4c0d-4df5-ae36-5ca9a442cfbd.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1e87e0c9-4c0d-4df5-ae36-5ca9a442cfbd.extra
Size 10KB
SHA256 8693e1f3fb6d24ec3a003791bc5ef4b00ab9c9e36da3e0dd940e636a40afac16
MD5 84b3a513cad71efc6ca2d56f84d26103
SHA1 2ae1e5fb1bfa7e9486e4f5dde4201381ffd6e17d
SHA512 0ee0d0208c3d80ce123853aa50f8fcd400c0edac058a4923a9540d9b9f22fe2433b9ba7f1f2ec2d3993081ce0b295d8bdb1e133896a87de5926d1d2377eacc66
SSDEEP 96:SEWCqnToAIY6pw6mJFFd8H0Rh7CsevBb1d0rjMLlIrLlhTLlaXv7a6OKtILfcBCM:SaqTdLFSG7uvZ8HLJxsPywlFnfos
TLSH
T14C228353878724B79D5194C4BC30AE7C45EC6FAA61F958A802CC4D47FA464F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e87e0c9-4c0d-4df5-ae36-5ca9a442cfbd.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1e87e0c9-4c0d-4df5-ae36-5ca9a442cfbd.extra
Size 10KB
SHA256 160277a6f20a565e6b67b8aa217e194a12e493a7279ac73a683b4b84c96a67d4
MD5 0d820b20f64399887618d134f848c658
SHA1 cbaa3c1e04ac67e45f9a4e43fbeded1ddaebf115
SHA512 2282b4592379c895054f09e3b87b9dcd1e0c83178f008a77ca6c8d6acd66a86bb1377969eebec375231dd5aa0d1ebbf745857b62f9dce1b02ac350b757d09e4a
SSDEEP 192:SaqccFgwiR4pDDnTYapdVxzP5WBHt4T/fKNUal9nfoEbLHL:hHcFgwiGDz1BWBHt4Txa/AEr
TLSH
T12322F832481CE837E7D7AC8EFA393E3AD66D7B1A10E6785C40CCCA89C1A54786778513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2567be95-4e81-4600-99a4-e844586f1f44.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2567be95-4e81-4600-99a4-e844586f1f44.dmp
Size 73KB
SHA256 a9e06bd415cb8ce10b8c1486e0b2cf617541a4a5aae9d5119c23f8fd4fbcaaa6
MD5 28dd21d71612821ccd4c32a79b3814bc
SHA1 f8318ed53e3ee574dd8aae15544d4348b6ed75f7
SHA512 d9b4f982c2508b621239ddf4181f53722915d807712a3f300d6e4eb8d9b2b05dab82d791db2a8ef338c42897637fa2b66df98b42a35a3384763d3e691c81b703
SSDEEP 768:i6a3Q3JkKS9Serm9k1iERghMCu2cBkBO0OG6Hup7L9idv:e3Q3JSoerik03MCu2woO0OhOp7L9o
TLSH
T1F9730E176F90497ED0A50B31ABE7B748BBF6F84A071B936B0251827EDC973486E70E11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2567be95-4e81-4600-99a4-e844586f1f44.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2567be95-4e81-4600-99a4-e844586f1f44.extra
Size 10KB
SHA256 de99508b0fd9760813969ad68d67f5369619f136052b81e117ffa87ac402090c
MD5 6e991b43f694019633f2216c20d76ff4
SHA1 a8543983fc3397ea2612a18bb4f099ce73b1e6ba
SHA512 03c8eb473c3f44fedc0f0c77a2adda0233456688bf2e48010437878a1045f04ec59f6e1d0b03ec9ee53a7dc859ee1f87f6be60bc556aac5782bd0ed15cb07167
SSDEEP 96:SEWCiJgToAIY6pw6mJFFd8H0Rh7CsevBb1d0rjMLlIrLlhTLlaXv7aWOKtILfcBX:SaiJsdLFSG7uvZ8HL9xsPywllffoU
TLSH
T1BF227353878724B7AD5194C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2567be95-4e81-4600-99a4-e844586f1f44.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2567be95-4e81-4600-99a4-e844586f1f44.extra
Size 10KB
SHA256 ee289ac538cc69c214f050f5acb5e3fc5b80fbe90a2df0e0727b1541afe17c4f
MD5 0f0383c8441da566d53580eab9c634a0
SHA1 5832f1af625db8d190fcb4f5755e2837aa8d7ec0
SHA512 a11d3e2c8a3da6dc313c471a2bafaf17624b7a345561ebd2964f27f8040742355ba047665ec3f0eb5fe769322db18eb5b17325020e645f5e973b597a9b776312
SSDEEP 192:SaiJNcFgwiR4pDDnTYapdVxzP5WBHf4T/fKNUaldffo8bL2L:hiHcFgwiGDz1BWBHf4TxarA82
TLSH
T18F32E832481CE837E7D7AC8EEA393E3AD66D7B1E10E6789C40CCCA49C1A54786779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d5e6060-cd14-4f40-9dc5-971c0795aff2.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3d5e6060-cd14-4f40-9dc5-971c0795aff2.dmp
Size 75KB
SHA256 72645d0440e217c17a96a359110e926ec07ffb428d20df87dd362891e307f03e
MD5 f37ca99e2acd4e08b108a1b3e73cdb8b
SHA1 c909f60d4d3374cade0fcb43d51e3ac8a613a836
SHA512 85efbf4fd8bce94557d5b900a7f3d6b1a6d7d7ff2fac426b10d3a6fa7982c151324cd86507da0160486b60de85803131ce83411a2753fdfbb5ab73092c5cd690
SSDEEP 768:o3p3Gl8c2mHBUxHTYRNd+B+qn7eBL9idv:o3p3GIERNi+RBL9o
TLSH
T10173E82257D28971E02947326BE7B7443BF6E85E0B57A39FC640A37ADCA73446C31E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d5e6060-cd14-4f40-9dc5-971c0795aff2.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3d5e6060-cd14-4f40-9dc5-971c0795aff2.extra
Size 10KB
SHA256 0e51cb50f272e6f85c47f84a08cecc9cc29f5f2feee7e61782ed298c1be770f4
MD5 203d217340502e50808756b9b0b6627e
SHA1 8f65fddc52df6a8f05aec744a32c1b476744ef0b
SHA512 9752ab98f77d89d0ec5a387c3344c34a7bce982aaa641f615ae8ca7e00c5a540cd81810ce24df333cdd1e50e29954d565307249bbc9c2f34f9e2d970e6ded607
SSDEEP 96:SEWCqqToAIY6pw6mJFFd8H0Rh7CTvBb1d0rjMLlIrLlhTLlaXv7a3OKtILfcBCqq:Saq6dLFSG7WvZ8HLYxsPywls8fodn
TLSH
T1A4227253879724B79D4294C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d5e6060-cd14-4f40-9dc5-971c0795aff2.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3d5e6060-cd14-4f40-9dc5-971c0795aff2.extra
Size 10KB
SHA256 93943d767f59a45892c17435730d7da0564d0ddbb4d5a5feb5ae430e6961dc8d
MD5 f69d1a95ab833ff4e381791122437ce5
SHA1 951a4cb6762933d431138619a7a1b1582a47241a
SHA512 7f9910431391711fdc6413dd66afc31e233dfc84f14d9a8270104b17c7f8c970b53b5d9b5465b41c390d4a21c3f4b7f9e9a848ff145fa72624a415a840016397
SSDEEP 192:SaqLcFgwiR4pDDnTYaVdVxzP5WBH24T/fKNUalE8foxbLC7L:hEcFgwiGD/1BWBH24Txa3AxCH
TLSH
T16B220A31481CD837E7D7AC8EFA393D3AD66D7B1A00E6786C41CCCA49C1A54786779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a353f06a-8f9c-49a3-a214-b483b0e064cc.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a353f06a-8f9c-49a3-a214-b483b0e064cc.dmp
Size 76KB
SHA256 278bfbbe4cad8aa4bab2bd3caa1368c6408e54ed6d8abfa8b91f09b12230083f
MD5 8ed1957df0af5025e9c24c37e230ccee
SHA1 2eb63a3d81ca97d686795f8ec3f7ddf39f0619ff
SHA512 31f2fa090ff1514e559c62bdab0ae6d39cfe1ea2db951f67a5569a1cd5c0b972054f8c3f828b89acfcf2217673916c22d958767ae29e126bedc84b79e373569c
SSDEEP 768:P3K3UzFs7HdWHSXKy6nC5n88XzHDL9idv:P3K3UzxHSXKyiKn88XzjL9o
TLSH
T18B73FC166790943ED46E87302BF7B7493BF6E41A0763A36B8250867ADCA73446F31F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a353f06a-8f9c-49a3-a214-b483b0e064cc.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a353f06a-8f9c-49a3-a214-b483b0e064cc.extra
Size 6KB
SHA256 854c7bbeb2ebce9ed890de48fc0bc6a551356e1c317edb276afaa62db10d6d0b
MD5 8736b602d3ed9ad13183db3a274432cf
SHA1 d5d25fd1f5d746c9d8adbc1c38fada25ebebdce4
SHA512 208c439a867880a06f0b3d0202a19ce1ebe34e029baccf65f3ec063c1e02f2bfaf6cf5cbff3f35e1e04d2a5ef0da111599543143a2d872901472ecb00fafeac6
SSDEEP 96:SEWCEToVIY6pw6mJFFd8H0Rh7CTvBb1dvOfoD:SaYoLFSG7WvZnOfoD
TLSH
T17CD11192831728FB8D4284D9AD346E7D19DC5EEA50F61C6843C60E09BE9A4F81FF90F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a353f06a-8f9c-49a3-a214-b483b0e064cc.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a353f06a-8f9c-49a3-a214-b483b0e064cc.extra
Size 7KB
SHA256 b1120b5386d050b8c4bd2b05b6994f3726e911eec65b5c86b368738eeb4b9cf7
MD5 7e4b9c614d4dd1c499c1a38a35398249
SHA1 36328476061ede3e184f2b644dd769aa26945d45
SHA512 70df457854faf8ea754c4ad725f5e2f892739cf712beb2c765a3464c661cbbb3213fa6081cd0d375769acf690d6d00b6b3063569842cbaf5b586acd0ec3b71ae
SSDEEP 96:SEWC6A7ViKdJPklwiyQ974pTXDnZDkwYaNQBv9QCGlQrQ9rQgAQbGYnQMRWnOfov:SaGcFgwiR4pDDnTYaVdGOfoPbL7PL
TLSH
T180F16322401CD8779AD75C9FE33E3D3A999D620A58D33C9C81CECB0C42F95B8679A142
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7dpxcjnk.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7dpxcjnk.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 66bf2cf9d6465867a45757a5d4d6d379196c52def7525f67ddad451d5dce5131
MD5 b225df5ad6fcb77fa0d1b31306c0087e
SHA1 1256c5668e406fff0efe9395e3105dcc549afb97
SHA512 024103eb2a5dcd34763d32b5749b56c77b31f35cf14a478c1782cea7f06118a74ba7a483b9eb368fbbc31e88e1da1d00c72b5067e77166f8a52e10d1287f86ae
SSDEEP 768:uASHe1FGcm+uBb2RO98/P4bnbBbybDU1/:8He8C/i
TLSH
T189D2F184EB2E953FD41912BBDCA547002F79B88A590A2F573A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7dpxcjnk.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 fba9c6eb85d8b224aa49c8de80d9a6bc5a7c66b68a2f2a64ba1bb412bbadb328
MD5 47c03ffe4b5644c1705dd84cdff4c1e0
SHA1 c942ca1d7faf5cd2641b4e4a1378a412a749e98c
SHA512 49a821df3a8293f2c5be44deb664b18031a175f8b7ef5fe1d202e74515e31f8d86dda73d5e360ffa8b99fc33e90965a762a87b1d8642617c23a270490b0bfaea
SSDEEP 768:hHe1FGcm+uBb2RO98/P4bnbBbybD7z1Mx6:hHe8C/d
TLSH
T1E7D2F184FB2E953FD41952BBDCA547002F79B88A580A2F573A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7dpxcjnk.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 538e8f5fd0026faab7109f4fa015ed3ccbfd262ad8ffa3838a41bdc8a27bc54a
MD5 1d9b8897719500da7175d3df9d3dbf18
SHA1 32b4f621323b00fb5ffef449f7a16cdad9bd560e
SHA512 691ea109e73b81c49d0e2b13a3596de76eed4d8f844bae352c5bdcfcebd061dd44b21e37186c2190bbb1586da5af8c82fb57003270d7cd366fa48aea0e49be55
SSDEEP 768:UWZHe1FGcm+uBb2RO98/P4bnbBbybD7k1/:jHe8C/W
TLSH
T12AD2F144FB2E953FD41952BBDCA507002F79B88A581A2F573A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7dpxcjnk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d2cec5076a158fa7f88398a0244cdd736425581686a2b529aec3d8b4e248323e
MD5 3de6ac2e47d53aef59c44749395306d6
SHA1 97eb96e93535e4f93681b8e605b175112215de91
SHA512 3af75a69e0c4ff053d8a1cff6a9395557ac686649196fdad41c87143e8ecf76eee18fd08f316527ac6ec43abbc3e6c3311df5f235ec54f25a8c9c9d521a92e4d
TLSH
T1A1118C9C3DB88DAA9DCBE29DB442068D93514E4305871D434D12EF8CCE82BD9322E83E
MD5 SHA1 SHA512 TLSH

Submit Download

023b0a21-c802-45bc-a878-33e09a29d284

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7dpxcjnk.default-release\datareporting\glean\pending_pings\023b0a21-c802-45bc-a878-33e09a29d284
Size 3KB
SHA256 8fc7f313ccf8a81f4f71a768b38425572af1053d390abecfaa3c2d4d6b64b864
MD5 6f891afc6d557b7e784c1eab062966c3
SHA1 5d277fa509407ea9bc7e1cd87cd51725a789457d
SHA512 82196722257491d9aefc890c4b08f4d9cc50cda602ec2ef34845cb5f41f29d5e8ac59907cbc9619eeef1af1ebbfc163b978d51df1a82ec305a21634de5c00b27
TLSH
T1956155315524B973CFECA445E33B7E988EDE33CB9C870A8521998D1486F8465478F35B
MD5 SHA1 SHA512 TLSH

Submit Download

0d03ae48-1ae0-4bbf-9976-741e8544dc03

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7dpxcjnk.default-release\datareporting\glean\pending_pings\0d03ae48-1ae0-4bbf-9976-741e8544dc03
Size 3KB
SHA256 0b3699fc4d2a83b10fb6f3b1f5e72514e175499df6b4639c2d495410a5f4ba18
MD5 342a46a1c74a85291805dd2b0d5bfe90
SHA1 a070d5d03585aab20883dd8a48a5d72e9c194052
SHA512 0f71fedf762d18383acdaaf98ac3a788b1ca92b06f801cb04115e434abcf974fe8620522336402250f4ff51373373f0e401b67fe7ee5ea91c7787944992b67c7
TLSH
T14D6165222468BA338BFCB445E33B7E94CADE33CB5C570A85519D8D5482F84A4078F25B
MD5 SHA1 SHA512 TLSH

Submit Download

240b108c-acbd-41d0-a4b6-473106b46642

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7dpxcjnk.default-release\datareporting\glean\pending_pings\240b108c-acbd-41d0-a4b6-473106b46642
Size 871B
SHA256 62cb47f32596db4b7489f0c1e67197124d001a9c83951f4413bd0e408b469e8a
MD5 dcae74801d7b4a7fed6b5118778b9506
SHA1 1660d4a39b0981abfeed159d32255fbaba0623b6
SHA512 62f710cc8a1e651b658abc273193e0aab984fcbcf3188fc9a4f607de38972617fe0b855cdc9f9272f7448d47f118644f53cd42087466c2c58bbe3c7c2ca4a464
TLSH
T10611C084A670B9729D7DD24F85667B0647E8342380C744103EB15F084DBF61EA7AA64B
MD5 SHA1 SHA512 TLSH

Submit Download

2633c1c3-c58b-4273-85a1-83a7670464cc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7dpxcjnk.default-release\datareporting\glean\pending_pings\2633c1c3-c58b-4273-85a1-83a7670464cc
Size 3KB
SHA256 d873ede90284fab949099c7f12a9d4aede8bd80ca323bae0323f77403750e217
MD5 2cb6f71aa42ff93c72d3118028fbba0d
SHA1 b736856174ecb5b0811dedc4d5dc6c3ef8f57db3
SHA512 fed294b50f6c5a89d73b0b6d6ef77aae2f3d44ad5d4e94fc9615801b3277d747246a345db318498100af017e7c2a19b624553337a7365eca00d8862cc89f5134
TLSH
T1406152215568BA338BECA141E33B6E948ADE33CF5C470EC925598D5892F846507CF36B
MD5 SHA1 SHA512 TLSH

Submit Download

37c823b3-4bf6-432e-9b29-5c7021cd5a03

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7dpxcjnk.default-release\datareporting\glean\pending_pings\37c823b3-4bf6-432e-9b29-5c7021cd5a03
Size 3KB
SHA256 1cfbac4780fbc96ef00b48339dac53383c245d3d0332f9527370dc4f512326ca
MD5 60d91c894e1ecc756e1f3ec6f9315d1c
SHA1 393c141a6946ae8a087811e594d4cba00116c7c8
SHA512 a7348e4d54dc304e8779f394f0212f38fec8d1996713e0becb3350b33db0910787b163731d472f79495bef4154e6778c8123d9c3a87877fdd76f1679d90f1161
TLSH
T1106154215424BA33CFFCA046E33B6E95CADE33CB9C471A99215ADD1882F8065178F25B
MD5 SHA1 SHA512 TLSH

Submit Download

46ecb0e7-c936-4858-8202-a415bba29341

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7dpxcjnk.default-release\datareporting\glean\pending_pings\46ecb0e7-c936-4858-8202-a415bba29341
Size 235B
SHA256 cf6d442a4ae1a47549f188d86bb3a69421029f411848f140b09f7876a3330dbf
MD5 285aa7709298f1a4a6584b4048e95c88
SHA1 f043e7fc6836a6ba3a35bc4997cc8f5c634d482b
SHA512 cdb944465e3dcf66d7a059cb16378de50b8adaa8c9d28e8b8728baf3845f62aeadb5163fc0414aa7b9710bc4b7c3ca7a8988dd68352aee8fbc5d261ea0f103c6
TLSH
T1E4D097809CACA39C88250F03B0E068E631898C3310A8E820AEA18674AABE9C80291917
MD5 SHA1 SHA512 TLSH

Submit Download

ba378d85-d8f1-467b-bb02-7b7f5cd648be

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7dpxcjnk.default-release\datareporting\glean\pending_pings\ba378d85-d8f1-467b-bb02-7b7f5cd648be
Size 896B
SHA256 150433c289c6e42f7177d77c5fc123d4d4d096591c24046202bd72d67d22f241
MD5 8cc34ae5abe6c96f904e12d31ca75e64
SHA1 440d7d0c89ef0c7de90862a5df6bdcef7ec94c2a
SHA512 18097585b35a3d384f2c7f41f4023e5ea1fccf85f4b76d940bb640589db4c48eb8f1816bae36fcc81fcbca37498cc6868ae63e80b928af58b79b8356982552da
TLSH
T165111CC1BA74BA729D7C828B88A137424BD4311380CB09107EA1AF184CBA55A93AB247
MD5 SHA1 SHA512 TLSH

Submit Download

ce57540a-8b0d-4c13-b437-7fb1636dfbba

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7dpxcjnk.default-release\datareporting\glean\pending_pings\ce57540a-8b0d-4c13-b437-7fb1636dfbba
Size 2KB
SHA256 04ccea38fe73f3208cb0899382e06bfc3cd48698f3130725aad0c5b20e09f1b8
MD5 c64f5e145f517d6f406d69801ffcac86
SHA1 e353abc6f0e46780156da75e8697ef3e549c05b1
SHA512 3e289c759f186784f9b6fdbba162947206b87a86e42d6e6c6aca2802a2682b6c7e0cbc57cc0ac3a767a7b017505490bc582b35b9161cc6659164e5e79d050f69
TLSH
T1B641215C39785D76ACCEF24E9082328D43E84E0310C758436E65EF4C8DD769A336E42B
MD5 SHA1 SHA512 TLSH

Submit Download

d3ab9b1b-c4ef-47e3-be1e-e7b16fdbebd6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7dpxcjnk.default-release\datareporting\glean\pending_pings\d3ab9b1b-c4ef-47e3-be1e-e7b16fdbebd6
Size 235B
SHA256 4e8dc1816cf38dae479f0c97a2dc8bdb44b3766e505544804f807bca57390bdc
MD5 9f5a2bf3226dbafe1cc7e76a5e95f1aa
SHA1 aadf10830781d9bebd4671a6674d2fd7549c43fb
SHA512 2ef4ea8396e1e3a8de7a8caea30e9604e31c490f60187d9fd5dca63dcb4a8a82c38463038f9dbe8cf292c8e326393eed3280fc0bcff00bfbb968fa2ec4919c99
TLSH
T1B8D09780349C631C0C155F07B1A268DB30888C33107058A086A102B48AFEEC50296817
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7dpxcjnk.default-release\prefs-1.js
Size 6KB
SHA256 1ed9fffc9041123b6c87d080973093d0f11d3a9300fdce4d9a2f1dfbe4945c3e
MD5 97d793166e7392bba5954817d0638129
SHA1 00f0e9bd304d41ad26b1ace3384f8097e277cec5
SHA512 9149cd26322ee3051ef19bfd26eab75aa86f18ce99547b5c96c75091acf3c341182287fd3e57e65a1423f7fe2677fb7637449e5f97d18bc60423091f696b5c4a
SSDEEP 96:xH0UTU5qGqibkf+A61zSU2SSlndv9j2FncHefK3Bw88u8L4cncVk00n:GURiIf+A62SSckiWBw886y
TLSH
T1D3E12E7890088F6F74B677ACAC688C316AB2013B7BBF68C610B55484054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7dpxcjnk.default-release\prefs.js
Size 6KB
SHA256 097167b03da9c1da057ef61cd9641ac3736b4c3249507fa9c783922021736370
MD5 672608666808f6350e91640a6ca49901
SHA1 285e482b97df84d362dc626e3b30153bb39ad0af
SHA512 b980eb2fa4955ada28039bf72709dbd68ca4312ab453c7dfcaf702c569d365705143601fb3dcad369b99c9e0b1c83790bdad4a4c32106de6f5c0a4060eb91865
SSDEEP 96:xH0UTU5qGqibkf+A61zSHmKSSlndv9j2FncHefK3Bw88u8L4cncVk00n:GURiIf+A6wmKSSckiWBw886y
TLSH
T1D5E12F7891188F6F78B677ACAC648C316AB2013B77BF68C610B55484054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1568-150-0x000001DCC4D90000-0x000001DCC4DA0000-memory.dmp

Download

memory/1844-15-0x00007FF998FA0000-0x00007FF999944000-memory.dmp

Download

memory/1844-12-0x00007FF998FA0000-0x00007FF999944000-memory.dmp

Download

memory/1844-1566-0x00007FF998FA0000-0x00007FF999944000-memory.dmp

Download

memory/1844-7-0x0000023EED300000-0x0000023EED322000-memory.dmp

Download

memory/1844-8-0x00007FF998FA0000-0x00007FF999944000-memory.dmp

Download

memory/1844-11-0x00007FF998FA0000-0x00007FF999944000-memory.dmp

Download

memory/1844-32-0x00007FF998FA0000-0x00007FF999944000-memory.dmp

Download

memory/1844-13-0x00007FF998FA0000-0x00007FF999944000-memory.dmp

Download

memory/1844-14-0x00007FF998FA0000-0x00007FF999944000-memory.dmp

Download

memory/1844-16-0x00007FF998FA0000-0x00007FF999944000-memory.dmp

Download

memory/1844-27-0x00007FF998FA0000-0x00007FF999944000-memory.dmp

Download

memory/1844-26-0x0000023EECBA0000-0x0000023EECBA8000-memory.dmp

Download

memory/1844-25-0x0000023EECB90000-0x0000023EECB9C000-memory.dmp

Download

memory/1844-1-0x00007FF99912F000-0x00007FF999130000-memory.dmp

Download

memory/1844-17-0x00007FF998FA0000-0x00007FF999944000-memory.dmp

Download

memory/1844-23-0x00007FF998FA0000-0x00007FF999944000-memory.dmp

Download

memory/1844-24-0x00007FF998FA0000-0x00007FF999944000-memory.dmp

Download

memory/1844-22-0x00007FF998FA0000-0x00007FF999944000-memory.dmp

Download

memory/1844-21-0x00007FF998FA0000-0x00007FF999944000-memory.dmp

Download

memory/1844-18-0x00007FF998FA0000-0x00007FF999944000-memory.dmp

Download

memory/1844-20-0x00007FF998FA0000-0x00007FF999944000-memory.dmp

Download

memory/1844-19-0x00007FF998FA0000-0x00007FF999944000-memory.dmp

Download

memory/3844-34-0x0000000006340000-0x00000000063F2000-memory.dmp

Download

memory/3844-1558-0x0000000006B10000-0x0000000006B32000-memory.dmp

Download

memory/3844-28-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/3844-39-0x0000000005B10000-0x0000000005B2E000-memory.dmp

Download

memory/3844-36-0x0000000006470000-0x00000000064E6000-memory.dmp

Download

memory/3844-35-0x00000000065C0000-0x0000000006782000-memory.dmp

Download

memory/3844-37-0x00000000064F0000-0x0000000006540000-memory.dmp

Download

memory/3844-30-0x00000000062D0000-0x0000000006336000-memory.dmp

Download

memory/3844-38-0x0000000006CC0000-0x00000000071EC000-memory.dmp

Download

memory/3844-31-0x0000000074D42000-0x0000000074D43000-memory.dmp

Download

memory/3844-29-0x0000000005B60000-0x000000000611A000-memory.dmp

Download

memory/3844-1559-0x00000000071F0000-0x000000000754B000-memory.dmp

Download

memory/3844-1564-0x0000000007EE0000-0x0000000007F72000-memory.dmp

Download

memory/3844-1565-0x0000000006C80000-0x0000000006C8A000-memory.dmp

Download

memory/3844-418-0x0000000074D42000-0x0000000074D43000-memory.dmp

Download