82085936272bf263f09cb82c1d9d94c6098f5c46a973d00da4c682346e3fa71e

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ws-Setup-Complete.exe
Size 1.8MB
Sample260822-aefymazakg
SHA256 82085936272bf263f09cb82c1d9d94c6098f5c46a973d00da4c682346e3fa71e
MD5 d252e8f0884cdfd7a81c26f2009b7719
SHA1 26a0fda22f954435e12528f1b270ff8e046692d0
SHA512 da88cc80374ff30714043e723d6f193593e94bc2da4d3eded471f23d11c3d8a38446b477452a45246d16decdf27b340929cbcc83027691ff1defad628b02e461
SSDEEP 24576:i3TWgO5pPZCTGkE9MMXxoq6+MNluBDIHSDIS7u9vFOy7apBxFmgdErvWiYyjMtWe:hgT7q72H/S7UvSjD6rvWiYyjM4SEXo3
TLSH
T173950251E6C381F2DE435836366EF32F5B225A068C31DBDEE7E86D4A68A3740265F1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery persistence spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 1628 created 2424	1628	ws-Setup-Complete.exe	82
PID 1628 created 2424	1628	ws-Setup-Complete.exe	82
PID 1628 created 2424	1628	ws-Setup-Complete.exe	82

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1628	ws-Setup-Complete.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ws-Setup-Complete.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3948	chrome.exe
4576	msedge.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	ws-Setup-Complete.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	ws-Setup-Complete.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe
1628	ws-Setup-Complete.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2332	chrome.exe
Token: SeCreatePagefilePrivilege	2332	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
3848	msedge.exe
2480	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2332	1628	ws-Setup-Complete.exe	89
PID 2332 wrote to memory of 5564	2332	chrome.exe	90
PID 2332 wrote to memory of 1564	2332	chrome.exe	91
PID 2332 wrote to memory of 1564	2332	chrome.exe	91
PID 2332 wrote to memory of 3948	2332	chrome.exe	92
PID 2332 wrote to memory of 4424	2332	chrome.exe	93
PID 2332 wrote to memory of 4424	2332	chrome.exe	93
PID 2332 wrote to memory of 1532	2332	chrome.exe	96
PID 2332 wrote to memory of 3052	2332	chrome.exe	95
PID 2332 wrote to memory of 1532	2332	chrome.exe	96
PID 2332 wrote to memory of 3052	2332	chrome.exe	95
PID 2332 wrote to memory of 4776	2332	chrome.exe	97
PID 2332 wrote to memory of 4776	2332	chrome.exe	97
PID 2332 wrote to memory of 2924	2332	chrome.exe	98
PID 2332 wrote to memory of 2924	2332	chrome.exe	98
PID 1628 wrote to memory of 3848	1628	ws-Setup-Complete.exe	99
PID 3848 wrote to memory of 1600	3848	msedge.exe	100
PID 3848 wrote to memory of 5496	3848	msedge.exe	101
PID 3848 wrote to memory of 4576	3848	msedge.exe	102
PID 3848 wrote to memory of 5496	3848	msedge.exe	101
PID 3848 wrote to memory of 5496	3848	msedge.exe	101
PID 3848 wrote to memory of 1588	3848	msedge.exe	103
PID 3848 wrote to memory of 1588	3848	msedge.exe	103
PID 3848 wrote to memory of 796	3848	msedge.exe	106
PID 3848 wrote to memory of 796	3848	msedge.exe	106
PID 3848 wrote to memory of 796	3848	msedge.exe	106
PID 3848 wrote to memory of 1676	3848	msedge.exe	105
PID 3848 wrote to memory of 1676	3848	msedge.exe	105
PID 3848 wrote to memory of 1676	3848	msedge.exe	105
PID 3848 wrote to memory of 3360	3848	msedge.exe	107
PID 3848 wrote to memory of 2644	3848	msedge.exe	108
PID 3848 wrote to memory of 3360	3848	msedge.exe	107
PID 3848 wrote to memory of 3360	3848	msedge.exe	107
PID 3848 wrote to memory of 2644	3848	msedge.exe	108
PID 3848 wrote to memory of 2644	3848	msedge.exe	108
PID 3848 wrote to memory of 360	3848	msedge.exe	109
PID 3848 wrote to memory of 360	3848	msedge.exe	109
PID 2392 wrote to memory of 2480	2392	firefox.exe	111
PID 2392 wrote to memory of 2480	2392	firefox.exe	111
PID 2480 wrote to memory of 3136	2480	firefox.exe	112
PID 2480 wrote to memory of 3136	2480	firefox.exe	112
PID 2480 wrote to memory of 3136	2480	firefox.exe	112
PID 2480 wrote to memory of 3136	2480	firefox.exe	112
PID 2480 wrote to memory of 2044	2480	firefox.exe	113
PID 2480 wrote to memory of 2044	2480	firefox.exe	113
PID 2480 wrote to memory of 2044	2480	firefox.exe	113
PID 2480 wrote to memory of 2044	2480	firefox.exe	113
PID 2480 wrote to memory of 2952	2480	firefox.exe	114
PID 2480 wrote to memory of 2952	2480	firefox.exe	114
PID 2480 wrote to memory of 2952	2480	firefox.exe	114
PID 2480 wrote to memory of 6036	2480	firefox.exe	115
PID 2480 wrote to memory of 6036	2480	firefox.exe	115
PID 2480 wrote to memory of 6036	2480	firefox.exe	115
PID 2480 wrote to memory of 6036	2480	firefox.exe	115
PID 2480 wrote to memory of 876	2480	firefox.exe	116
PID 2480 wrote to memory of 876	2480	firefox.exe	116
PID 2480 wrote to memory of 876	2480	firefox.exe	116
PID 2480 wrote to memory of 876	2480	firefox.exe	116
PID 2480 wrote to memory of 5848	2480	firefox.exe	117
PID 2480 wrote to memory of 5848	2480	firefox.exe	117
PID 2480 wrote to memory of 5848	2480	firefox.exe	117
PID 2480 wrote to memory of 5848	2480	firefox.exe	117
PID 2480 wrote to memory of 828	2480	firefox.exe	118
PID 2480 wrote to memory of 828	2480	firefox.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:2424
- C:\Users\Admin\AppData\Local\Temp\ws-Setup-Complete.exe
  "C:\Users\Admin\AppData\Local\Temp\ws-Setup-Complete.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8eb5fc728,0x7ff8eb5fc734,0x7ff8eb5fc740
    3⤵
    PID:5564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,13198744484854673028,5928640120796734627,262144 --field-trial-handle=1932,i,12810576295721107567,15778749509173886589,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:2
    3⤵
    PID:1564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1512,i,11711829747994127637,15120568064563079303,524288 --field-trial-handle=1932,i,12810576295721107567,15778749509173886589,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,10282157069512286593,13914990297364727420,524288 --field-trial-handle=1932,i,12810576295721107567,15778749509173886589,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:13
    3⤵
    PID:4424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,3588920569786480718,8589740842047579153,2097152 --field-trial-handle=1932,i,12810576295721107567,15778749509173886589,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:3052
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,16085630788223282694,12353712290715589259,2097152 --field-trial-handle=1932,i,12810576295721107567,15778749509173886589,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:1532
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4480,i,17603699669331753106,15789568014441416441,2097152 --field-trial-handle=1932,i,12810576295721107567,15778749509173886589,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:1
    3⤵
    PID:4776
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4784,i,11052320942933997834,5297980109840027256,524288 --field-trial-handle=1932,i,12810576295721107567,15778749509173886589,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:14
    3⤵
    PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x31c,0x7ff8e059c188,0x7ff8e059c194,0x7ff8e059c1a0
    3⤵
    PID:1600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,2491794615152757893,2155919959004211165,262144 --field-trial-handle=2220,i,4867688613583081973,3735365533592788779,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
    3⤵
    PID:5496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,15024384954862857935,12252238756163745445,524288 --field-trial-handle=2220,i,4867688613583081973,3735365533592788779,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,14460531380249037471,17787144124542107901,524288 --field-trial-handle=2220,i,4867688613583081973,3735365533592788779,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:13
    3⤵
    PID:1588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,7034042391276461134,8402533286443622532,2097152 --field-trial-handle=2220,i,4867688613583081973,3735365533592788779,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
    3⤵
    PID:1676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,1626829492360371485,2977254047834048110,2097152 --field-trial-handle=2220,i,4867688613583081973,3735365533592788779,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
    3⤵
    PID:796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,14451963992595332360,5320879184949216614,2097152 --field-trial-handle=2220,i,4867688613583081973,3735365533592788779,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
    3⤵
    PID:3360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,11633090664838745900,5198385153457149825,2097152 --field-trial-handle=2220,i,4867688613583081973,3735365533592788779,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:9
    3⤵
    PID:2644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,3949040519610469882,4139296009867440904,524288 --field-trial-handle=2220,i,4867688613583081973,3735365533592788779,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:14
    3⤵
    PID:360
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2480
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2300 -prefsLen 27098 -prefMapHandle 2304 -prefMapSize 270315 -ipcHandle 2368 -initialChannelId {0828de77-3a32-46ea-ad3f-8d8436d97bb4} -parentPid 2480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:3136
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3592 -prefsLen 27238 -prefMapHandle 3596 -prefMapSize 270315 -jsInitHandle 3600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3608 -initialChannelId {54660f52-922b-444e-a835-1f731d5547d7} -parentPid 2480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:2044
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3780 -prefsLen 27238 -prefMapHandle 3784 -prefMapSize 270315 -ipcHandle 3872 -initialChannelId {2d16db23-f076-4fc4-b45b-f4aa74d38f83} -parentPid 2480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2480" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:2952
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4428 -prefsLen 34737 -prefMapHandle 4432 -prefMapSize 270315 -jsInitHandle 4436 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4444 -initialChannelId {30bc2168-9fef-4742-8ca5-5d9cd0562b7b} -parentPid 2480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:6036
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5080 -prefsLen 34974 -prefMapHandle 5076 -prefMapSize 270315 -ipcHandle 5096 -initialChannelId {74c1ccbc-aba8-4e3b-b059-7bb7db500944} -parentPid 2480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      Checks processor information in registry
      PID:876
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5104 -prefsLen 32864 -prefMapHandle 5108 -prefMapSize 270315 -jsInitHandle 5112 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5124 -initialChannelId {31d5660d-856f-4059-b108-3d5f43448ba5} -parentPid 2480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      Checks processor information in registry
      PID:5848
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5140 -prefsLen 32864 -prefMapHandle 5144 -prefMapSize 270315 -jsInitHandle 5148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5156 -initialChannelId {bce5b251-9c4c-4ebe-9354-6edfe49a83f6} -parentPid 2480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:828
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5664 -prefsLen 32916 -prefMapHandle 5668 -prefMapSize 270315 -jsInitHandle 5672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5680 -initialChannelId {030e4305-741b-418d-8a0b-e166e4e44faa} -parentPid 2480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5376

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 a3b8603a875c89fe7cb584ea38672eee4dc0131e9044d517b7ab0dcd25342679
MD5 bb04ee6a40dd38bb7c7a8f991cd571e5
SHA1 210953434dac755c5017af50313a0922ed5b59e3
SHA512 48b7168eaf5c3db02999515b0eccdb83b079b5b055a610b09ab0a5f515b5548f2000d7ac9f912e00ecd305e91ce2d56a127286f335cb25bc2561b21fd09607c9
SSDEEP 96:TC0d+PTkblaRZiIEby3rUfsfuZ8IKGGxRDotok5JFADLB6xGyv4YR5gAObETev4a:TC0cTkJaRZi/CF2lIDUDT21ZIR5gAObV
TLSH
T121A13B3264659DB7A976D989B4423A43CFBD722B7960AFC4E9DD0E0C14FB0EC1342027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 0d1fdc10950a454f06c723e929f4ebbda2acc19908d9b29ee536aa779ebbb5b5
MD5 b1feb9dd8e112098c4580796aaa8bba1
SHA1 0e54114c2a80dae901b2b0868e4dacd087430a8c
SHA512 89f7600ef180fe7ec3c97a4ddd2d87dede023e7694696418b504e4614cff5f594460a0a8b21b7f14df8a83091f0cadd02618d12fe77fb07947d1301e929ad6a2
SSDEEP 768:mrv+4UNbd43XXc+wfZOXfjHufjxvShCQsZ2bwWV:mbsbO3lwfofDufFvS60wO
TLSH
T13B03BF35E97869739EF39648B60ABB13BFA99163C4C54744DACC4F0D018769E231BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d8736784866c3c703b54cc22acecb24ab13334431a9253c40ddd4fb8434bada6
MD5 2cb746858d22bb1d6304f26771afdb84
SHA1 76c42ad3baeb4768ef4001295e4f1e5d1c817db7
SHA512 603f9d59d914b7448cee5b419ceb83b78b92dca8759e7d244d6a15fd5a8ac994da13e01dd38870272db1493a93eeb9321402abec1b30d9f81184d6487cff97e3
SSDEEP 768:Rrv+4UNbd43pMkc+wfZOXfjHJvShCQtA2bwWV:RbsbO3pBwfofDJvSE0wO
TLSH
T19A03CF32E868A9339DE79248764ABB637EB46173C8C54784DACD4B0D018369F371BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 b6509a5b73224f55f77be858590e3c7c7fe751912dd719b085ed61217886c6de
MD5 e1ae23a1ac1801ed0875fb6770d2a285
SHA1 99300227684bbf06881d705140c85a5f603509d1
SHA512 e579666c6ea719b841fa994db7aae497678d56804dff1034dbefcfee59a2df15035ce05c0ee4d8eed70b92bcf15e416661b0329e0d1d2d0e217d5b5d7800f71f
SSDEEP 768:EOj1MimtiM7H+Gcm+uF4iReTCf0fbkblbGbR:YimtiqHR4ia
TLSH
T167C22084FB2A953FD42512BBDCA507042F78B8C998192F573A4C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.tmp
Size 26KB
SHA256 81d8732e04cdb26021494f0d6ef2ab10526a9e84e8f73c0fcd758c20a97c9421
MD5 157fb5c090723e5c34bb835c72af0b90
SHA1 917a86603cf6aaddd91dda2383f1544f312a0d05
SHA512 16e30626103628fed33b5e43eb9179a512a67efb1d2494ea018e4a82299abe7065b2c25a4e1a5718a8372f7b9dbd1864ab976f1989e2db3fe9c17bce4a14b1a3
SSDEEP 768:bimtiM7H+Gcm+uF4iReTCf0fbkblbGbRc7j17:bimtiqHR4iam
TLSH
T171C22084FB2E953FD41552BBDCA10B042F79B88998192F573A4C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\events\events
Size 1KB
SHA256 16dc753a9e0957d27e959633fe66c1ebc16908b158f2682acdbbd4f8a2d7f5af
MD5 9394d322a44e1ff2b3a9c2c468ab751e
SHA1 a4b46f649e9076af8d8b4f073b983c54e09c6487
SHA512 99f9d40186e92ead353d9baa39ef178273bd80f9892d39e0da2897324abe4e791ac1e3458cc4c9af08f39953e182ba4b9ef64fea916327a7cd15c3018213653c
TLSH
T12411505C3AF98D6A98CBE29C7442028D93654E06048B5D438D52FF8CCE92AD9726E43E
MD5 SHA1 SHA512 TLSH

Submit Download

03c39fc1-6c9f-4394-9ddd-80738019d2f6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\03c39fc1-6c9f-4394-9ddd-80738019d2f6
Size 235B
SHA256 ca96766efcb25a46b1823b6f2d5ed0e7e7946c2ebc6f91ab299c0832297dae5b
MD5 f1ca056cf41074888a876061e403125f
SHA1 d0bf3a5c6243ce335b68383f2dd6be17441ba0ca
SHA512 6eb8978e6c96e1b7280c74d66ad5074a93c4d3aa52c3b331ca0142e2fd47fc2910548bf4a73da7aae06cfae5641140d6f87cd676c062857a49da05b662235ac5
TLSH
T1D1D0978128D82F6C19084F0AB0A07DC33088CC33287C68108A61057889F9EC841B182B
MD5 SHA1 SHA512 TLSH

Submit Download

233d7a98-0cda-4a24-a4aa-08c6509d08c5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\233d7a98-0cda-4a24-a4aa-08c6509d08c5
Size 235B
SHA256 cc562e764b9d00aad5fbdf86677244ea734bda8df8876df898f339efbb338c33
MD5 5404c5edaf07d0128b7e367a3c741e38
SHA1 7811cb6bcc2a75f98148f763a5940912f5d8ecab
SHA512 33bb0e5f668128434ebd5faf70e32d4fa69544b6ce931a396cebd449d7b21ffb183d5d79cf9ae127cb7397dba37d193412b043e8dfd86ff3ca10efea21d4c769
TLSH
T1F5D09784249C675C58004F17F0F028C730898C3324B65C20D562017C8ABAAC892A1C47
MD5 SHA1 SHA512 TLSH

Submit Download

382b4345-18b9-40fc-bc0b-8e27e1aa5719

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\382b4345-18b9-40fc-bc0b-8e27e1aa5719
Size 871B
SHA256 dfd34a4f03c95402331a164966ce62d3db44e260fc2f17657f4b2b5fe5b1e8bd
MD5 570466b274c64c26d1a49a21bd9dcc76
SHA1 015db717a1f2314ce7b7ad6b4fdf7e261debb198
SHA512 5d6126c2167a71b941d2d9838253dc31f854fcaeded00b2a83cfb591cede1a9403975d651b4b8ee0cb4dcebe736786c2b6b133640dfaa90eceb4ae9c5f87fb04
TLSH
T188119C4192357AB2CC78914BC5A537068BB47923C4CB54143DB45E084EBB11E97B674B
MD5 SHA1 SHA512 TLSH

Submit Download

843738c0-2310-4c7f-9ce8-d7a6fa85e312

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\843738c0-2310-4c7f-9ce8-d7a6fa85e312
Size 2KB
SHA256 82aa5e13c3a7e607784a646365e9a632d75f9e0f3d4eff56a646a4eb8a2f3de3
MD5 adbee38f255f1c46ec1cef92315a6647
SHA1 b7569b16865265d721549382e7b7a0495b979eaa
SHA512 a50778ee04009cea2c902f35f7f51ad5dcd39fc852b851eb884f6913095ab5e1f369b2978eff6c4ee0d915f802243eae915d4a7dff1e7beab68b529481da2d33
TLSH
T1BF41335C35789D768CDAE24D9452338E93A09A1344C728832E51EF0CCEE379E636A52B
MD5 SHA1 SHA512 TLSH

Submit Download

a4a07b76-9528-4dc6-affb-455307efd271

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\a4a07b76-9528-4dc6-affb-455307efd271
Size 886B
SHA256 935110908600d46df78042fffd9ed157f03e2be593e04df4a865f6b338667753
MD5 e2d716d8c4da5ac825c18781a391aff5
SHA1 e811ba96685280c7fde4396f351732a45a9e3b1b
SHA512 d342b340cb2ae7a7f5c542318bb3a93c02efa42ff2623970de5990b1366564f3ed1e753b3c8cff842cf7d8d6c44af1f8128e2f7efb67241a7e60b276e0a4dcd1
TLSH
T1CD11DC419675BAB2CC3C928FC49177538BE47423C0CB65147DA45F084EFB21EA7A6B07
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs.js
Size 6KB
SHA256 d71d8ecda72b3dee471ec29c578a3cddf9d3fe5b359e0607e09cf2a1291bd6b2
MD5 66daa0151eac103499af4c6f799a880f
SHA1 9f2d1c7e40051380c2e7a673a4e2266f56969df6
SHA512 95f0533e6b271d3843a68981c5001c83cfe54557f73067065fb3152e95d37f3e39c0b1cc32f2c6a0e002cd3bc9f403b57c03c586f26600fc579a4f0ec33cd449
SSDEEP 96:xHtUTUPqGqTf9dg1zS3SSlQdv9j6nnH1Bw88u8L4cnyFa:byRTf9dgGSSD1Bw88B
TLSH
T111E10F7890088F7F74B6776CAC688C316AB2013BBBBF68D650B55484055CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.0MB
SHA256 f267ad319700e95ef2ded93644d1e4fd92f5121f702d703013473d25647e025b
MD5 10456a40c904702b773044eb3017db01
SHA1 fdf65576021b92d7669c5c58d35f0fcbe421f47d
SHA512 33fd7667a6a8d1c5ca6ef8471c5a9ebc816a1948a88ccfdca636f2c7f8ddf316ca4be59750cf6339ae81db4ef2df97340a79d9757094bb2208e239f4bb7041dd
SSDEEP 49152:B38pTQdRzgMCJYjSL8itVQ8arrWNI8ej:BSnoitCxrrWNHej
TLSH
T148362AF820D1A257F3814033664593EF21EFD00C6037DA085BA966E9A574CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download