phantom_stealer | c0c6d90a469fe79f03c570f7d2a6485b2ccd7ee890b5ec3bf04380e8c8d55739

Analysis

max time kernel
149s
max time network
139s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 10:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Swift-TT-ref07052579.js
Size 76KB
Sample260508-mkap1saz7r
SHA256 c0c6d90a469fe79f03c570f7d2a6485b2ccd7ee890b5ec3bf04380e8c8d55739
MD5 caacc18870f071fdafa0ce3fe0f18e0b
SHA1 3edca3ebe0662ee48f146769e7c2b12278c73fca
SHA512 eb5c3ff497a43f7bf69934eb6fdff80976f9653701b82ef41b10589cd5f3329f88d1eb943d21de22144a7f1043a23d2cacef41513f5985fb8c303e70b774bca6
SSDEEP 1536:xwjvr8P7k3vH9BctadF66wWYuGo1NjEtpws7/qXbpESGoXwMvbCj5t:CjweQIFbYFo3EtpwESiSZzvbCj5t
TLSH
T19A73C8C839CAF4A6039270B7992BA057F1ED8C80B80CC555FDD5645DB8AC704EAB6B7C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution phantom_stealer persistence stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.mcigroup.sbs
Port
587
Username
[email protected]
Password
keki7s5bxmhDEbQO

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
mail.mcigroup.sbs
Port
587
Username
[email protected]
Password
keki7s5bxmhDEbQO
Email to
[email protected]

Mutex

EZHJT0AZJABWP7O53ZFE

Attributes

anti_analysis
0
cb_enables_ssl
1
debug
0
keylogger
0
start_delay
0
startup
0

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 1 IoCs

resource	yara_rule
behavioral2/memory/2484-29-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4292	wscript.exe
3	4292	wscript.exe
4	4292	wscript.exe
5	4292	wscript.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	icanhazip.com

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/memory/5004-24-0x00000266106B0000-0x00000266106C4000-memory.dmp	ConfuserEx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5004 set thread context of 2484	5004	powershell.exe	87

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5004	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4676	chrome.exe
1244	msedge.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	aspnet_compiler.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	aspnet_compiler.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5004	powershell.exe
5004	powershell.exe
5004	powershell.exe
5004	powershell.exe
5004	powershell.exe
5004	powershell.exe
5004	powershell.exe
5004	powershell.exe
5004	powershell.exe
5004	powershell.exe
5004	powershell.exe
5004	powershell.exe
5004	powershell.exe
5004	powershell.exe
5004	powershell.exe
5004	powershell.exe
2484	aspnet_compiler.exe
2484	aspnet_compiler.exe
2452	chrome.exe
2452	chrome.exe
2484	aspnet_compiler.exe
5004	powershell.exe
2484	aspnet_compiler.exe
2484	aspnet_compiler.exe
2484	aspnet_compiler.exe
2484	aspnet_compiler.exe
2484	aspnet_compiler.exe
2484	aspnet_compiler.exe
2484	aspnet_compiler.exe
2484	aspnet_compiler.exe
3580	firefox.exe
3580	firefox.exe
3580	firefox.exe
3580	firefox.exe
3580	firefox.exe
3580	firefox.exe
3580	firefox.exe
3580	firefox.exe
3580	firefox.exe
3580	firefox.exe
3580	firefox.exe
3580	firefox.exe
3580	firefox.exe
3580	firefox.exe
3580	firefox.exe
3580	firefox.exe
3580	firefox.exe
3580	firefox.exe
3580	firefox.exe
3580	firefox.exe
5004	powershell.exe
5004	powershell.exe
2484	aspnet_compiler.exe
2484	aspnet_compiler.exe
2484	aspnet_compiler.exe
2484	aspnet_compiler.exe
2484	aspnet_compiler.exe
2484	aspnet_compiler.exe
2484	aspnet_compiler.exe
5004	powershell.exe
2484	aspnet_compiler.exe
2484	aspnet_compiler.exe
5004	powershell.exe
5004	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	5004	powershell.exe
Token: SeDebugPrivilege	2484	aspnet_compiler.exe
Token: SeShutdownPrivilege	2452	chrome.exe
Token: SeCreatePagefilePrivilege	2452	chrome.exe
Token: SeShutdownPrivilege	2452	chrome.exe
Token: SeCreatePagefilePrivilege	2452	chrome.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
2452	chrome.exe
2452	chrome.exe
3580	firefox.exe
3580	firefox.exe
3580	firefox.exe
3580	firefox.exe
3580	firefox.exe
3580	firefox.exe
3580	firefox.exe
3580	firefox.exe
2492	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3580	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 5004	4292	wscript.exe	79
PID 5004 wrote to memory of 864	5004	powershell.exe	81
PID 5004 wrote to memory of 4856	5004	powershell.exe	82
PID 5004 wrote to memory of 3396	5004	powershell.exe	83
PID 5004 wrote to memory of 4584	5004	powershell.exe	84
PID 5004 wrote to memory of 3092	5004	powershell.exe	85
PID 5004 wrote to memory of 860	5004	powershell.exe	86
PID 5004 wrote to memory of 2484	5004	powershell.exe	87
PID 5004 wrote to memory of 2484	5004	powershell.exe	87
PID 5004 wrote to memory of 2484	5004	powershell.exe	87
PID 5004 wrote to memory of 2484	5004	powershell.exe	87
PID 5004 wrote to memory of 2484	5004	powershell.exe	87
PID 2484 wrote to memory of 2452	2484	aspnet_compiler.exe	89
PID 2452 wrote to memory of 4536	2452	chrome.exe	90
PID 2484 wrote to memory of 2452	2484	aspnet_compiler.exe	89
PID 2484 wrote to memory of 2452	2484	aspnet_compiler.exe	89
PID 2452 wrote to memory of 468	2452	chrome.exe	91
PID 2452 wrote to memory of 4676	2452	chrome.exe	92
PID 2484 wrote to memory of 4536	2484	aspnet_compiler.exe	90
PID 2484 wrote to memory of 4536	2484	aspnet_compiler.exe	90
PID 2452 wrote to memory of 5108	2452	chrome.exe	93
PID 2452 wrote to memory of 2920	2452	chrome.exe	94
PID 2452 wrote to memory of 2472	2452	chrome.exe	95
PID 2452 wrote to memory of 1700	2452	chrome.exe	96
PID 2452 wrote to memory of 756	2452	chrome.exe	97
PID 2484 wrote to memory of 756	2484	aspnet_compiler.exe	97
PID 2452 wrote to memory of 2280	2452	chrome.exe	98
PID 2484 wrote to memory of 756	2484	aspnet_compiler.exe	97
PID 2452 wrote to memory of 5064	2452	chrome.exe	99
PID 2484 wrote to memory of 1700	2484	aspnet_compiler.exe	96
PID 2484 wrote to memory of 1700	2484	aspnet_compiler.exe	96
PID 2484 wrote to memory of 2472	2484	aspnet_compiler.exe	95
PID 2484 wrote to memory of 2472	2484	aspnet_compiler.exe	95
PID 2452 wrote to memory of 4564	2452	chrome.exe	100
PID 2484 wrote to memory of 2452	2484	aspnet_compiler.exe	89
PID 2484 wrote to memory of 2452	2484	aspnet_compiler.exe	89
PID 2484 wrote to memory of 468	2484	aspnet_compiler.exe	91
PID 2484 wrote to memory of 468	2484	aspnet_compiler.exe	91
PID 2484 wrote to memory of 4676	2484	aspnet_compiler.exe	92
PID 2484 wrote to memory of 4676	2484	aspnet_compiler.exe	92
PID 2484 wrote to memory of 5108	2484	aspnet_compiler.exe	93
PID 2484 wrote to memory of 5108	2484	aspnet_compiler.exe	93
PID 2484 wrote to memory of 4536	2484	aspnet_compiler.exe	90
PID 2484 wrote to memory of 4536	2484	aspnet_compiler.exe	90
PID 2484 wrote to memory of 756	2484	aspnet_compiler.exe	97
PID 2484 wrote to memory of 756	2484	aspnet_compiler.exe	97
PID 2484 wrote to memory of 5064	2484	aspnet_compiler.exe	99
PID 2484 wrote to memory of 5064	2484	aspnet_compiler.exe	99
PID 2484 wrote to memory of 1700	2484	aspnet_compiler.exe	96
PID 2484 wrote to memory of 1700	2484	aspnet_compiler.exe	96
PID 2484 wrote to memory of 2280	2484	aspnet_compiler.exe	98
PID 2484 wrote to memory of 2280	2484	aspnet_compiler.exe	98
PID 2484 wrote to memory of 2472	2484	aspnet_compiler.exe	95
PID 2484 wrote to memory of 2472	2484	aspnet_compiler.exe	95
PID 2484 wrote to memory of 2452	2484	aspnet_compiler.exe	89
PID 2484 wrote to memory of 2452	2484	aspnet_compiler.exe	89
PID 2484 wrote to memory of 468	2484	aspnet_compiler.exe	91
PID 2484 wrote to memory of 468	2484	aspnet_compiler.exe	91
PID 2484 wrote to memory of 4676	2484	aspnet_compiler.exe	92
PID 2484 wrote to memory of 4676	2484	aspnet_compiler.exe	92
PID 2484 wrote to memory of 5108	2484	aspnet_compiler.exe	93
PID 2484 wrote to memory of 5108	2484	aspnet_compiler.exe	93
PID 2484 wrote to memory of 4536	2484	aspnet_compiler.exe	90
PID 2484 wrote to memory of 4536	2484	aspnet_compiler.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Swift-TT-ref07052579.js
1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -ep bypass -file "C:\Temp\IIVATZXYDJ.ps1"
  2⤵
  - Suspicious use of SetThreadContext
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:864
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4856
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:3396
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4584
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:3092
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:860
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:2484
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gz11ykwl.emq"
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2452
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\gz11ykwl.emq /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\gz11ykwl.emq\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\gz11ykwl.emq --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff93de1c728,0x7ff93de1c734,0x7ff93de1c740
        5⤵
        
        PID:4536
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gz11ykwl.emq" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1592,i,3286841306978851087,3083833715885635323,262144 --field-trial-handle=1892,i,11030270597308379609,5905003444670414949,262144 --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:2
        5⤵
        
        PID:468
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gz11ykwl.emq" --force-high-res-timeticks=disabled --metrics-shmem-handle=1804,i,6594910023642818886,2334701728205989504,524288 --field-trial-handle=1892,i,11030270597308379609,5905003444670414949,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4676
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gz11ykwl.emq" --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,5323019238587364542,4373013390618039912,524288 --field-trial-handle=1892,i,11030270597308379609,5905003444670414949,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:13
        5⤵
        
        PID:5108
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gz11ykwl.emq" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3092,i,13396056619468589210,7621585956941505711,2097152 --field-trial-handle=1892,i,11030270597308379609,5905003444670414949,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:1
        5⤵
        
        PID:2920
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gz11ykwl.emq" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3108,i,16251919335302095092,13286869298179504928,2097152 --field-trial-handle=1892,i,11030270597308379609,5905003444670414949,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
        5⤵
        
        PID:2472
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gz11ykwl.emq" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3272,i,5156492149654959108,11574224643369372774,2097152 --field-trial-handle=1892,i,11030270597308379609,5905003444670414949,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:1
        5⤵
        
        PID:1700
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gz11ykwl.emq" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3288,i,7847343779563845356,3525353836170307963,2097152 --field-trial-handle=1892,i,11030270597308379609,5905003444670414949,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:9
        5⤵
        
        PID:756
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gz11ykwl.emq" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3916,i,1986192846793883134,5851259438477851789,2097152 --field-trial-handle=1892,i,11030270597308379609,5905003444670414949,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:9
        5⤵
        
        PID:2280
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gz11ykwl.emq" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4108,i,16779765007953959984,17221191457319095413,2097152 --field-trial-handle=1892,i,11030270597308379609,5905003444670414949,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:1
        5⤵
        
        PID:5064
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gz11ykwl.emq" --force-high-res-timeticks=disabled --metrics-shmem-handle=4408,i,12481886250709024996,4542012542098878133,524288 --field-trial-handle=1892,i,11030270597308379609,5905003444670414949,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
        5⤵
        
        PID:4564
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gkpobv3g.wqy"
      4⤵
      PID:600
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\gkpobv3g.wqy
        5⤵
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:3580
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1536 -prefsLen 27097 -prefMapHandle 1544 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {1f36a398-eaf9-4db6-a18a-d5379aa6b215} -parentPid 3580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3580" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        6⤵
        
        PID:4392
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2192 -prefsLen 27133 -prefMapHandle 2180 -prefMapSize 270279 -ipcHandle 2156 -initialChannelId {cc559280-6786-4458-9e23-d52941fb17b9} -parentPid 3580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        6⤵
        
        PID:4684
      - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8ccf4b6e-c07d-48cf-9f75-2245706c58ca.dmp"
        6⤵
        
        PID:552
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2832 -prefsLen 27133 -prefMapHandle 2836 -prefMapSize 270279 -ipcHandle 2572 -initialChannelId {87e9c185-bef1-4de8-ae4e-2104546bf3df} -parentPid 3580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3580" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        6⤵
        
        PID:1972
      - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8bc35ef8-3571-443d-9863-58427a893eb2.dmp"
        6⤵
        
        PID:2956
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2572 -prefsLen 27133 -prefMapHandle 2948 -prefMapSize 270279 -ipcHandle 2980 -initialChannelId {17f074c3-d50d-4012-bc30-74f87234f22b} -parentPid 3580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3580" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        6⤵
        
        PID:4836
      - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2484fb65-bd6d-4bc8-9ab1-d8782a97468d.dmp"
        6⤵
        
        PID:4136
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3612 -prefsLen 27247 -prefMapHandle 3600 -prefMapSize 270279 -ipcHandle 3500 -initialChannelId {8320e957-d916-4466-aa19-8564190f4e88} -parentPid 3580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3580" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        6⤵
        
        PID:3960
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3848 -prefsLen 27323 -prefMapHandle 3852 -prefMapSize 270279 -jsInitHandle 3856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3924 -initialChannelId {5c5664b8-031b-43c6-a3b3-e271ebeb4036} -parentPid 3580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        6⤵
        Checks processor information in registry
        
        PID:2272
      - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\aed77d22-154b-448d-a081-5dcb503cdb48.dmp"
        6⤵
        
        PID:3820
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3500 -prefsLen 27323 -prefMapHandle 3860 -prefMapSize 270279 -ipcHandle 4076 -initialChannelId {972b895b-281e-482b-aa35-b8f5bf7cd3e7} -parentPid 3580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3580" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        6⤵
        
        PID:4888
      - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b3c2b757-0cf9-4cbd-88c3-30436ada4f3c.dmp"
        6⤵
        
        PID:4976
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4268 -prefsLen 27323 -prefMapHandle 4272 -prefMapSize 270279 -ipcHandle 4280 -initialChannelId {2bce1733-ddbe-4067-927c-1ddaf0678aa7} -parentPid 3580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3580" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        6⤵
        
        PID:3544
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3192 -prefsLen 34822 -prefMapHandle 4588 -prefMapSize 270279 -jsInitHandle 4600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4612 -initialChannelId {4c4c97cd-df05-4fe2-84ad-bba2541ce701} -parentPid 3580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        6⤵
        Checks processor information in registry
        
        PID:4352
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5016 -prefsLen 35010 -prefMapHandle 5012 -prefMapSize 270279 -ipcHandle 2788 -initialChannelId {cc6a623f-0fee-43aa-92b5-c777837c03d4} -parentPid 3580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        6⤵
        Checks processor information in registry
        
        PID:5824
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4996 -prefsLen 32900 -prefMapHandle 4976 -prefMapSize 270279 -jsInitHandle 4992 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4980 -initialChannelId {e2be7373-890c-4d76-82be-901f07b35b6d} -parentPid 3580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        6⤵
        Checks processor information in registry
        
        PID:5832
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5320 -prefsLen 32952 -prefMapHandle 5316 -prefMapSize 270279 -jsInitHandle 5312 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5428 -initialChannelId {ae5bde40-bb77-442e-ba2e-c5d987bd3680} -parentPid 3580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        6⤵
        Checks processor information in registry
        
        PID:6036
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5592 -prefsLen 32952 -prefMapHandle 5596 -prefMapSize 270279 -jsInitHandle 5600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5452 -initialChannelId {3c527ee3-f2bb-48d8-8ec9-0cd3b06e7357} -parentPid 3580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        6⤵
        Checks processor information in registry
        
        PID:3684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv"
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:2492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ec,0x7ff93b93c188,0x7ff93b93c194,0x7ff93b93c1a0
        5⤵
        
        PID:440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1524,i,17032099810969174176,16804444821503657591,262144 --field-trial-handle=2076,i,10047526205535622223,15819671472673027603,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:2
        5⤵
        
        PID:2980
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1596,i,16295687501603109819,16765894318184122002,524288 --field-trial-handle=2076,i,10047526205535622223,15819671472673027603,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:1244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,744790736859815246,12924219468606104957,524288 --field-trial-handle=2076,i,10047526205535622223,15819671472673027603,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:13
        5⤵
        
        PID:3820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,18138780835295046052,2125893492374980550,2097152 --field-trial-handle=2076,i,10047526205535622223,15819671472673027603,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
        5⤵
        
        PID:5400
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,9722711853299433053,10037642966791939365,2097152 --field-trial-handle=2076,i,10047526205535622223,15819671472673027603,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
        5⤵
        
        PID:5668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,6119425848995593291,2254093615758184477,524288 --field-trial-handle=2076,i,10047526205535622223,15819671472673027603,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:14
        5⤵
        
        PID:5492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,7022963289351805765,15665248949690682745,524288 --field-trial-handle=2076,i,10047526205535622223,15819671472673027603,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:14
        5⤵
        
        PID:5484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,11660837794882961911,10338152321343345344,524288 --field-trial-handle=2076,i,10047526205535622223,15819671472673027603,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:14
        5⤵
        
        PID:5468
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3740,i,10448368662623415163,8198361786340582514,2097152 --field-trial-handle=2076,i,10047526205535622223,15819671472673027603,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:1
        5⤵
        
        PID:5424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3744,i,2007919513897026910,4078811400569364619,2097152 --field-trial-handle=2076,i,10047526205535622223,15819671472673027603,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:9
        5⤵
        
        PID:5448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3760,i,4805220480532472471,15205953970997610621,2097152 --field-trial-handle=2076,i,10047526205535622223,15819671472673027603,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:1
        5⤵
        
        PID:5472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3780,i,7708579388349409348,8920823858725511510,2097152 --field-trial-handle=2076,i,10047526205535622223,15819671472673027603,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:9
        5⤵
        
        PID:5712
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3800,i,14149384765213127350,3278491771100812671,2097152 --field-trial-handle=2076,i,10047526205535622223,15819671472673027603,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:1
        5⤵
        
        PID:5720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3776,i,5805465039902160811,8681135026933321724,2097152 --field-trial-handle=2076,i,10047526205535622223,15819671472673027603,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:9
        5⤵
        
        PID:5412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3816,i,6443025828492573647,9689906416075021142,2097152 --field-trial-handle=2076,i,10047526205535622223,15819671472673027603,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:1
        5⤵
        
        PID:5796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3908,i,7117521900219306141,10194774952787305245,2097152 --field-trial-handle=2076,i,10047526205535622223,15819671472673027603,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:9
        5⤵
        
        PID:5060
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3952,i,3986055732931538054,13684247012595213361,2097152 --field-trial-handle=2076,i,10047526205535622223,15819671472673027603,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:1
        5⤵
        
        PID:4952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3936,i,13369075103246920290,17593684911848429369,2097152 --field-trial-handle=2076,i,10047526205535622223,15819671472673027603,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:9
        5⤵
        
        PID:2344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4100,i,14483368727713490957,12196515078669419280,524288 --field-trial-handle=2076,i,10047526205535622223,15819671472673027603,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:14
        5⤵
        
        PID:2488
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        6⤵
        
        PID:6040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4084,i,8555236357421240611,4557672321209833924,524288 --field-trial-handle=2076,i,10047526205535622223,15819671472673027603,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
        5⤵
        
        PID:6004
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=592
        6⤵
        
        PID:800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,207382609251061552,2752428627357791729,524288 --field-trial-handle=2076,i,10047526205535622223,15819671472673027603,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
        5⤵
        
        PID:5880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,2843077902068494016,10164900888188398574,524288 --field-trial-handle=2076,i,10047526205535622223,15819671472673027603,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
        5⤵
        
        PID:4048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,15455625303539560680,3935961138831543893,524288 --field-trial-handle=2076,i,10047526205535622223,15819671472673027603,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
        5⤵
        
        PID:4828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

IIVATZXYDJ.ps1

Path C:\Temp\IIVATZXYDJ.ps1
Size 5.0MB
SHA256 d1971a18d14ac1b7ffb9c0bacad97afc31f3b422facb6437cc4c9584428195fe
MD5 c28e22aff2a2f10f12f4cbfb119f6a9c
SHA1 6cdf204fd754b0b8891ae72b4207629dfff7833f
SHA512 4b093f4f2757c50d04d4085ab1ad38b619314077bb8031837c5525633f1c99a677b44cbf5a8b13101beb1bdaed4fd27d73f385e214cad81f2b3c43be986b21e7
SSDEEP 24576:p2jNbl5YJe276qcZBkFziOB+Ej9VvANxb8mT65k/pemMvUHvg6iAsD2e/XZ/3YjD:C
TLSH
T17B36BFCAD56E44D29C053FC9A8242BC78B2546328A7400283A7F7D498F775FEC15EEE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv\Crashpad\settings.dat
Size 280B
SHA256 a554f0e98119d92163c73be68839b917352e4cdc43b701a84ea8b501d04da44d
MD5 95a3070f3e1928c5f385d41f7d77ae99
SHA1 0ddf84007338f6f2f65a5fb20566843a144e9840
SHA512 f18802e166b0f0e1e7780a9d3d09cba9a1e517cf0e4be61d1999d5572be365d1193543153eb6b6a859e85e0895234b9fbc9f62801f8d8419fb66177ca46c42eb
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv\Crashpad\settings.dat
Size 280B
SHA256 2eeba34feeb0a8c6dc52956dfd81dd20c5f29d398a75ba1bb7611269e62d2ec8
MD5 11f06ff669a75d3ef6bbc6cdcdfb01a4
SHA1 df195884e474a68e02b6a140da86c443cca297de
SHA512 c1e25cf62f1d1f65838ea716f469ec4f2f21b95f49e796f154026d3a1b8f35faf70407b40eb020e7e4ad60162e094d52f574259398a95e3140fab936f26e8144
TLSH
T109D02202FF330800CCC022300B228208002E8228C803328A8C300F8ECFBC22038008CC
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv\Local State
Size 4KB
SHA256 a9d397e73d80755fa4b743e34ef53e66b629194a287dd4377387684aaeada2b2
MD5 38237ff5cfbac8bdb4ec0eba2256c852
SHA1 0f93e5c52f3cfafb97ec81813df614779001f971
SHA512 e2898605d181428b9199a20a0cb29ae6f0ed33f7862568b75be8e9e20dcbf9cdc4dd9983e69f937c3a886d8fa2dc6cc05dcaf91e6836fefe6f78d1c225834019
SSDEEP 96:N4qGNkARQsFfNRYdmh4Js58Frh/cInURoDotovL6EdDLf4BN7av9BGse00eUnFW7:hGNY+gJPooDUwb4cGp0qFc
TLSH
T1B6A1B8B2A569EC274DF2A944B4863793AFA43573E845BF98E5D80B0C04DB388374AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv\Local State
Size 3KB
SHA256 baf7567f647d0ed140e4456fd360e77d2eb9cd4c66df7a32fb687c470df1e2e7
MD5 7f38896f56feac603384b8737aecc464
SHA1 44d5436f27656b924367c46d1cba088d361b02e4
SHA512 ff714eeefa08bbf0f6ebd26ca219cd97298cc0558841ce5aab5e045d92f73e6992d0bff3c3dc79640a852e60980e0442a65761b12b1b0a3cdd8a824539575360
TLSH
T12381C8B2A459ED3359F26544B55A36D39E7439B3DD12AF54E1D8030800EB64C3B4EC37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe595104.TMP

Path C:\Users\Admin\AppData\Local\Temp\1vtqjvfe.4gv\Local State~RFe595104.TMP
Size 1KB
SHA256 273a227875dbb9f19a15ddf848b2f9758b2980859d1b2563e370c76c53d9bd27
MD5 19167a64fdceb9a5535a8f63b4710759
SHA1 09dd94cd984ccd4e865aa080b161ab324890d846
SHA512 f8200ae2e0f3846f0075aeb46cddb5fbe84dcfc520d85b91f1788b34737d7419d5fbb2e1cf0bf7a1c8ffbb3eb981e2aa35019b81b763bb648c2bd1869cf830e2
TLSH
T1103173F2E9D96D73BCB20645B20ABE939E3056718166664891EC0A0C05EB5CC720AC3F
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xpmxkmzk.w5k.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xpmxkmzk.w5k.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\gz11ykwl.emq\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\gz11ykwl.emq\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\gz11ykwl.emq\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\gz11ykwl.emq\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\gz11ykwl.emq\ShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\gz11ykwl.emq\ShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\gz11ykwl.emq\ShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

2484fb65-bd6d-4bc8-9ab1-d8782a97468d.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2484fb65-bd6d-4bc8-9ab1-d8782a97468d.dmp
Size 65KB
SHA256 02fbc16559ff98276327708ea7188de7818163355851dec82e0ed23f214a1239
MD5 0877c8e31cc1085fbc53fde6be33765f
SHA1 6bedf33830806a096368a630f2133ccfd29fa35b
SHA512 1725d9889386478ac4e44ac6b696373110032df5a59ee52eeda8716a1d456964f482024107b3fe4b39a731280d66da17ac99df83bf026f8ff7c5e39fda30b66b
SSDEEP 768:TZrON9Em9pryWtxzVfgE+nLeGndOrYEmdX2:9Amm9JyWtxRovLBQYEmdX2
TLSH
T1AA63D91293D414F7E83103B85AE76B983BF2E8655797435F468CE27AAC663C4AC70E13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2484fb65-bd6d-4bc8-9ab1-d8782a97468d.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2484fb65-bd6d-4bc8-9ab1-d8782a97468d.extra
Size 10KB
SHA256 e2bd027d18566952786008530eea52f97667b87001e00dfa237bb3a565278278
MD5 a2cbb74f7f3921154f689c575f5c7fc9
SHA1 6de047d0491fe50adb401634b4b2aa878d70259a
SHA512 7b1584525055c97869b74d8a5928f7bbc142ae8c51bb311431a426daa7c06e3e810ccbf242dddf8b5636b1aa18dab9a27c756dd4e672d844ceb87a6f89bd4afb
SSDEEP 96:STWC8T0bY6pw6lFFdtH0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7a5utILfcBCqwvEi:S5w8FbG7uvZ8RLpxsP5wlAPfof
TLSH
T186227253878724B7AD5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2484fb65-bd6d-4bc8-9ab1-d8782a97468d.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2484fb65-bd6d-4bc8-9ab1-d8782a97468d.extra
Size 10KB
SHA256 11d0695b9cac0f8ea23fd186ff347b5bf80515fd264a22dd10ec7289bf0c83ac
MD5 98f798bde0111dc768bac548b76cf836
SHA1 d93c7eac953265c5b60b4d509eb36a0ee2a967cc
SHA512 f28a346bb8570c4eaca652e94b4d0b5e9f16d099ded5e3b24445116eed38ca59d95565eb61a1e0dd7ff403705483036470896bc5fe21a1ee16b6031ae1baf3af
SSDEEP 192:S5HcFQiR4p4DnTYapdVxzPjWBHx4T/fKNtalIPfoTbLgDl5:iHcFQi5Dz1LWBHx4TmawAT0n
TLSH
T1D232E831481CD837E7E6AC8EFA393E3AD66D7B1A00E6789C41CCCA49C1A5478A779453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8bc35ef8-3571-443d-9863-58427a893eb2.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8bc35ef8-3571-443d-9863-58427a893eb2.dmp
Size 65KB
SHA256 86560374e731055052be46b990b95176eb4364d442d309a45d983dd58e81145e
MD5 0be64c5c4261cefe2777225a79d0722c
SHA1 00258bb353a51d621725724c7d1a2d9ac8f41dc6
SHA512 0f7a4f132bac8150cefdc0104f4e0d2c9b14dd4c06d40ad5349ea00dce2d6ccc818bef07680ab64c2d409e539f693bf7d5db60a3ea735b4f7d170f405edb403f
SSDEEP 384:ytbYrxwzUwhX9YqrzgNghg2FEe3w+0rqAkZrYEmdX2:yyrx0HrzgGF9/AkZrYEmdX2
TLSH
T1EC63EC16A79416A1FA31823456E7E7483BF6E81C3793439F5B32916AEC7B3C45E30E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8bc35ef8-3571-443d-9863-58427a893eb2.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8bc35ef8-3571-443d-9863-58427a893eb2.extra
Size 10KB
SHA256 420e02e97b6373e0c5d49c7554c6583d6755efc2c241966bb731052a862c891c
MD5 4a3e7220ebd634af2b0ec0876140c79e
SHA1 20416846ee5b00c12dc8c754428cdb417403149f
SHA512 5a1b91e3c42b3e5adb2864819347fa046ade7762586b1b56f2ebe7aea7c09ba3040aa4f2d16131b47feacc7ecc447ce74c52351c2c3a0e194aad8cd7fcf26519
SSDEEP 96:STWCxT0bY6pw6lFFdtH0Rh7CTvBb1d0FjMLlIrLlhTLlaXv7a2utILfcBCqwvEYH:S5B8FbG7WvZ8RL8xsP5wl6tfox
TLSH
T1D5227253878724B7AD5198C4BC30AE7C45EC6FAA51F958A802CC4D47FA4A8F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8bc35ef8-3571-443d-9863-58427a893eb2.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8bc35ef8-3571-443d-9863-58427a893eb2.extra
Size 10KB
SHA256 878f8deff1c0ef729ea7c6d80220d63d15ebcbaf613090805c0c4a1a0a49734f
MD5 be5171fdc51ffee8da841e7ff12ccdbf
SHA1 7c1382bc840a542a79ab0644e220d47c9a413014
SHA512 8b37d310b0d5ab9321c10dc2293dffd6aa69c5ae1bf3269d5987210958841dbfa513b92f8cb50609a49e75d7cdffe7aa60941b1ae35af3d9ded190e772d2215d
SSDEEP 192:S5YcFQiR4p4DnTYaVdVxzPjWBHe4T/fKNtalytfo9bLgDl5:iYcFQi5D/1LWBHe4TmaYA90n
TLSH
T1C622F931481CD837E7E6AC8DFB393E3AD26E7B1A00E6789C41CCCA89C1A5474A779553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ccf4b6e-c07d-48cf-9f75-2245706c58ca.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8ccf4b6e-c07d-48cf-9f75-2245706c58ca.dmp
Size 64KB
SHA256 55ec481008558a12fe66dec55f593a0eafa8051db1570047b7ff766926d7df64
MD5 0bfeb3003c7e96145e9fecab30f50a52
SHA1 6b71430199b0d5f48a4f70cd5b6e13e31c407307
SHA512 4b3a236b2651bcd5de7a73027405d063bf777e3d700ab687b8c66208193bf51b85ad80353b3f599610032cfcd2ae93675a01d721c69c1974098406fd55312f2b
SSDEEP 768:FH6rU9rby4PrDR4f/keWRTLBF+yhrYEmdX2:Rqmby44keCYEmdX2
TLSH
T12C53FA92A79408A9E93103749EE7738CBBF6EC1527F3476F4610526A9C77BC46C31D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ccf4b6e-c07d-48cf-9f75-2245706c58ca.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8ccf4b6e-c07d-48cf-9f75-2245706c58ca.extra
Size 1KB
SHA256 50eb4fa4a75c3d6dc378061bbf7f1ee3c0082872e02218e3d5de8a19063737f6
MD5 e676645ec1b8557d930d53fe8236bd4e
SHA1 acc6717d2167be7535c52c0fe1706b69bf75ec94
SHA512 f593ed4097af6d3c76f0a3c1172870bee20e6b229d5b5526238fa01e6d90a00c93af5c5c59a4ccb02361a6d8ba408cdd0b0e3c38e7321b9ee474a9f60a2ec15b
TLSH
T1CB3174B3819C2D6699978699B77F1302C999732301D25D0D34CD4A0D418E4DCD3629D3
MD5 SHA1 SHA512 TLSH

Submit Download

8ccf4b6e-c07d-48cf-9f75-2245706c58ca.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8ccf4b6e-c07d-48cf-9f75-2245706c58ca.extra
Size 3KB
SHA256 efdbc41eef5e06bfde4dc8bd4ac94fa0aecf16837d9c5ee8075ba03812af0143
MD5 69122f5aa730d139f507e282538d298e
SHA1 1fb30ef730d1800541c4046a7398c0c06054a853
SHA512 7ae64c3fccfe56a69fc8e585fe0cd5ef76842a75901cfa6103e10dd29af23fb1d286540aeafd48aae21c4fac6e1cebe4618d65589ad71fd8bf2edb41a23688a5
TLSH
T16D811172405CD9276AEE5D9AB3376D1D889FB31998B23A8C80CEC75C01B8CB07387183
MD5 SHA1 SHA512 TLSH

Submit Download

aed77d22-154b-448d-a081-5dcb503cdb48.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\aed77d22-154b-448d-a081-5dcb503cdb48.dmp
Size 66KB
SHA256 a9db1eb9761d3ee61b445b76ac0f6abb26ae5d213004efe8a199d787ae6c1e08
MD5 680a54772010839c202a0965cd026164
SHA1 cfc63bd0872ed7c29005dd9b8e786c1d5bef3d40
SHA512 8167f8c0a414dbe92ee026b833e2ae382cfe353fd955e70a4a0af438c856b239c8c78b9e37c2eee53a24aabb6460d7f093109a10dc89e48db20b1a0c274b924d
SSDEEP 384:QjeYrYPJF/Ml87gdfZu4t0rBv7GnR9nrrtNo7rXohfe8Xv7TQwguwoErYEmdX2:Qj3rYFUl8UdCrB6hfXf7TLErYEmdX2
TLSH
T13363E81297A408ABE93153345BE7675D3FF6E41827A3435F4A1051AEECB73C2AE31A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aed77d22-154b-448d-a081-5dcb503cdb48.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\aed77d22-154b-448d-a081-5dcb503cdb48.extra
Size 10KB
SHA256 e0f957d831a098dc7302e25ffc15d44f46f4496e29415c12a05d9ddcc8781285
MD5 7e30a977c646747029cc7e007e7cddc3
SHA1 ec98bb4e9c361ddef48af9e56d7a61fb49aa4f10
SHA512 630b4eb92edb12d56bc73f82890fc7109017ae64551c8c0303f6c887f58beb4d53e98d2f47b813e73e36aa0e449551b912faba5875982a97fd6abb8a9eb36c77
SSDEEP 96:STWCfT0bY6pw6lFFdtH0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7aHutILfcBCqwvET:S5L8FbG7uvZ8RLHxsP5wl4nfoa
TLSH
T136227313878724B7AD5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aed77d22-154b-448d-a081-5dcb503cdb48.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\aed77d22-154b-448d-a081-5dcb503cdb48.extra
Size 10KB
SHA256 4c2f072765c06f79c4269c1a77d59df90a04826c1318924fa8d3c71163378f5a
MD5 9796e543b99a6814c53aaf8b13248324
SHA1 e41c041bd7f51e9512ddb9d6399b327659545ca3
SHA512 c6d0e90f13ebbaba6d474a671bb89cc0d4122e80c5aa766a8c838b1e0beb6c29d7c0c323addff50b925d2ddd01ec97c1230cdbc48230f359eea99915561317e5
SSDEEP 192:S52cFQiR4p4DnTYapdVxzPjWBHd4T/fKNtalwnfo6bLgDl5:i2cFQi5Dz1LWBHd4TmaUA60n
TLSH
T1E522E831481CD827E7E7AC8EFA393E3AD66D7B1A00E6789C41CCCA89C1A5474A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3c2b757-0cf9-4cbd-88c3-30436ada4f3c.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b3c2b757-0cf9-4cbd-88c3-30436ada4f3c.dmp
Size 66KB
SHA256 6839bb5c4fa6545b3b6676ef09534d4db63d52d29b3009c5da6e685f5fe13fda
MD5 b2cc77b35130292c366f6f7b413671e6
SHA1 e6023617d7d99bd1ef27713a668289349627ddab
SHA512 dcc0bcf6b4b630dac6afa91125740a52e2709740fb417c5f56bb671c8a612f3cc5bd253d39feba177b8eb207a9fba43d91e4e2ad406f22696e1994cd9f9fecb5
SSDEEP 768:XBrsz+wgoprQp8BkpA9HP08ZABJrYEmdX2:Rs+6Qp8KWhBABpYEmdX2
TLSH
T16063B922ABD405A2E8350774DAAB735C3BF2E4545FA3839B860851BAECF63C45C75E13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3c2b757-0cf9-4cbd-88c3-30436ada4f3c.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b3c2b757-0cf9-4cbd-88c3-30436ada4f3c.extra
Size 10KB
SHA256 0d495eadf03a759f82b77fc98ced823964169000644e1f09b728cb41c41f4cbd
MD5 614167d0e1e30370b916153a858071e5
SHA1 14a6ff76fe26076a5328927bf3c6ac8d12c4efe4
SHA512 13cade4a974c3634addc8d2447b20bb7bdeb68bd13cca7cb226a1d42d3d9a578e6b6377f7e2f19beba88857d54965f19c34b939e41ce673a8c86f854bb67646d
SSDEEP 96:STWClYT0bY6pw6lFFdtH0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7aeutILfcBCqwvq:S5lk8FbG7uvZ8RLUxsP5wlx7foAq
TLSH
T15E228353878724B7AD5194C4BC30AE7C45EC2FAA61F958A802CC4D47FA468F41FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3c2b757-0cf9-4cbd-88c3-30436ada4f3c.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b3c2b757-0cf9-4cbd-88c3-30436ada4f3c.extra
Size 10KB
SHA256 3c1357e04476be636d73291b476fae20e85ce5e040a6420a9c3518964dc581ed
MD5 3b5732b24f5af703edaa1040f3dfdff8
SHA1 e6975c763540bc7711f5c3cb2c709a3d2535aa01
SHA512 457824883c1e9c4209661277f1b663ae524a3b8c882468171e2b00de2f145604281abaa295ce932c7bf5e7b57627989f78ac8106641e58b0c1583ea38f97ea10
SSDEEP 192:S5lDcFQiR4p4DnTYapdVxzPjWBHM4T/fKNtal57foAqbLgDl5:iRcFQi5Dz1LWBHM4TmaHAn0n
TLSH
T13E32F831481CD827E7E6AC8DFA393E3AD66E7B1A00E6789C40CCCA89C1A5474A779453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 493bb2be07c6365024288213e53a57abeef1b82d98a57f788589c32ea1e51a89
MD5 a4e869691585c1445a07d0a13f2589a2
SHA1 c12449b0db29218924f5834eb07b03d546249f36
SHA512 e4c9ba333aba14ddbb0f33edeff52f5cc1834c1a41bb2981ff98fb7e385f5cccdf68e4373dbd9df93f0659caf524f9e2388658aead54f9145c9607c99e698466
SSDEEP 192:GkOv5zboobNbyjqmx/P1d66Joz0dzgCl6mc0dz:GnboobNbyjqGdd66JozQzgC1jd
TLSH
T182D1FC28E6394A3FC444023FCDA51F500E36795BA88E7F2632EC64482C572DE7A9D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 9e6db25583408660f0e09f9cea6df8bee8e8c27e2009feae8065d96cc920849f
MD5 9406f7f4f559b6443b162a8285377830
SHA1 b21156a122e13e3cfd69bbf54841a42b57148bda
SHA512 b637d8acccaf88260a60281dd33c197f6968a59aec503137f3d0572217dd4a3078aae90340bdd7988eaab20c79848f5f3dcf378d5528b6986a2449b34b5e3dff
SSDEEP 192:rkOv5zbonZNbyjqlvpt1d66Joz0dzgCl6mc0dz:rnbonZNbyjqXLd66JozQzgC1jd
TLSH
T14DE14F68EA29463FC404027BCDA61B414F35398A9C4E7F1532AD644C2C472DE7A8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 4201bc3d6426e7e0b691afb34b282d0bddf1a93c626ee9898b0b39baf5d20bde
MD5 54836c9ca4451b09beb69443db733f14
SHA1 24f7d32453b778ec4b036fd59bbcb79c4bdd7dfb
SHA512 26b7acc3b07a66d47e9083aad91d59051b643c2fbc964945bd2003415a8a823932be2421e48087c9753319895880d1448f6324b19bb006cdc1afa0a5e1fa4d1a
SSDEEP 192:Xt1d66Joz0dzgCl6mc0drkOv5zbo2ZNbyjqlv:XLd66JozQzgC1jZnbo2ZNbyjq
TLSH
T166E14068EA29863FC404027BCDA61B414F35398ADC8E7F1932AD644C2C572DE7A9E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 1c48ec8c7a5d4ede4b56484aca2fadecc74eb900286dfa3390ffd6af17148e12
MD5 04aa782f2e10be978c72cb403e803e53
SHA1 d1146865292d0e2828141cb62a41fe2d6dbafab2
SHA512 277ddbb97c04609de12bb201f224a1d3a7406f462c3d820f49d3b282f72be945908df0a30aa6fee453ccf3cb4c8cf29d48544057e6e1bdbfb0c88055b196833e
SSDEEP 192:Xc1d66Joz0dzgCl6mc0dMkOv5zboH2ZNbyjqlvT:XGd66JozQzgC1jmnboWZNbyjq1
TLSH
T1EEE14068EA29863FC404027BCDA61B414F35398ADC4E7F1932AD644C2C572DE7B9E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\events\events
Size 1KB
SHA256 664590142beababc6414edbcaa04d7078d18cc5d843154718c82a720d3243ce6
MD5 98b2ee67434614b2f4e93bfa1956bd76
SHA1 a4939bcd04e00b6987071cd4824cec1f7729f7a6
SHA512 77fc6d77bfb97923f3b1a4e5164e598813be88369aca0810c041f3345692fbba12fc3138226d0467b144fb4e0567b10b62bca070f989f13eea4311c796cb0d57
TLSH
T15F216A4C39F84D6A99D7E69CF8A1028E93954E0A05C72C434D62DF8DCDC5ADD326B43D
MD5 SHA1 SHA512 TLSH

Submit Download

0026541d-5ffc-45d3-9217-9f89312b6186

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\0026541d-5ffc-45d3-9217-9f89312b6186
Size 16KB
SHA256 5f1dd3857b92d628e5a7d229e6dbf81275881094aa79e69ff0dce4e3d5290d43
MD5 93709cfff096e93b2cc3a5437c3e438c
SHA1 3c3e56bb0b4193998e3fe420136560587393b4a2
SHA512 ee50abf7738f40491303e892e8c1b5a657ef5c5487588c831cc85328d1da3ae0593231bb37051008d899b96083387b7993ec5e5e3cd1974fb3fc0d29512dee9c
SSDEEP 192:4Kizi97SDb2KC3KlyLUllJvvpIaai0ulIlKETW9EFenmI3T4WkU9JkptThOwWXwo:Bio7SDb2KkKgL0vlcZhOwWXt6Ry
TLSH
T1E972CA462420497A8291E36994FC7FC3E6F538CB4C419FCA9BE4BD486DDE06E512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b204b85-d0a3-453d-a10d-55b1c1c3d916

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\4b204b85-d0a3-453d-a10d-55b1c1c3d916
Size 3KB
SHA256 08469de412f7cf72cc966e25e4ddeefcb2075271903b0bcdc1431b09c28ec679
MD5 8486f433634ccda7f545fa011ba691f9
SHA1 1959d445e8806b3cd025fc52acbab7585ac98441
SHA512 2dd926b43493ed69d3460da111c06238b764bf5d5c490fe8726843cf80ff21a3bc005c61667f0a44d3e5af93b0aada2b064300c7fa4c570df8214e4d08f36b58
TLSH
T1D86172314628A9738EF8B401E3677A548EDF338F58931BCE126ECD2442B8438578F25B
MD5 SHA1 SHA512 TLSH

Submit Download

6e171654-60a4-4d28-bc45-2f9c8483538b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\6e171654-60a4-4d28-bc45-2f9c8483538b
Size 3KB
SHA256 c816c6893a73d7b0cd6ce75c6c4159fbedd06919689636fc59ca3ff485486127
MD5 08a0eb8dd571943ab01eeea7f3ce4bf4
SHA1 79ada10a6dc067a47a19aa72efff3a77d763a353
SHA512 80274ea64c43f6db6aee6f87ea64b95a3b85bda362023df1524e8726f30f40dda46d7f908b21bb9b3bd7e01e5228ef2930af3f549bb06c3af682a9103b338788
TLSH
T164617271462869738EF8A105E36B7A548EDE338F58930BCD226DDD2442B8434578F34F
MD5 SHA1 SHA512 TLSH

Submit Download

8344133b-9f3f-498e-95ab-6ea504d87a5f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\8344133b-9f3f-498e-95ab-6ea504d87a5f
Size 896B
SHA256 096ca135b23b01fdf6558700295eae901ee9b802c484ff5aa98f73647a7e04d4
MD5 2449d29c1d75d62219833034a321c2bf
SHA1 e392b036bc75b54d9eb9f1d225fb953fdfeb713c
SHA512 f9587d2185f06b899a05972bd700f684571abd596044f5a7d85bac2ab7e2aaf692d85c67d7ce8a9feac656f6d2cce47d89febb2ebd251c3ccfea21c5b8229f96
TLSH
T11F110455873479728CA4A24F9DD1774786F47623C0CA49143EA45B080C6A42EA77770B
MD5 SHA1 SHA512 TLSH

Submit Download

83790e06-052f-44ca-a370-7c663e0350ae

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\83790e06-052f-44ca-a370-7c663e0350ae
Size 3KB
SHA256 ca305c5a38745676f858e5be963c8f621ce347e67eb8866237018fece3ebc737
MD5 492ae7690070718a431e8ab6b3569de7
SHA1 07fd87ee876e899e247dc95944f5318cd2095c68
SHA512 773a5733656cd052e1d772468c57e53f1439bfe876cf9a9026f58523a8de1ab2aa3c019c0a3a96d8113b09ea98e155fe47ada3f5923c574fc9c217436a1a21d3
TLSH
T1E86142314668A9739EE8A001E36B7A948ADE339F58531BCA21ADD92442B8434578F34F
MD5 SHA1 SHA512 TLSH

Submit Download

9289590b-b10f-4a3f-950f-2d5e24715f82

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\9289590b-b10f-4a3f-950f-2d5e24715f82
Size 3KB
SHA256 ce10b70e0b9f26ce1f6b21b182e16881e554bf25d29e009f24180e484599b1e0
MD5 f91b969630dee1ea8f88381d008f99ce
SHA1 ad62879ca8f9825de8b00d171b5c693f111ccad4
SHA512 2ad80d3aa08598049bdf6f1e2b550aed4385708142ac5b32fe13da6a4dcd2ea9247bc5b306f2a08e1dcf03cfb72e16f1157dccdc148a993086a8d82e338b4693
TLSH
T127616231862869738EFCB441E36BB9548EDE338F48571BCE116EDD2442A84785B8F24B
MD5 SHA1 SHA512 TLSH

Submit Download

aedecff7-141d-42e2-a108-1eb4b4155905

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\aedecff7-141d-42e2-a108-1eb4b4155905
Size 235B
SHA256 07ab59d4529e82fb8f50aad9ae9c00093b4d28f94fb1c44dc502602795fc2535
MD5 b462c726f7b21d1f44446f3f436bd574
SHA1 f3b7f329ce1099743f96a13dded0721be8cd0d77
SHA512 c4cc7d2c8fc298dd07f5fa89d0879849709053a22dc8d97e1b878fb0275ebb7c519e57d4bb8ae05bca23c036737e593c399275bef48dc816ac4116865fa84b23
TLSH
T1C6D0978024982BAE0C180F0BF0A8A9C230688C339460783096A08238DEBDAC91122826
MD5 SHA1 SHA512 TLSH

Submit Download

b5c93dff-571c-447d-9270-b5803f278d8e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\b5c93dff-571c-447d-9270-b5803f278d8e
Size 235B
SHA256 b1a5a23db02d49aeea22b93a20d499d763e54eaa16ad01bc082ba718ca106740
MD5 bd29cd1fac09339a0adb5e9d772765cb
SHA1 24137fb886667ecf7442582c61836aa914c012e7
SHA512 799a5911a697fc6d2d542f59c787b49cea240a8679cb3fc10507c787a6aed10ce4a450a92536dab2b13842cb3ee0a1781059e68dafc1db5c8fa889ca057fc280
TLSH
T137D097E41898A76D88000F02F0E07DC232488C3720B878208A9206B88BBDEC80162807
MD5 SHA1 SHA512 TLSH

Submit Download

dc0d17c8-d0d1-4920-b719-43bf5d400fb6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\dc0d17c8-d0d1-4920-b719-43bf5d400fb6
Size 3KB
SHA256 dcdea31b4c393fd28187cb82ce3e42bede0823f2e7d97dad9544a288899bb0d4
MD5 7ea8427b4453ec1d0567a979fa92676f
SHA1 576a54c483f44bc61466056865cd4d6b3872c5e3
SHA512 a4f0a43901066815a89ba863f82b9bdbf733df77374c512ef5c43b927d76e323b5c278fe2672b80c3b5f792efc18c3997d91a9f9b87343ccd87e81a5f2f7ce3f
TLSH
T11E6172714628A9738EFCA045A3677A548EDE338F48530BCD12AE8D2442F8434578F34B
MD5 SHA1 SHA512 TLSH

Submit Download

f18ffc98-6ed6-4584-b831-b547359dd4ee

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\f18ffc98-6ed6-4584-b831-b547359dd4ee
Size 2KB
SHA256 498ed92e5d1840e6e641254ee784b6be67f70a27679859a33955405c6c83729b
MD5 84fe21cacb757b9dda3b3cbf4838f7da
SHA1 81ae1ceffd9b5768184608ac586db61495c888ad
SHA512 a77673ebc02977758b62ba993c182286dd1e0481e953e3aad00d7360d9e0972f8e3c1a9a34f1aae83cf81f0f12dbd6638bfeb322731205702fbb843e652f7c6e
TLSH
T19F41236CB5784C7A8CDBF99D94C2338D53788A0340C61D532E51DF4C8CDA69A33BA427
MD5 SHA1 SHA512 TLSH

Submit Download

f32e0904-2bf2-4da5-8227-2b8162ea819c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\f32e0904-2bf2-4da5-8227-2b8162ea819c
Size 883B
SHA256 16472832da36f1b2e524dcbfaecfcfbccdf46347f2f05fade659fb6306f32c25
MD5 2f9ed8bcceecc554b5f5f8c8f38cfc2a
SHA1 0eb1c302ea807e84fb8aa04ba0307a563591f9fe
SHA512 cba6d33917a01f40827b0d6d05f6a6d89ce508e17be73fc82614cbb054322113695d65501b92db07f76b237a422d847c5e4ea3749954885ce53d4888c506515b
TLSH
T16411E750D6357971CC74A15F899137524BE87523C0C685243EF45F084D6F52FD7A970B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\prefs.js
Size 6KB
SHA256 3ff197d881139a47b17dce8d4df742c112a0fa0dcda38167659864a4aac15ece
MD5 a07a3bf48bba858f57301b05648f97a2
SHA1 55f7c99530f0d1c308b12afbba073a93e08620b6
SHA512 33b10c8c5d8da6e5704dd975260ce11467527f04a8612d0857cdd0b32f790ece3620c68075e01202911e65bc095b86e109e7d89b4eee722235fc184f87035bfe
SSDEEP 96:xHWgUTUaqGqFyzf3KjCnjo1zS1SSlldv9jknoHdDaCHV4Bw88H8L4cni0v:FdRFgf3lEASS90CHWBw88q
TLSH
T182E1307894088F7F64B6776CAC688871AAB2413BB7BF68C350B544C5055CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2452-51-0x0000022708FA0000-0x0000022708FB0000-memory.dmp

Download

memory/2484-31-0x0000000006480000-0x00000000064E6000-memory.dmp

Download

memory/2484-29-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/2484-37-0x0000000006720000-0x0000000006796000-memory.dmp

Download

memory/2484-36-0x0000000006870000-0x0000000006A32000-memory.dmp

Download

memory/2484-35-0x00000000065F0000-0x00000000066A2000-memory.dmp

Download

memory/2484-1280-0x00000000015D0000-0x000000000177C000-memory.dmp

Download

memory/2484-1278-0x0000000007FA0000-0x0000000007FAA000-memory.dmp

Download

memory/2484-39-0x0000000006F70000-0x000000000749C000-memory.dmp

Download

memory/2484-40-0x0000000005C80000-0x0000000005C9E000-memory.dmp

Download

memory/2484-1269-0x00000000074A0000-0x00000000077F7000-memory.dmp

Download

memory/2484-1277-0x0000000008000000-0x0000000008092000-memory.dmp

Download

memory/2484-394-0x00000000015D0000-0x000000000177C000-memory.dmp

Download

memory/2484-30-0x0000000005D60000-0x0000000006306000-memory.dmp

Download

memory/2484-1268-0x0000000006C60000-0x0000000006C82000-memory.dmp

Download

memory/2484-395-0x0000000001780000-0x000000000185F000-memory.dmp

Download

memory/2484-38-0x00000000067A0000-0x00000000067F0000-memory.dmp

Download

memory/2484-1273-0x0000000006CD0000-0x0000000006CD7000-memory.dmp

Download

memory/4292-2-0x00000212409B0000-0x00000212409BC000-memory.dmp

Download

memory/5004-28-0x00000266289B0000-0x00000266289C0000-memory.dmp

Download

memory/5004-22-0x00000266289B0000-0x00000266289C0000-memory.dmp

Download

memory/5004-17-0x0000026628AC0000-0x0000026628AE2000-memory.dmp

Download

memory/5004-13-0x00000266289B0000-0x00000266289C0000-memory.dmp

Download

memory/5004-14-0x00000266289B0000-0x00000266289C0000-memory.dmp

Download

memory/5004-24-0x00000266106B0000-0x00000266106C4000-memory.dmp

Download

memory/5004-26-0x00000266106C0000-0x00000266106C6000-memory.dmp

Download

memory/5004-27-0x00000266289B0000-0x00000266289C0000-memory.dmp

Download

memory/5004-32-0x000002660EB70000-0x000002660EB7C000-memory.dmp

Download

memory/5004-33-0x00000266288A0000-0x00000266288B2000-memory.dmp

Download

memory/5004-34-0x00000266289B0000-0x00000266289C0000-memory.dmp

Download