phantom_stealer | b5a692c8627d6485773a81c1d0a5f806d62980b933d6b3ee6be2cdd9f5e91dd0

Analysis

max time kernel
35s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b5a692c8627d6485773a81c1d0a5f806d62980b933d6b3ee6be2cdd9f5e91dd0.exe
Size 1.5MB
Sample260707-rmx1jsbv8v
SHA256 b5a692c8627d6485773a81c1d0a5f806d62980b933d6b3ee6be2cdd9f5e91dd0
MD5 50f71f27947902cfb4cc78c6cb26d036
SHA1 f767c0e98900640bb48100cb139ed154e904077c
SHA512 3b6b45be09d7e942328cef0728125fd5cbf15e6973ddae868d6c29bb59bc4882d080bb413b2328cfd0142e1a77f5d2dd0d973e97a9d0c42b5ccff3d8b729a440
SSDEEP 24576:GmcEVM6EdWxSTwnGlhwCHNwwd2+njJGNdNqHLZH9nQ5uypn5VIJAjlXA6r+:m8KWxcwKrdBnjJkdcZFQ5dprIK9Ac+
TLSH
T1DC7512945B29D506DE1157785BB0F1B813EC2EEAB912E2165FD8BDFBBD36E044C08283
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery execution phantom_stealer persistence spyware stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.gencay-insaat.com.tr
Port
587
Username
[email protected]
Password
Muhasebe581903

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
mail.gencay-insaat.com.tr
Port
587
Username
[email protected]
Password
Muhasebe581903
Email to
[email protected]

Mutex

XG71LIFOBOOO57AY702H

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 1 IoCs

resource	yara_rule
behavioral2/memory/5788-12-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3568	powershell.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	icanhazip.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2808 set thread context of 5788	2808	b5a692c8627d6485773a81c1d0a5f806d62980b933d6b3ee6be2cdd9f5e91dd0.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5a692c8627d6485773a81c1d0a5f806d62980b933d6b3ee6be2cdd9f5e91dd0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5a692c8627d6485773a81c1d0a5f806d62980b933d6b3ee6be2cdd9f5e91dd0.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4892	chrome.exe
3400	msedge.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{C46A6306-D7CE-497B-A4E2-A82887BC3D9A}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{4A45AE7A-F601-414A-A4D0-7ABDEC667275}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2808	b5a692c8627d6485773a81c1d0a5f806d62980b933d6b3ee6be2cdd9f5e91dd0.exe
2808	b5a692c8627d6485773a81c1d0a5f806d62980b933d6b3ee6be2cdd9f5e91dd0.exe
2808	b5a692c8627d6485773a81c1d0a5f806d62980b933d6b3ee6be2cdd9f5e91dd0.exe
2808	b5a692c8627d6485773a81c1d0a5f806d62980b933d6b3ee6be2cdd9f5e91dd0.exe
3568	powershell.exe
3568	powershell.exe
4912	explorer.exe
4912	explorer.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2808	b5a692c8627d6485773a81c1d0a5f806d62980b933d6b3ee6be2cdd9f5e91dd0.exe
Token: SeDebugPrivilege	5788	b5a692c8627d6485773a81c1d0a5f806d62980b933d6b3ee6be2cdd9f5e91dd0.exe
Token: SeDebugPrivilege	3568	powershell.exe
Token: SeShutdownPrivilege	4912	explorer.exe
Token: SeCreatePagefilePrivilege	4912	explorer.exe
Token: SeShutdownPrivilege	4912	explorer.exe
Token: SeCreatePagefilePrivilege	4912	explorer.exe
Token: SeShutdownPrivilege	4912	explorer.exe
Token: SeCreatePagefilePrivilege	4912	explorer.exe
Token: SeShutdownPrivilege	4912	explorer.exe
Token: SeCreatePagefilePrivilege	4912	explorer.exe
Token: SeShutdownPrivilege	4912	explorer.exe
Token: SeCreatePagefilePrivilege	4912	explorer.exe
Token: SeShutdownPrivilege	4912	explorer.exe
Token: SeCreatePagefilePrivilege	4912	explorer.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1288	sihost.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4912	explorer.exe
4912	explorer.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 3568	2808	b5a692c8627d6485773a81c1d0a5f806d62980b933d6b3ee6be2cdd9f5e91dd0.exe	88
PID 2808 wrote to memory of 5604	2808	b5a692c8627d6485773a81c1d0a5f806d62980b933d6b3ee6be2cdd9f5e91dd0.exe	90
PID 2808 wrote to memory of 5788	2808	b5a692c8627d6485773a81c1d0a5f806d62980b933d6b3ee6be2cdd9f5e91dd0.exe	91
PID 2808 wrote to memory of 5788	2808	b5a692c8627d6485773a81c1d0a5f806d62980b933d6b3ee6be2cdd9f5e91dd0.exe	91
PID 2808 wrote to memory of 5788	2808	b5a692c8627d6485773a81c1d0a5f806d62980b933d6b3ee6be2cdd9f5e91dd0.exe	91
PID 2808 wrote to memory of 5788	2808	b5a692c8627d6485773a81c1d0a5f806d62980b933d6b3ee6be2cdd9f5e91dd0.exe	91
PID 2808 wrote to memory of 5788	2808	b5a692c8627d6485773a81c1d0a5f806d62980b933d6b3ee6be2cdd9f5e91dd0.exe	91
PID 1288 wrote to memory of 4912	1288	sihost.exe	98

C:\Users\Admin\AppData\Local\Temp\b5a692c8627d6485773a81c1d0a5f806d62980b933d6b3ee6be2cdd9f5e91dd0.exe
"C:\Users\Admin\AppData\Local\Temp\b5a692c8627d6485773a81c1d0a5f806d62980b933d6b3ee6be2cdd9f5e91dd0.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b5a692c8627d6485773a81c1d0a5f806d62980b933d6b3ee6be2cdd9f5e91dd0.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3568
- C:\Users\Admin\AppData\Local\Temp\b5a692c8627d6485773a81c1d0a5f806d62980b933d6b3ee6be2cdd9f5e91dd0.exe
  "C:\Users\Admin\AppData\Local\Temp\b5a692c8627d6485773a81c1d0a5f806d62980b933d6b3ee6be2cdd9f5e91dd0.exe"
  2⤵
  PID:5604
- C:\Users\Admin\AppData\Local\Temp\b5a692c8627d6485773a81c1d0a5f806d62980b933d6b3ee6be2cdd9f5e91dd0.exe
  "C:\Users\Admin\AppData\Local\Temp\b5a692c8627d6485773a81c1d0a5f806d62980b933d6b3ee6be2cdd9f5e91dd0.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr"
    3⤵
    PID:5420
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffe22f6c728,0x7ffe22f6c734,0x7ffe22f6c740
      4⤵
      PID:5704
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1860,i,18216433442585661807,17083076012148937802,262144 --field-trial-handle=2264,i,13534148012043465986,13314165006256366821,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
      4⤵
      PID:4252
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1936,i,7131427075388927490,8084876322212026686,524288 --field-trial-handle=2264,i,13534148012043465986,13314165006256366821,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:11
      4⤵
      System Time Discovery
      PID:4892
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr" --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,8479532429066207,15660144165351807997,524288 --field-trial-handle=2264,i,13534148012043465986,13314165006256366821,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:13
      4⤵
      PID:3468
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,1239964203175003120,18200851053472440193,2097152 --field-trial-handle=2264,i,13534148012043465986,13314165006256366821,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:1
      4⤵
      PID:4204
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3200,i,16918630318830423436,18159823805384961161,2097152 --field-trial-handle=2264,i,13534148012043465986,13314165006256366821,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:1
      4⤵
      PID:3936
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3476,i,4724011950122034854,17509601554318571977,2097152 --field-trial-handle=2264,i,13534148012043465986,13314165006256366821,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:256
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3488,i,13840788295455865394,7291987516663633110,2097152 --field-trial-handle=2264,i,13534148012043465986,13314165006256366821,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:9
      4⤵
      PID:4696
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4228,i,5449252906305100008,17928995312211466376,2097152 --field-trial-handle=2264,i,13534148012043465986,13314165006256366821,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:9
      4⤵
      PID:6068
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr" --force-high-res-timeticks=disabled --metrics-shmem-handle=4528,i,12080398066077110643,2236961740162858293,524288 --field-trial-handle=2264,i,13534148012043465986,13314165006256366821,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:14
      4⤵
      PID:1856
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4584,i,14929316357412291949,3917789521884473931,2097152 --field-trial-handle=2264,i,13534148012043465986,13314165006256366821,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:1
      4⤵
      PID:2388
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr" --force-high-res-timeticks=disabled --metrics-shmem-handle=4500,i,4783011138196599778,10981915716718927087,524288 --field-trial-handle=2264,i,13534148012043465986,13314165006256366821,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:14
      4⤵
      PID:5888
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr" --force-high-res-timeticks=disabled --metrics-shmem-handle=4704,i,2542299909698337377,776738228921406555,524288 --field-trial-handle=2264,i,13534148012043465986,13314165006256366821,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:14
      4⤵
      PID:4340
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr" --force-high-res-timeticks=disabled --metrics-shmem-handle=4564,i,10694587476487394492,10233640219188894105,524288 --field-trial-handle=2264,i,13534148012043465986,13314165006256366821,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:14
      4⤵
      PID:1856
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4592,i,8200249959470352220,14663438099198800494,2097152 --field-trial-handle=2264,i,13534148012043465986,13314165006256366821,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
      4⤵
      PID:5752
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4616,i,7441466049278196273,15878093016794141875,2097152 --field-trial-handle=2264,i,13534148012043465986,13314165006256366821,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
      4⤵
      PID:3348
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4704,i,7011839500425923218,12631608510131755194,2097152 --field-trial-handle=2264,i,13534148012043465986,13314165006256366821,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
      4⤵
      PID:1480
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      PID:4456
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff723b555a0,0x7ff723b555ac,0x7ff723b555b8
        5⤵
        
        PID:2348
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        
        PID:5520
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x264,0x29c,0x7ff723b555a0,0x7ff723b555ac,0x7ff723b555b8
        6⤵
        
        PID:5200
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5448,i,3377018597457394852,13123585465697992877,2097152 --field-trial-handle=2264,i,13534148012043465986,13314165006256366821,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:1
      4⤵
      PID:6268
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr" --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,5352489134891695110,18270051934421462,524288 --field-trial-handle=2264,i,13534148012043465986,13314165006256366821,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:14
      4⤵
      PID:6276
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr" --force-high-res-timeticks=disabled --metrics-shmem-handle=4728,i,9705144000713074632,6102711903881984544,524288 --field-trial-handle=2264,i,13534148012043465986,13314165006256366821,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
      4⤵
      PID:6284
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5332,i,6812899963250871790,2819175530843831367,2097152 --field-trial-handle=2264,i,13534148012043465986,13314165006256366821,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:1
      4⤵
      PID:6292
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4576,i,12318764788178845490,15093771783263920821,2097152 --field-trial-handle=2264,i,13534148012043465986,13314165006256366821,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
      4⤵
      PID:6484
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5472,i,115962571998146623,10900410108161926246,2097152 --field-trial-handle=2264,i,13534148012043465986,13314165006256366821,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
      4⤵
      PID:6704
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5628,i,17088115180185613556,16666244118908026677,2097152 --field-trial-handle=2264,i,13534148012043465986,13314165006256366821,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
      4⤵
      PID:6712
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr" --force-high-res-timeticks=disabled --metrics-shmem-handle=5740,i,15356776541557140530,14737050159981112878,524288 --field-trial-handle=2264,i,13534148012043465986,13314165006256366821,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
      4⤵
      PID:6168
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr" --force-high-res-timeticks=disabled --metrics-shmem-handle=5760,i,6937260804957319030,2473917672929576857,524288 --field-trial-handle=2264,i,13534148012043465986,13314165006256366821,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
      4⤵
      PID:6164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ld1xscve.sas"
    3⤵
    PID:6636
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ld1xscve.sas
      4⤵
      PID:6620
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2028 -initialChannelId {3ddb41de-52d3-4aac-8939-f41ebe207477} -parentPid 6620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6620" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:6980
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2448 -prefsLen 27133 -prefMapHandle 2452 -prefMapSize 270279 -ipcHandle 2460 -initialChannelId {d0c0d3af-5d2e-4293-a5a4-5aff58ca9d68} -parentPid 6620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:4756
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\64c6d323-40a7-4caf-a61a-55b2e9ca618f.dmp"
        5⤵
        
        PID:7052
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27133 -prefMapHandle 3020 -prefMapSize 270279 -ipcHandle 3056 -initialChannelId {df211748-9186-4f42-9849-94cd7e234611} -parentPid 6620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6620" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:1264
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\005aee8b-b606-4065-8017-f2492d6add46.dmp"
        5⤵
        
        PID:3412
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3180 -prefsLen 27133 -prefMapHandle 3020 -prefMapSize 270279 -ipcHandle 3100 -initialChannelId {f188da1f-9d31-4764-b532-657ea5203965} -parentPid 6620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6620" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:7108
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f055a976-1654-4644-9f8e-aa7ea67a9113.dmp"
        5⤵
        
        PID:1472
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3328 -prefsLen 27133 -prefMapHandle 3332 -prefMapSize 270279 -ipcHandle 3340 -initialChannelId {e2b0e967-c902-4227-94d6-c28d1de40792} -parentPid 6620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6620" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:2312
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\89bf175e-1f32-4a26-ac16-cdd1c70ee82e.dmp"
        5⤵
        
        PID:6460
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3340 -prefsLen 27198 -prefMapHandle 2616 -prefMapSize 270279 -ipcHandle 3204 -initialChannelId {1f5e88f5-3aeb-43bf-b060-a26b01156e7e} -parentPid 6620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6620" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:3312
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3876 -prefsLen 27323 -prefMapHandle 3880 -prefMapSize 270279 -jsInitHandle 3884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3892 -initialChannelId {e7275c9d-8ee5-46f8-af1a-43b2f7b36b6f} -parentPid 6620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        5⤵
        
        PID:6388
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\fd20ebd3-c61a-47b7-a841-79014d2f506c.dmp"
        5⤵
        
        PID:6288
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3200 -prefsLen 27323 -prefMapHandle 3916 -prefMapSize 270279 -ipcHandle 3860 -initialChannelId {932fce6d-721f-45b5-90a0-9dd8ef5e9d8a} -parentPid 6620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6620" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 gpu
        5⤵
        
        PID:6404
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c3827037-31df-4b97-89f5-90a628f74568.dmp"
        5⤵
        
        PID:4284
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4216 -prefsLen 27323 -prefMapHandle 4212 -prefMapSize 270279 -ipcHandle 4292 -initialChannelId {be720287-0112-4165-96ad-9dad92e6cf91} -parentPid 6620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6620" -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 rdd
        5⤵
        
        PID:2464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i"
    3⤵
    PID:1208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x26c,0x7ffe2165c188,0x7ffe2165c194,0x7ffe2165c1a0
      4⤵
      PID:476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=2200,i,18178572934237578731,11765671006206014009,262144 --field-trial-handle=2660,i,13772064259609879179,3394946836523928650,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:2
      4⤵
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,14889008716935459588,3976882171321358998,524288 --field-trial-handle=2660,i,13772064259609879179,3394946836523928650,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:11
      4⤵
      System Time Discovery
      PID:3400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2748,i,9610972335026522769,12476034647179281653,524288 --field-trial-handle=2660,i,13772064259609879179,3394946836523928650,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:13
      4⤵
      PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,9758748863964645821,3422290097564630127,2097152 --field-trial-handle=2660,i,13772064259609879179,3394946836523928650,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,9820602797609766506,1020268474458397773,2097152 --field-trial-handle=2660,i,13772064259609879179,3394946836523928650,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3864,i,14424693533253358019,14529691489044075088,524288 --field-trial-handle=2660,i,13772064259609879179,3394946836523928650,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:14
      4⤵
      PID:3196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3872,i,5280501752525285356,2161199632919328307,524288 --field-trial-handle=2660,i,13772064259609879179,3394946836523928650,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:14
      4⤵
      PID:7000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3876,i,4063574357837198588,17985753748050467472,524288 --field-trial-handle=2660,i,13772064259609879179,3394946836523928650,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:14
      4⤵
      PID:6816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3912,i,13466383742606477415,1831485524184343904,2097152 --field-trial-handle=2660,i,13772064259609879179,3394946836523928650,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:1
      4⤵
      PID:6748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4080,i,6126590063713276291,9935842432640131752,2097152 --field-trial-handle=2660,i,13772064259609879179,3394946836523928650,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:9
      4⤵
      PID:7024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4136,i,9285564465943017859,17217149950151658488,2097152 --field-trial-handle=2660,i,13772064259609879179,3394946836523928650,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:1
      4⤵
      PID:1136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4188,i,3061933875786610141,8549936073528921875,2097152 --field-trial-handle=2660,i,13772064259609879179,3394946836523928650,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:9
      4⤵
      PID:6992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4152,i,7670772345571195626,13606534133922967536,2097152 --field-trial-handle=2660,i,13772064259609879179,3394946836523928650,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
      4⤵
      PID:6244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4220,i,2698251933136592374,8165302720368652696,2097152 --field-trial-handle=2660,i,13772064259609879179,3394946836523928650,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:9
      4⤵
      PID:7152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4232,i,10568029887608344828,12104746281263441773,2097152 --field-trial-handle=2660,i,13772064259609879179,3394946836523928650,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
      4⤵
      PID:6444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4248,i,10620163159070998758,10354103977957990972,2097152 --field-trial-handle=2660,i,13772064259609879179,3394946836523928650,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:9
      4⤵
      PID:1316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4260,i,8323644489834968179,8598647337697711503,2097152 --field-trial-handle=2660,i,13772064259609879179,3394946836523928650,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:1
      4⤵
      PID:3312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4312,i,11439890484198834032,16909337055255190346,2097152 --field-trial-handle=2660,i,13772064259609879179,3394946836523928650,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:9
      4⤵
      PID:6104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,13375124051591914177,6756092196126072496,524288 --field-trial-handle=2660,i,13772064259609879179,3394946836523928650,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:14
      4⤵
      PID:6184
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1152
        5⤵
        
        PID:6344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,11645247170125733647,4089228416456158878,524288 --field-trial-handle=2660,i,13772064259609879179,3394946836523928650,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
      4⤵
      PID:6612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,13392297709441930351,15999714227836807656,524288 --field-trial-handle=2660,i,13772064259609879179,3394946836523928650,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:14
      4⤵
      PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,12963068552091781022,1963571728964062022,524288 --field-trial-handle=2660,i,13772064259609879179,3394946836523928650,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
      4⤵
      PID:3268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=632
        5⤵
        
        PID:1692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,15278488250070956118,8574404892742088090,524288 --field-trial-handle=2660,i,13772064259609879179,3394946836523928650,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
      4⤵
      PID:4828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,3059068352861285015,4317651517389299042,524288 --field-trial-handle=2660,i,13772064259609879179,3394946836523928650,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7072,i,4155780001024025836,3684485880091199481,524288 --field-trial-handle=2660,i,13772064259609879179,3394946836523928650,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:14
      4⤵
      PID:2976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7072,i,4155780001024025836,3684485880091199481,524288 --field-trial-handle=2660,i,13772064259609879179,3394946836523928650,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:14
      4⤵
      PID:2420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7352,i,7998186195299912003,12060906982811129474,524288 --field-trial-handle=2660,i,13772064259609879179,3394946836523928650,262144 --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:14
      4⤵
      PID:6344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7396,i,16672910090958140732,10757193561045500283,524288 --field-trial-handle=2660,i,13772064259609879179,3394946836523928650,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:14
      4⤵
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      PID:1144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x7ff73a3d04c8,0x7ff73a3d04d4,0x7ff73a3d04e0
        5⤵
        
        PID:4952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        
        PID:6212
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff73a3d04c8,0x7ff73a3d04d4,0x7ff73a3d04e0
        6⤵
        
        PID:4240

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4912

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2260

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:4204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4456_13427907614171993.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\4456_13427907614171993.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

5520_13427907614115907.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5520_13427907614115907.pma
Size 696B
SHA256 d6268725cfa76d8df7039e256ae2e2a7a298d24d82b59f8a9375ae9ec87010c3
MD5 b34e20fccd7f13ad261ceb273e057bb7
SHA1 0876193d2b15de02168975af38e7b99f1f2683a8
SHA512 637c5c32028aa9179b12fc7a8ff5b958f5db42dda26f78567f2b67e60e5f3ca8916ab240b4cef36bff2efde9545027df22fd1a07ea245d783c60e759edaa2de9
TLSH
T1BD01C986A3544F67CC468D7984BE27512BB4FA502B821BBF7B10764F2E021C89E99168
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr\Default\Preferences
Size 11KB
SHA256 5346ad113477788baa1641dd2f8885d92939d037334cc250e0a685895b739033
MD5 9c046cc5429e81015221019460cd12f5
SHA1 0ddefabff6736ebd5303490a4a7d92b4961542b7
SHA512 d671274f939a50f7f1cbcbd82106f87f6ed47330a3a6439e81b6ddd0465a59a33c5ed0a6dc9f9aab7a32fca69dae230e9a40ac6cb934490967515815322ed2cd
SSDEEP 192:wRoB6Fpv7uvAPRp2ZXsb+WNnJO2wo/BbGdiyIsnAUgR:wRoBWpC6XSXwI2woZR
TLSH
T14532C62EAA196A7F5CCBD21AFA783753E7F2102231901D44D7FC9A2C19D75DC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a23f4.TMP

Path C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr\Default\Preferences~RFe5a23f4.TMP
Size 3KB
SHA256 9d076f8e6545eb52332d8997ce407ce6f14f6648574c32a7ba9d541e70e4be21
MD5 52916ba291e897894a9b58d78c4860cf
SHA1 97b5cd58b0c0dc2e9c21309f863f1efc577b9847
SHA512 00cc233d25bb095dfbf763503ef6beeaeb0748899cb52e06230206f5b71acec13b4d5ca62fdd06c3a62690dc66da1f39e1b659fabe0e11fff3a02acd4d616f30
TLSH
T1896163A8C6755EAB1EFA7674B87C1781FE61433F110008563A3D058D0FB287B8044F5A
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr\Local State
Size 3KB
SHA256 66967149c0f9a8aa37001bcc76fb992210e5feb49f9482988fa68425af121e20
MD5 3b6a808522712c8c5b6a78e5026ea1be
SHA1 17e488f955b27f25d6ea23688025fb097c1f7854
SHA512 171315dbd1e0e7dd3b6d99c7182b11a277d7eb4c8a7d65a47fe1ec7c108acddc8fcc861a0f0bd6a490909b25f7cd9faa430b10407bf44c79e94215ae64f0f217
TLSH
T1E381D6BAB42E9D33187BC146B1552E03CF746166A621AED8D9DD0F0C02EB1EC1306923
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5a2329.TMP

Path C:\Users\Admin\AppData\Local\Temp\42rmozhs.ylr\Local State~RFe5a2329.TMP
Size 1KB
SHA256 7c92102a5619c0767a858b563e5b48c7c722b70de529f5ba6c3138da1ed09cf5
MD5 c892c7ad54d2e232641ee73183655eef
SHA1 f2ec71d1bf779cbea2aa028d1a82b60a13676036
SHA512 0d221d4d21392a40e5d582186e3f85933e22febe8242e8943dcb797c26851b275ef93756b67d0af6b1ffea52393eec738126a53baffe5b06dd1409919d438d59
TLSH
T1181179F9691D7634B847C64BA25097679F385366C5B1D98C6DCE0E0805B979C3207C35
MD5 SHA1 SHA512 TLSH

Submit Download

59f9dfd8-b501-4534-b120-96ec61ec3ebd.tmp

Path C:\Users\Admin\AppData\Local\Temp\59f9dfd8-b501-4534-b120-96ec61ec3ebd.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

b6a2387f-99a4-4b3e-a7d5-a0f85862bd08.tmp

Path C:\Users\Admin\AppData\Local\Temp\b6a2387f-99a4-4b3e-a7d5-a0f85862bd08.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i\Crashpad\settings.dat
Size 280B
SHA256 35f85b6878a5f472aa8b7847174549f993e9becb389ff60119968e25efdde01a
MD5 86db676f8097b866b30c52791b629311
SHA1 d7715dfaa69de187d0574fd99a5fb978bd396d86
SHA512 3bc5c81a7e6d4fc713d1d996cf83e076b10e0e52c4e2358e48887e8b6b4f4f1c4176b0dfd9a8c5a4b7fca97a427fc655f12d39c33747149a8b35e89e9bf01ead
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i\Crashpad\settings.dat
Size 280B
SHA256 31538290a136ac479487b080a8b6f0ef8d9d8240c04b08be6ad2282028268f55
MD5 b7684184c4303a5f67e71341d00836cc
SHA1 090ec13505c5decff21484c01153ab23e9d309a7
SHA512 20b8ff14e542a8184640c852a4631ff87ce3c2f6a00fe04a402b69edbdade826d61bcbdf4ec46626595df16d6550adda2b6ac5db87d347e1f63a0ebb897b7193
TLSH
T1B6D02200B30888A3C00220320333A3C82882B8000C00B23888EC80CAEBE3B03BB2C88A
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 be9137c445b47ae7c4feb2c27ea69c765815e0c4b588d9a68a800e6dd4599f6f
MD5 c0ef3e68a71a91c684e361535bca5afb
SHA1 5fec7e50dc106f57e2c6a3b20ae55fd9b260defe
SHA512 747512b8e081b85e74ef986bcd004a742841865cc952bc19918cf4d0cc3893918bce3ca9a2ae3964d7de0709228f6521669bba49e0e879cf7304e2ceba0ec6fc
TLSH
T16ED02BFB28A624109AFF87DB643184D144417C549905AC8D113EF78751712523D12C75
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 4125b474f7f181af73ab59d3b38251102c0fd6e246ecab066e3610593c64bac5
MD5 c1ea80021aa2c5e5accd96dcfdb57f31
SHA1 a0262b52b4e2f5a6e748ed7b5cc68fda00ebf1b8
SHA512 79bd628ee0e8dfd14de60043145eafc0b3ac6d3cdb478cfd0668ec5b5128a199ec4e6f70b41cf7facdb86e96eb87dc8cb2ee3da222503272024ad8f97caaf729
TLSH
T15AE0D8BB2DF73810E9FFC7EA6431849104457D548905BC8E2126F2C795B12563C55C25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a83c8.TMP

Path C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe5a83c8.TMP
Size 153B
SHA256 9b6a01a084bcc146d813b601e77c0a21fb37649ddeab7694a84df99995b7abca
MD5 97ad7524ecaddfa13a188c0261e2a695
SHA1 54a5494b5e7c1bc0d4a07839859d967d010180f0
SHA512 93f843d651c94f2ec163800257c596e8c80440e43808de5a5c52d68f69540a8054e5bd6810a40f5196c4bb180de0746de298445548268b8e2ee5193e29582c11
TLSH
T10AC02BFF2E561400EFCB87DB803248D145163CC88944EC99011EF3C332301223522C71
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 847994e274e86c7137407e6ec3ef6e9dddbdff0ce0e309c9c523ba7109a65954
MD5 6e676f450911055bdfe5b3e0c2c71374
SHA1 e29c6f1acff2d39e015a9b9637932335c043533c
SHA512 e1924ecff0361c0f79019dfb65e87b71e6a6d3ef99da3c58b069b922cb3ee294aad2deaa5e79bb31353a23f341ed062e41e1c8ebaee4c9b3f018bdc46c6a015a
TLSH
T160216B92223B42442C7D252C8264C416F2D5746B311CE86E77B901B54F27F038DFF9EA
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i\Local State
Size 7KB
SHA256 0dc5a0920639d2f2c50d4a8a2391082ed77f8fce8670bdb11828d5bdae54869c
MD5 bc97a9fab23e0d63d83e10e3a3842791
SHA1 bc418d3266c49c47096d509a751772a403d225c2
SHA512 23553205726838a5eb416d38cc9cf7f4e77ae2daab6a5d410d83f90be6efd2fcd6612a6c4bcc8a4d5a3bbd3400427fbd58aa146535f0b7c3bdb7d9f373f789d2
SSDEEP 96:zuPq8NkZQamVuf/PxBlx/CDSzjOsP8Frh/cIimURoDoto+5x2geD3BFGYevNLky7:zH8NBlQPL6D0jg2oDUhexFGem6mq0cBu
TLSH
T1A3F1067668359D3398FAA449B5493B139F7860B3E8446F98D5DCAB0D02DB39D2306C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i\Local State
Size 4KB
SHA256 dbef5af1becd24de640d21244c81c384bd75447273262157e1daf65b94029052
MD5 d832ed62458bd4e12dc14cd14335ccae
SHA1 1fb93ad2cdd7acbd18284b37ac4ea664fa592ec7
SHA512 7bb29f72d44ee738ae3efbb8cc92ec9dc06332301b8d96c975c01993a9cd8004f12b3777b062a3713cbe6bf0eef156435e188f5751b598a2a9ea1b407811690d
SSDEEP 96:JqGNkjsFf/PxBlx/ChOs1C7yDyB8PivNqkyCvm0eUn05QqXq4a:wGNkaPL6hFzSGQDvmq0s
TLSH
T16481A7B26929DD336DF6A948758A37939E343073E941AF48E1D8631C01EB75C2B0AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i\Local State
Size 5KB
SHA256 4426b5368ff803b10c8afa21af47d264f71b17863f07027c81429ab1ddc70efd
MD5 6f095ea750ff275317529412b0708644
SHA1 05932351cf1d09aeea57a6a1422c2956b014e1c5
SHA512 869ea952739413dc7192f5873abb941bf0bc92ff5f1736bcb701f5f8e21577b9778234380915b4b399d91a6f4641665c0df2161757cc943963a7d1f0a3a8b498
SSDEEP 96:JqGNkUQsFf/PxBlx/ChOs58Frh/cInURoDotovxuyD5B8PivNqkyCvm0eUn05Qqo:wGNwaPL6h6ooDUwBfGQDvmq0s
TLSH
T1EBB1B6726929DD275DF6A94475CA3753AE643033E844BF8CD2EC6B0C01E73982746C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a58b0.TMP

Path C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i\Local State~RFe5a58b0.TMP
Size 1KB
SHA256 74c682802dedb610bb517797ca3332d6d896305039fc9f437999d58b618f0852
MD5 b79fcdefb21e6c8382c6d3ea1e4e9594
SHA1 397569f3e0d4794771b52389443e93d7902202d2
SHA512 6f86d0f868b7ffaab4e360d6bbc24607d19ea7504d023bd1a0550a682322ec72029aba55787c23833889e9e6c8769003cad9153adee0bd5d802edee1459bf7d1
TLSH
T1E73174B1AE681E73FCE18586638E7A535E301032D1415E8851ECAB1C03E76DC5359C3B
MD5 SHA1 SHA512 TLSH

Submit Download

721157f1-0719-4a0b-a3b8-fbb42f491143.tmp

Path C:\Users\Admin\AppData\Local\Temp\yusu2ez1.g4i\component_crx_cache\721157f1-0719-4a0b-a3b8-fbb42f491143.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 53f8efd986e649d1c7a5ef2e3378510ca8c2515fdb39b9cd47675205a5db57a6
MD5 9e746528bccb31d6619d09ed7e6125a0
SHA1 6d5cc8fd9baf6938f2bd544d536810fbfa205a6a
SHA512 609b11711fbb50931510e6639c6636d2b03ac673348ea20a5374b6b42a975eac401e8074e8d0c489371cc1d67a089cc0da5e0cf3cd6b1ff6a00bb7427d86e847
SSDEEP 48:01/e0dOHa3wZ4tWJ9zCNYSkdLXuHOpWW8/e0dOHySyvyb4tWJ9zvYSngdLXuHV26:0gNJo2uuQWt8r6TJvtIunZ
TLSH
T1C29100105BE20F56F3F7EA7295737B10AF7BFD0A4E188A1E048541090C72A0499B9FE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

005aee8b-b606-4065-8017-f2492d6add46.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\005aee8b-b606-4065-8017-f2492d6add46.dmp
Size 76KB
SHA256 de8074da1698a86fce72f93dacf4948077698ace1120da3e28207052a073cf4e
MD5 694f91bb75c2d19b855617a5376c5945
SHA1 cc99680f8f2ef8afa795b231e03edc8208f69235
SHA512 91dc9b01870b697e7841e02263b8cf9cf97a9f9d1a0701d1ed8b2240e970e52cffe8f919c67669cf58854ca1ce97fd4697c6498f63aaaadea65fdd79cbc25b32
SSDEEP 384:bS/++dcFp4gIC5C5Kx2s0FCtXyWK3OaUKjOD9l1HiDUcaI9+vWC2uA27y3T0KCzK:gUxWZjOD9CgaeWXuAP05Hc
TLSH
T12273CA22A7CC2422E1269B7D5BE7AB413BFAE82107538B4F0251477E2C677557E30F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

005aee8b-b606-4065-8017-f2492d6add46.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\005aee8b-b606-4065-8017-f2492d6add46.extra
Size 10KB
SHA256 f65a9451d8759e7374c25f302073606dd283607eee5b91c71eaaeaa5743457d7
MD5 649b8caf79d39f7dfd0498a45a220899
SHA1 680243e90d500b409cfc69043adeda7e5bfdd3a0
SHA512 f70ea3abf1f5102e0dc7073a3e7c91a177837afdb8e7bc4dba75baaf4d4d38ebc9d1c65def7a037b542f7903d3e57c5f138cfc29715f00672e3cd30db4865f40
SSDEEP 96:SEWCmTRqY6pw6mJFFd8H0Rh7CsevBb1d0PjMLlIrLlhTLlaXv7agOKtILfcBCqwV:Sau/LFSG7uvZ8bLTxsPywlwc8foU
TLSH
T178227253878724B7AD4298C4BC30AE7D45EC6FAA61F958A802CC4D47FA464F81FB44F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

005aee8b-b606-4065-8017-f2492d6add46.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\005aee8b-b606-4065-8017-f2492d6add46.extra
Size 10KB
SHA256 82c38aea8b14219b9ce2a84910af28b0dca1751f9b258327f640d6170a10756d
MD5 fb63c3669755cb206617df8475c4c685
SHA1 6ebb8df1407b531ea80bfa56244775462c3b1760
SHA512 7eae35a76335172481e5fe69fe47e09fef10b909012cbe855978cebb07585feee47ef6e86030fde5eda0d9de199de4476b0437078ba5316509565a90fde0b89c
SSDEEP 192:SahcFgwiR4pDDnTYapdVxzPVWBHd4T/fKNUal4c8fo8bLpB:hhcFgwiGDz1dWBHd4TxaqA8L
TLSH
T1A422F932081CD837E7E7AC8EFB392E36D25D7B1A10E6789C41CCCA4AC1A54786779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64c6d323-40a7-4caf-a61a-55b2e9ca618f.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\64c6d323-40a7-4caf-a61a-55b2e9ca618f.dmp
Size 75KB
SHA256 a4b50239b20265209ad9ca0c5a1076cc16e2841eec747d843bda1a26413dc3b4
MD5 e728990a9aa422fe96e401aba4a31c58
SHA1 81e10ff5323518aabac6214d332805b4aa126c4d
SHA512 b12fa1f16f86e89b668ef232ea327a57ae87c2eb07f27babddca5e998b6abba1dc6607458b14e079940ca9163ac693352426cecf089530e3aa71bc56aa7e5b86
SSDEEP 384:DY/+6UhMwilD6rdUjH8GkZp09LmuteKvlQjtJi2DvVzT8RlfPb/S1AQrFuxR02RL:lZw2Dv4nb61XrFuxR02m8TXCr99+
TLSH
T19873A826779025E1E7E62B351BEBA74277F6E4200B53870B32605B7A2C27F547E30B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64c6d323-40a7-4caf-a61a-55b2e9ca618f.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\64c6d323-40a7-4caf-a61a-55b2e9ca618f.extra
Size 1KB
SHA256 22b77aa44cc144b65002f1182e4cc5dd53282f553def4a964401897b4c2dac92
MD5 21b4e6170678941e15947fb6f46bd7f3
SHA1 29ef9585b0c59dfdc07e3dec9b6db587b2700a4a
SHA512 2e29e14876b106d4ba14078f89a1d0ee496f892ed0632877eb8cd22a8bf453f455881f4b1a37048d6939904bf6df6166b3f978b2e23af2d4179a568a59fd3efe
TLSH
T1283174BB81AC6D168DAB499D733B1703CA4A73274493590C34CD4A0D428E0DD9666AC3
MD5 SHA1 SHA512 TLSH

Submit Download

64c6d323-40a7-4caf-a61a-55b2e9ca618f.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\64c6d323-40a7-4caf-a61a-55b2e9ca618f.extra
Size 3KB
SHA256 9af17721591182a1b74880b2293e21220adcf4d32d88f2a05b7bef0597e79bec
MD5 190ef6094c46b031ef666560b35d3d10
SHA1 943f1d7d6d7e8a361bb3c2e27792e6bfb5d41f68
SHA512 0b3526f54a9337678fb88bb4012814aaabc8c9fdd7bb4bbf8f1ad218af09a3a11bcbadd0052d1a42307fe4624458a1b3e1da093cff35e053139cdb052bbd19d6
TLSH
T1BD812332005CE9375AEF9C8EB3376E1D899E731998623A8C41DAC35D41A8CF47386183
MD5 SHA1 SHA512 TLSH

Submit Download

89bf175e-1f32-4a26-ac16-cdd1c70ee82e.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\89bf175e-1f32-4a26-ac16-cdd1c70ee82e.dmp
Size 76KB
SHA256 cc9227903f0d759d11776a743ffd16d4814b48689ef5805d951f7dbe15921602
MD5 f6ab87db4b0717252b63dcfb50f99a93
SHA1 76ab618d6556a6c1bf186945839af2f157d07b22
SHA512 6639319d9fd1bd115aed84fee2e1c63bfce4689a6124e971c73c6b06285228d51dd497717078d546afb602c3af52ee62229ad4778fb5fbf7932939076953abab
SSDEEP 384:6Z/+mOl4GUlhMK3dtMWOtwdCKWwqWjKagx2QfiJ9f7fVQ1RDbCVMY7Re6mHmworU:wfFfT9fbVtRaHksiE6IpX
TLSH
T18173C926A7C42475D5EA37316BEBA7513FF6E82407538B0B0250577A2CAB3587E30F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89bf175e-1f32-4a26-ac16-cdd1c70ee82e.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\89bf175e-1f32-4a26-ac16-cdd1c70ee82e.extra
Size 10KB
SHA256 2d8651af86e8e00c64b9cf534fa6d7d7688e5766fd41f9327bc22d595b1e9502
MD5 e6afe0e23e07b7722a24da572f671774
SHA1 1b735bd7cab6cc918365616b1b2416f0b586e445
SHA512 9055b23eefa466d7eec9f6f4b07ceb3af74b6f49c19a0b5674d9266c7e6da49ec341e2e45872a1c8d513c211fde24d0026a00aeb499ee6d8268ae091916cf7e3
SSDEEP 96:SEWCbTRqY6pw6mJFFd8H0Rh7CsevBb1d0PjMLlIrLlhTLlaXv7anOKtILfcBCqwy:SaP/LFSG7uvZ8bLIxsPywlje1fo3
TLSH
T1EB227253879724B79D4294D4BC30AE7C45EC2FAA61F958A802CC4D47FA464F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89bf175e-1f32-4a26-ac16-cdd1c70ee82e.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\89bf175e-1f32-4a26-ac16-cdd1c70ee82e.extra
Size 10KB
SHA256 0ff1a013bd57dfef229275b324ac172cc2f08bfb2724ebddbbe5e9f04140c74c
MD5 ddcb0bf32ae585610cb0998477b5d541
SHA1 db179938c2c10e6cfbbdd520f68f1fe7b55095eb
SHA512 731153dd4f39e9ebd4fe5079199e61099ddaf03e3776c5b1ea6d1687cfde5e2d2002a6e62a392b60965b393dfcae940725a99cd4402cc36b8dc823a3fecfb7de
SSDEEP 192:SaGcFgwiR4pDDnTYapdVxzPVWBHQ4T/fKNUal7e1fo7bLpB:hGcFgwiGDz1dWBHQ4TxaOA7L
TLSH
T10B22F832081CE837E7E7AC8EFB392E36D65D7B1A00E6789C41CCCA4AC1A54786779553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c3827037-31df-4b97-89f5-90a628f74568.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c3827037-31df-4b97-89f5-90a628f74568.dmp
Size 77KB
SHA256 944786c678fb861a28ee07ba715de204301663befc292ead17198546f65ef4a1
MD5 3d5365824abdb12ed5616c4540ba2081
SHA1 f9bf38d6ccacc65dabb1fb219d31c9b3365ef8e8
SHA512 814864cbff751a76f9fe1799435b5bd51c1528664c73d5d50bf1aa832f8c96626ca2e9c727d02027449c420b2d8137c1326af0862274dc4244ada9792a360152
SSDEEP 384:C+/+ksseSI59O7og7Bbjd6cotQRKC7OY9MA7ocNp5R2bI3W+iHGOmA5zVjqNdBF9:aCmCf17owGbcWfmizUFH/2TI
TLSH
T1DF739722B7802436D12667356BEB6B5137FAEA20C753C74F0251877A6CE7354EE32B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c3827037-31df-4b97-89f5-90a628f74568.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c3827037-31df-4b97-89f5-90a628f74568.extra
Size 10KB
SHA256 a8c2215c02781a073ff98c34b2d4c955c2d2ce813ea253c3aae144025dd35eaf
MD5 ee4332faeaacd836cc97629853e5261e
SHA1 1fdda48dbc22b03b46fb41945689c65a5be1e20a
SHA512 fd1cc8d751bc4d785863717c1f7fd6b1422612bddd71b28eb1662a314ca91f80db09dfc41f9cf36d8432b0ae1d008a4db93b2b7d073c66d9dde473351a336a0c
SSDEEP 96:SEWCTuTRqY6pw6mJFFd8H0Rh7CsevBb1d0PjMLlIrLlhTLlaXv7aX8OKtILfcBCi:SaTW/LFSG7uvZ8bL3xsPywlQs6foP
TLSH
T111228353878724B7AD5194C4BC30AE7C45EC2FAA61F958A802CC4D47FA468F81FB84F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c3827037-31df-4b97-89f5-90a628f74568.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c3827037-31df-4b97-89f5-90a628f74568.extra
Size 10KB
SHA256 0ff6de43ab2af7885888d6ea21300cccfb2daead986e8e4b2b2a15467c5ba013
MD5 cae5cbf015308efabf3a05376e2ce36f
SHA1 075f3f1a4101a9d79ae7990c05eaa3fea5cc3945
SHA512 da36ec3ddea736568b88c67f8764b9e4dae09901330426c7fbb719d27d1b46b10bdc09ade44fc518ea52705d6bf4f066df306f15764e56dc5619348e07b88c39
SSDEEP 192:SaTZcFgwiR4pDDnTYapdVxzPVWBHt4T/fKNUalos6fojbLpB:h1cFgwiGDz1dWBHt4Txa16AjL
TLSH
T10232F932081CE837E7E7AC8EFB392E36D65D7B1A00E6789C41CCCA4AC1A54786779553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f055a976-1654-4644-9f8e-aa7ea67a9113.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f055a976-1654-4644-9f8e-aa7ea67a9113.dmp
Size 77KB
SHA256 d1bf0c4c5bd60a8096f37df1add5a822b7f3f848844154437890d963fa9af627
MD5 7abe31d206a7a06e611ef79d47b015cb
SHA1 a5c59ba1f26ea9b7491e8eb3e120cd298c130290
SHA512 dec47abdd039a1d3d0aaaa8d8a56da456e45ba27506177ca4105278994d47ce98daada820708e376aa960c3de823f6e2145911a09672f4e47d6977b84ce7ae99
SSDEEP 384:Cs/+XDN86mDfAtMrLo5ca6tK8gVuJwdrZ9JazirTvPYLTMa1nNBrCjqbLF1c/Cgv:n96YEtazevTcBbQ/Cg971
TLSH
T1E573EB26A7813836E2661B365BD77B413BF6E8240763872F1250577E2C67354EE30FA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f055a976-1654-4644-9f8e-aa7ea67a9113.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f055a976-1654-4644-9f8e-aa7ea67a9113.extra
Size 10KB
SHA256 044c3364fd5e8f29046f2932ff877a0933433ed18ad7d97a81984b4954ee44c7
MD5 b1b14141aec706520615a2ad3b3dedfd
SHA1 7bd6da3a216d6cbbafeacbc3c708c7f442ae91c5
SHA512 5d323b9db231f29fc598bb4431b6b48777b800dc1edc2c71a98b692482f411ca996a530f5fdcd0d18ee1ffaadc7d32007caf71632c809fbeb454be46d584dd19
SSDEEP 96:SEWCPTRqY6pw6mJFFd8H0Rh7CsevBb1d0PjMLlIrLlhTLlaXv7a9OKtILfcBCqw1:Sab/LFSG7uvZ8bLyxsPywlV9foF
TLSH
T1A9227213878724B7AD4198C4BC30AE7D45EC2FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f055a976-1654-4644-9f8e-aa7ea67a9113.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f055a976-1654-4644-9f8e-aa7ea67a9113.extra
Size 10KB
SHA256 b9c82e3426ffd20bfb17e2ade0226b8f9438b989aa57291cc44b08cd5f9dac6a
MD5 5aa446058400c7aa155445294a6871f8
SHA1 32aa62d318b4f5a9f4d95e58ab08af3fc80e9635
SHA512 eafb4182ee770ef748e84a7e6929bd9e8a55c9b8a8bb6f3e643ec7e41c285c1eb6288d6873abecbb56fe19a017ea04cff7a1a71559579f66536b99ba127698b2
SSDEEP 192:SaKcFgwiR4pDDnTYapdVxzPVWBHa4T/fKNUald9foJbLpB:hKcFgwiGDz1dWBHa4TxaVAJL
TLSH
T15222F932081CE837E7E7AC8EFB392E36D65D7B1A10E6789C41CCCA4AC1A54786779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd20ebd3-c61a-47b7-a841-79014d2f506c.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\fd20ebd3-c61a-47b7-a841-79014d2f506c.dmp
Size 76KB
SHA256 ebe58796941f6730effb3375da7f9062c53a25a70d74716062734f4343a113c6
MD5 d28a46b94954986f951025a2b21799c0
SHA1 f21c4594e9712fa8cdd13b5bdf4dcc0abdd087c4
SHA512 7c7817f8b5de4e520ec4c383e07ea67e99641f3fef530fd558720c22a96a3eab1f34d02fb702aa65fbcdf4fd3503bdc20505a34f280c4d2bbc18d3e3f45a6c42
SSDEEP 384:wN/+rYttX5Tn+vUImtNgHT4BAWut7x0ua1KhFtbWHq7v8aKKTSbp4cyZ2MyikQXK:z30ua1KEHqwamnyZlrqj
TLSH
T1B173FA22E7E0372AE12267364BE7A719B7F6E4641BD3870B0250477A2D673497E30F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd20ebd3-c61a-47b7-a841-79014d2f506c.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\fd20ebd3-c61a-47b7-a841-79014d2f506c.extra
Size 10KB
SHA256 84686f4121ef1331d37ce1cb262c394358fb42e55c844250185bca33af87f987
MD5 e5b272dfc24fc42758a947772cee36dc
SHA1 7145aeb80e01183feb63ae82b89d1f7e97f7f96e
SHA512 01c75dc2538ddb29de5f32aa460a6971281ce8a29efbb7d502c15dcbec4c4793f9e910f1b26b108f4fba15f9b562d142611a072ead3a853c42846a33b6d488bd
SSDEEP 96:SEWCRTRqY6pw6mJFFd8H0Rh7CsevBb1d0PjMLlIrLlhTLlaXv7aoOKtILfcBCqwz:Sah/LFSG7uvZ8bLbxsPywljrxfop
TLSH
T1CE228353878724B79D4198C4BC30AE7C45EC2FAA61F958A802CC4D47FA464F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd20ebd3-c61a-47b7-a841-79014d2f506c.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\fd20ebd3-c61a-47b7-a841-79014d2f506c.extra
Size 10KB
SHA256 1fe01025f9b374b8f4a9ea44c531a6002c697ad07c58c54307a574da91b92d94
MD5 70dbc9077b36e43abc47aeb5a4d78645
SHA1 a02ee7a58b97b634930500a204eccffa6cd2b3c3
SHA512 aab58392266eb7df523b95e1e168c536c9409ead51597084b81acffcb4d96df04c59963e533edfb1a5f7965512e42ba2c4209b14f7bd3c767fee3d4e89521c65
SSDEEP 192:SaUcFgwiR4pDDnTYapdVxzPVWBHB4T/fKNUalLrxfolbLpB:hUcFgwiGDz1dWBHB4TxaRFAlL
TLSH
T15C220A32081CE837E7E7AC8EFB392E36D65D7B1A00E6785C41CCCA4AC1A54786779553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 fc8ef022f157b64bb639dc2c62ebe6be538b38a335682e989c9f543d61814669
MD5 5720ad28921adbd386e70e7bae57a921
SHA1 906437d950f98f412a3d2eb673a478a382b37372
SHA512 e43d2c8fb6bda927fcce8f16f33d241c1758b4327d263e43d296085f25aa16e499c98c8cece54a427c1713f1005f4e0b28ec19b084dd09f211eb1a5ee15d7c91
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 6KB
SHA256 58d1dba0005b2f3396585f4739e42b56c0c99f9cb8b6dd82f1a735792d46efff
MD5 20c5a3c74106ad66d881ef8aefdf55d3
SHA1 64fec8f94680a8184075edf5a6609601c0cd38b9
SHA512 7eabd3f3d33fa3905d8e43fe0cf524b58adb8a8ea10c8674c395135878b0a82a3df30cea8b09b2d28742e7d9425abc4d72a9144325b8e26a6cc27ae5caa66fc1
SSDEEP 96:8aHpNrj8U6hlwsk1/wZvvaRhK25K20c2qWAPgiObqsehK3NK3IY0:THfb6hlwp7S+gi3+1d
TLSH
T108D1AEDB9E0248AFBBC59F3B335331526D67140ACBE4A4727BDB9606B0CA964011F1A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2348-622-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Download

memory/2808-11-0x00000000098C0000-0x000000000995C000-memory.dmp

Download

memory/2808-7-0x0000000008ED0000-0x000000000922B000-memory.dmp

Download

memory/2808-6-0x00000000055E0000-0x0000000005600000-memory.dmp

Download

memory/2808-5-0x00000000742D0000-0x0000000074A8C000-memory.dmp

Download

memory/2808-4-0x0000000005360000-0x000000000536A000-memory.dmp

Download

memory/2808-3-0x00000000052C0000-0x0000000005352000-memory.dmp

Download

memory/2808-8-0x00000000742E2000-0x00000000742E3000-memory.dmp

Download

memory/2808-0-0x00000000742E2000-0x00000000742E3000-memory.dmp

Download

memory/2808-2-0x00000000057E0000-0x0000000005D9A000-memory.dmp

Download

memory/2808-1-0x0000000000610000-0x0000000000798000-memory.dmp

Download

memory/2808-25-0x00000000742D0000-0x0000000074A8C000-memory.dmp

Download

memory/2808-10-0x0000000009B10000-0x0000000009C60000-memory.dmp

Download

memory/2808-9-0x00000000742D0000-0x0000000074A8C000-memory.dmp

Download

memory/3568-15-0x0000000005730000-0x0000000005D7A000-memory.dmp

Download

memory/3568-37-0x00000000077D0000-0x00000000077DA000-memory.dmp

Download

memory/3568-43-0x00000000742D0000-0x0000000074A8C000-memory.dmp

Download

memory/3568-27-0x0000000006770000-0x00000000067BC000-memory.dmp

Download

memory/3568-26-0x0000000006410000-0x000000000642E000-memory.dmp

Download

memory/3568-29-0x0000000074BB0000-0x0000000074BFC000-memory.dmp

Download

memory/3568-45-0x00000000742D0000-0x0000000074A8C000-memory.dmp

Download

memory/3568-21-0x00000000742D0000-0x0000000074A8C000-memory.dmp

Download

memory/3568-18-0x0000000005620000-0x0000000005642000-memory.dmp

Download

memory/3568-32-0x00000000075A0000-0x00000000075C0000-memory.dmp

Download

memory/3568-33-0x0000000007620000-0x00000000076C3000-memory.dmp

Download

memory/3568-20-0x00000000056C0000-0x0000000005726000-memory.dmp

Download

memory/3568-34-0x0000000007DA0000-0x000000000841C000-memory.dmp

Download

memory/3568-46-0x00000000742D0000-0x0000000074A8C000-memory.dmp

Download

memory/3568-38-0x00000000079D0000-0x0000000007A66000-memory.dmp

Download

memory/3568-28-0x00000000075E0000-0x0000000007616000-memory.dmp

Download

memory/3568-13-0x0000000002BB0000-0x0000000002BE6000-memory.dmp

Download

memory/3568-19-0x00000000742D0000-0x0000000074A8C000-memory.dmp

Download

memory/3568-14-0x00000000742D0000-0x0000000074A8C000-memory.dmp

Download

memory/3568-36-0x0000000007760000-0x000000000777A000-memory.dmp

Download

memory/3568-230-0x00000000742D0000-0x0000000074A8C000-memory.dmp

Download

memory/4204-269-0x000001C91B3C0000-0x000001C91B4C0000-memory.dmp

Download

memory/4204-278-0x000001C90B340000-0x000001C90B360000-memory.dmp

Download

memory/4204-268-0x000001C90AE60000-0x000001C90AE80000-memory.dmp

Download

memory/4204-255-0x000001C9059B0000-0x000001C905AB0000-memory.dmp

Download

memory/4204-301-0x000001C91B840000-0x000001C91B860000-memory.dmp

Download

memory/5200-657-0x0000000000660000-0x0000000000661000-memory.dmp

Download

memory/5704-78-0x000002A977800000-0x000002A977988000-memory.dmp

Download

memory/5788-40-0x0000000006AF0000-0x0000000006B66000-memory.dmp

Download

memory/5788-17-0x00000000067F0000-0x0000000006856000-memory.dmp

Download

memory/5788-35-0x00000000069C0000-0x0000000006A72000-memory.dmp

Download

memory/5788-42-0x0000000007340000-0x000000000786C000-memory.dmp

Download

memory/5788-12-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/5788-66-0x0000000006F70000-0x0000000006F8E000-memory.dmp

Download

memory/5788-41-0x0000000006A70000-0x0000000006AC0000-memory.dmp

Download

memory/5788-52-0x00000000742D0000-0x0000000074A8C000-memory.dmp

Download

memory/5788-39-0x0000000006C40000-0x0000000006E02000-memory.dmp

Download

memory/5788-24-0x00000000742D0000-0x0000000074A8C000-memory.dmp

Download

memory/5788-44-0x00000000742D0000-0x0000000074A8C000-memory.dmp

Download

memory/5788-16-0x00000000742D0000-0x0000000074A8C000-memory.dmp

Download