phantom_stealer | 7378b1987d62470c1cc5ba7e131c9de86b7fe2a45cf4d583d076166a92b3c4df

Analysis

max time kernel
149s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Specs_090726_pdf.vbs
Size 1.2MB
Sample260709-kdc6fsfz8w
SHA256 7378b1987d62470c1cc5ba7e131c9de86b7fe2a45cf4d583d076166a92b3c4df
MD5 ccd2ed44a4b43ef8b442b484a111a295
SHA1 fc902010cbbd13705211cc66a79849656170f3a0
SHA512 77e8d0adbd7183a175bb9eff8c49a158282981abb0031b1f5caed8212d294432ff33b1ecd2e24269d522e2449bb2c155c3eecc8d691e5455db2a0374bfb43024
SSDEEP 384:thfXVNLtsfHeMfIse/edBc7e53iiPe7dBcfeZfsNsiB7e54VNLtsfHe9BemfiBs6:0mF/5
TLSH
T11645A389AD471C28A93D025AED70199C76D78CF3C4277E7D4C38EC4AA957BE42C8C9B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution phantom_stealer stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
auromaglobal.com
Port
587
Username
[email protected]
Password
pamaaashish
Email to
[email protected]

Mutex

4VYU844MMIWE4XD4YH9P

Attributes

anti_analysis
0
cb_enables_ssl
1
debug
0
keylogger
0
start_delay
0
startup
0

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 1 IoCs

resource	yara_rule
behavioral2/memory/4420-19-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2308	3424	powershell.exe	88

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2308	powershell.exe
3	2308	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	icanhazip.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2308 set thread context of 4420	2308	powershell.exe	91

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2308	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4756	msedge.exe
3780	chrome.exe

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	MSBuild.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
4420	MSBuild.exe
4420	MSBuild.exe
5844	chrome.exe
5844	chrome.exe
4420	MSBuild.exe
4420	MSBuild.exe
4420	MSBuild.exe
4420	MSBuild.exe
4420	MSBuild.exe
4420	MSBuild.exe
4420	MSBuild.exe
4420	MSBuild.exe
4420	MSBuild.exe
236	firefox.exe
236	firefox.exe
236	firefox.exe
236	firefox.exe
236	firefox.exe
236	firefox.exe
236	firefox.exe
236	firefox.exe
236	firefox.exe
236	firefox.exe
236	firefox.exe
236	firefox.exe
236	firefox.exe
236	firefox.exe
236	firefox.exe
236	firefox.exe
236	firefox.exe
236	firefox.exe
236	firefox.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeDebugPrivilege	4420	MSBuild.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
5844	chrome.exe
5844	chrome.exe
236	firefox.exe
236	firefox.exe
236	firefox.exe
236	firefox.exe
236	firefox.exe
236	firefox.exe
4872	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
236	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 4420	2308	powershell.exe	91
PID 2308 wrote to memory of 4420	2308	powershell.exe	91
PID 2308 wrote to memory of 4420	2308	powershell.exe	91
PID 2308 wrote to memory of 4420	2308	powershell.exe	91
PID 2308 wrote to memory of 4420	2308	powershell.exe	91
PID 4420 wrote to memory of 5844	4420	MSBuild.exe	93
PID 5844 wrote to memory of 4492	5844	chrome.exe	94
PID 5844 wrote to memory of 1076	5844	chrome.exe	95
PID 5844 wrote to memory of 3780	5844	chrome.exe	96
PID 5844 wrote to memory of 3540	5844	chrome.exe	97
PID 4420 wrote to memory of 4492	4420	MSBuild.exe	94
PID 5844 wrote to memory of 1212	5844	chrome.exe	114
PID 5844 wrote to memory of 1988	5844	chrome.exe	99
PID 5844 wrote to memory of 2812	5844	chrome.exe	100
PID 5844 wrote to memory of 5692	5844	chrome.exe	101
PID 5844 wrote to memory of 5880	5844	chrome.exe	102
PID 4420 wrote to memory of 4492	4420	MSBuild.exe	94
PID 4420 wrote to memory of 5844	4420	MSBuild.exe	93
PID 5844 wrote to memory of 4964	5844	chrome.exe	103
PID 5844 wrote to memory of 1780	5844	chrome.exe	104
PID 4420 wrote to memory of 5844	4420	MSBuild.exe	93
PID 4420 wrote to memory of 3540	4420	MSBuild.exe	97
PID 4420 wrote to memory of 3540	4420	MSBuild.exe	97
PID 4420 wrote to memory of 1076	4420	MSBuild.exe	95
PID 4420 wrote to memory of 1076	4420	MSBuild.exe	95
PID 4420 wrote to memory of 5692	4420	MSBuild.exe	101
PID 4420 wrote to memory of 5692	4420	MSBuild.exe	101
PID 4420 wrote to memory of 5880	4420	MSBuild.exe	102
PID 4420 wrote to memory of 5880	4420	MSBuild.exe	102
PID 4420 wrote to memory of 2812	4420	MSBuild.exe	100
PID 4420 wrote to memory of 2812	4420	MSBuild.exe	100
PID 4420 wrote to memory of 4492	4420	MSBuild.exe	94
PID 4420 wrote to memory of 4492	4420	MSBuild.exe	94
PID 4420 wrote to memory of 4964	4420	MSBuild.exe	103
PID 4420 wrote to memory of 4964	4420	MSBuild.exe	103
PID 4420 wrote to memory of 3780	4420	MSBuild.exe	96
PID 4420 wrote to memory of 3780	4420	MSBuild.exe	96
PID 4420 wrote to memory of 5844	4420	MSBuild.exe	93
PID 4420 wrote to memory of 5844	4420	MSBuild.exe	93
PID 4420 wrote to memory of 1988	4420	MSBuild.exe	99
PID 4420 wrote to memory of 1988	4420	MSBuild.exe	99
PID 4420 wrote to memory of 3540	4420	MSBuild.exe	97
PID 4420 wrote to memory of 3540	4420	MSBuild.exe	97
PID 4420 wrote to memory of 1076	4420	MSBuild.exe	95
PID 4420 wrote to memory of 1076	4420	MSBuild.exe	95
PID 4420 wrote to memory of 5692	4420	MSBuild.exe	101
PID 4420 wrote to memory of 5692	4420	MSBuild.exe	101
PID 4420 wrote to memory of 5880	4420	MSBuild.exe	102
PID 4420 wrote to memory of 5880	4420	MSBuild.exe	102
PID 4420 wrote to memory of 2812	4420	MSBuild.exe	100
PID 4420 wrote to memory of 2812	4420	MSBuild.exe	100
PID 4420 wrote to memory of 4492	4420	MSBuild.exe	94
PID 4420 wrote to memory of 4492	4420	MSBuild.exe	94
PID 4420 wrote to memory of 4964	4420	MSBuild.exe	103
PID 4420 wrote to memory of 4964	4420	MSBuild.exe	103
PID 4420 wrote to memory of 3780	4420	MSBuild.exe	96
PID 4420 wrote to memory of 3780	4420	MSBuild.exe	96
PID 4420 wrote to memory of 5844	4420	MSBuild.exe	93
PID 4420 wrote to memory of 5844	4420	MSBuild.exe	93
PID 4420 wrote to memory of 1988	4420	MSBuild.exe	99
PID 4420 wrote to memory of 1988	4420	MSBuild.exe	99
PID 4420 wrote to memory of 3540	4420	MSBuild.exe	97
PID 4420 wrote to memory of 3540	4420	MSBuild.exe	97
PID 4420 wrote to memory of 1076	4420	MSBuild.exe	95

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Specs_090726_pdf.vbs"
1⤵
PID:3180

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Invoke-Expression $env:intervert"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4420
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ebtpgaru.jp2"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5844
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ebtpgaru.jp2 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\ebtpgaru.jp2\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\ebtpgaru.jp2 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0xa4,0x138,0x7ffd486fc728,0x7ffd486fc734,0x7ffd486fc740
      4⤵
      PID:4492
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ebtpgaru.jp2" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1652,i,135830207788589793,1723955117981274606,262144 --field-trial-handle=2000,i,10350157095656295049,4597479942759442113,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:2
      4⤵
      PID:1076
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ebtpgaru.jp2" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1780,i,10815517734031138913,12583056950217881614,524288 --field-trial-handle=2000,i,10350157095656295049,4597479942759442113,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:11
      4⤵
      System Time Discovery
      PID:3780
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ebtpgaru.jp2" --force-high-res-timeticks=disabled --metrics-shmem-handle=2124,i,5325920224168836123,15769356518534144996,524288 --field-trial-handle=2000,i,10350157095656295049,4597479942759442113,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:13
      4⤵
      PID:3540
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ebtpgaru.jp2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2972,i,8586127279000024712,12377149990199300124,2097152 --field-trial-handle=2000,i,10350157095656295049,4597479942759442113,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:1
      4⤵
      PID:1212
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ebtpgaru.jp2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2980,i,13803691672033191697,10221468234574731579,2097152 --field-trial-handle=2000,i,10350157095656295049,4597479942759442113,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:1
      4⤵
      PID:1988
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ebtpgaru.jp2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3180,i,10378756459919265052,17238408457773792133,2097152 --field-trial-handle=2000,i,10350157095656295049,4597479942759442113,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
      4⤵
      PID:2812
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ebtpgaru.jp2" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3260,i,9526664743765130623,50357273053775589,2097152 --field-trial-handle=2000,i,10350157095656295049,4597479942759442113,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:9
      4⤵
      PID:5692
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ebtpgaru.jp2" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3768,i,6351067147619934356,8206704723418028299,2097152 --field-trial-handle=2000,i,10350157095656295049,4597479942759442113,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:9
      4⤵
      PID:5880
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ebtpgaru.jp2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4328,i,6099429452566805756,15387865671906688418,2097152 --field-trial-handle=2000,i,10350157095656295049,4597479942759442113,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
      4⤵
      PID:4964
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ebtpgaru.jp2" --force-high-res-timeticks=disabled --metrics-shmem-handle=4344,i,13805596475751524422,14878358742897268046,524288 --field-trial-handle=2000,i,10350157095656295049,4597479942759442113,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:14
      4⤵
      PID:1780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\evxqk0xv.esb"
    3⤵
    PID:2696
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\evxqk0xv.esb
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:236
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1780 -prefsLen 27097 -prefMapHandle 1784 -prefMapSize 270279 -ipcHandle 2024 -initialChannelId {2d0cc750-e30c-4906-a8ae-0a032b11a058} -parentPid 236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.236" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:4236
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2216 -prefsLen 27133 -prefMapHandle 2204 -prefMapSize 270279 -ipcHandle 2400 -initialChannelId {b883ec73-c680-4f79-88ff-5388e53dbf66} -parentPid 236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.236" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:4512
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bd6776f1-ad20-412a-9821-3ef91eb7fc06.dmp"
        5⤵
        
        PID:5444
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2592 -prefsLen 27133 -prefMapHandle 2200 -prefMapSize 270279 -ipcHandle 2816 -initialChannelId {f498e085-15fa-4ddc-8b8c-399e317f4737} -parentPid 236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.236" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:4956
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e6ae0594-d745-4386-977a-052cdd231088.dmp"
        5⤵
        
        PID:3020
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3024 -prefsLen 27133 -prefMapHandle 3028 -prefMapSize 270279 -ipcHandle 3036 -initialChannelId {3e50a4cb-f4ca-43a2-a78b-96b0865cf1e0} -parentPid 236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.236" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:2088
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\497ba25f-e69d-499f-8f24-5870d76235b2.dmp"
        5⤵
        
        PID:1036
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3036 -prefsLen 27198 -prefMapHandle 2912 -prefMapSize 270279 -ipcHandle 2872 -initialChannelId {591cd856-2223-45eb-aadf-a60f6bc766b5} -parentPid 236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.236" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:1212
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c668c00e-22bc-443f-bc81-424a497ff3c3.dmp"
        5⤵
        
        PID:1900
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2708 -prefsLen 27198 -prefMapHandle 2872 -prefMapSize 270279 -ipcHandle 3556 -initialChannelId {b21a610b-b54a-4318-a354-ea47c263e7f8} -parentPid 236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.236" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:3672
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3692 -prefsLen 27323 -prefMapHandle 3696 -prefMapSize 270279 -jsInitHandle 3680 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2876 -initialChannelId {970d3beb-56eb-4c5b-8d2a-e6453de7c25b} -parentPid 236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.236" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        5⤵
        Checks processor information in registry
        
        PID:3108
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\09cd7ab6-a73a-4879-b3f1-385c8ac4a256.dmp"
        5⤵
        
        PID:2520
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3556 -prefsLen 27323 -prefMapHandle 3844 -prefMapSize 270279 -ipcHandle 2888 -initialChannelId {b174cc58-4d82-4da5-8102-ceff0bc5994d} -parentPid 236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.236" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 gpu
        5⤵
        
        PID:5360
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\afb6fd60-db68-4549-8e62-3caa954791b9.dmp"
        5⤵
        
        PID:1956
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4088 -prefsLen 27323 -prefMapHandle 4084 -prefMapSize 270279 -ipcHandle 4064 -initialChannelId {6053ccdf-486e-4904-b8ba-9bd186dd1a85} -parentPid 236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.236" -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 rdd
        5⤵
        
        PID:5460
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4568 -prefsLen 34822 -prefMapHandle 4572 -prefMapSize 270279 -jsInitHandle 4576 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4584 -initialChannelId {0db4a0ee-255f-47fa-bbca-5f0a33c56829} -parentPid 236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.236" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:2384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:4872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x230,0x260,0x264,0x22c,0x26c,0x7ffd4695c188,0x7ffd4695c194,0x7ffd4695c1a0
      4⤵
      PID:4936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1864,i,6541142939485786846,16913664756139875546,262144 --field-trial-handle=2492,i,15920216873625304890,1547015284624931768,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:2
      4⤵
      PID:5988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2144,i,16989439139601583755,16449533761888197157,524288 --field-trial-handle=2492,i,15920216873625304890,1547015284624931768,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:11
      4⤵
      System Time Discovery
      PID:4756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2720,i,7127530286378479550,17424046958574097841,524288 --field-trial-handle=2492,i,15920216873625304890,1547015284624931768,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:13
      4⤵
      PID:2880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,14865307075036734026,7202432239258396412,2097152 --field-trial-handle=2492,i,15920216873625304890,1547015284624931768,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:5916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,5875872230323574719,2819116629428638688,2097152 --field-trial-handle=2492,i,15920216873625304890,1547015284624931768,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:5680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3908,i,15412944511182098160,6918432906393676422,524288 --field-trial-handle=2492,i,15920216873625304890,1547015284624931768,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:14
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3960,i,4676787427828327702,998248883023071044,524288 --field-trial-handle=2492,i,15920216873625304890,1547015284624931768,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:14
      4⤵
      PID:1124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,11086144210157148254,6205284292153416479,524288 --field-trial-handle=2492,i,15920216873625304890,1547015284624931768,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:14
      4⤵
      PID:4244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3972,i,3653161047739623514,9667202683444585975,2097152 --field-trial-handle=2492,i,15920216873625304890,1547015284624931768,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:1
      4⤵
      PID:2088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3980,i,2315885002098528701,14418737218790907929,2097152 --field-trial-handle=2492,i,15920216873625304890,1547015284624931768,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:9
      4⤵
      PID:1300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4052,i,736669123133616217,15624336576396773886,2097152 --field-trial-handle=2492,i,15920216873625304890,1547015284624931768,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
      4⤵
      PID:1304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4120,i,14399357799979084496,1844461872342111161,2097152 --field-trial-handle=2492,i,15920216873625304890,1547015284624931768,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:9
      4⤵
      PID:6064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4124,i,17617497971818902141,16039285802509986897,2097152 --field-trial-handle=2492,i,15920216873625304890,1547015284624931768,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4148,i,18199152033865347287,9003057142444567637,2097152 --field-trial-handle=2492,i,15920216873625304890,1547015284624931768,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:9
      4⤵
      PID:5600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3988,i,9071994665937979535,10541110311668286461,2097152 --field-trial-handle=2492,i,15920216873625304890,1547015284624931768,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:1
      4⤵
      PID:1520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4236,i,7307303839867840889,8031567702603392504,2097152 --field-trial-handle=2492,i,15920216873625304890,1547015284624931768,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:9
      4⤵
      PID:5644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4220,i,6589321271608198305,13507182480350641131,2097152 --field-trial-handle=2492,i,15920216873625304890,1547015284624931768,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
      4⤵
      PID:4272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4216,i,12342621164820502930,4957647343387675471,2097152 --field-trial-handle=2492,i,15920216873625304890,1547015284624931768,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:9
      4⤵
      PID:5932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,10519642188451382659,4980035302281074200,524288 --field-trial-handle=2492,i,15920216873625304890,1547015284624931768,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
      4⤵
      PID:2480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1152
        5⤵
        
        PID:5612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,2369753875397641762,10657593607841411097,524288 --field-trial-handle=2492,i,15920216873625304890,1547015284624931768,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:14
      4⤵
      PID:3036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3484,i,1876564431371000258,2785189806320679307,524288 --field-trial-handle=2492,i,15920216873625304890,1547015284624931768,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
      4⤵
      PID:1832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,8968286482701288899,796822546310385572,524288 --field-trial-handle=2492,i,15920216873625304890,1547015284624931768,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
      4⤵
      PID:5460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=624
        5⤵
        
        PID:2808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,5258552516341233123,15691726064392597268,524288 --field-trial-handle=2492,i,15920216873625304890,1547015284624931768,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
      4⤵
      PID:3788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,1308583124835940221,4245286953817142372,524288 --field-trial-handle=2492,i,15920216873625304890,1547015284624931768,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
      4⤵
      PID:4184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4\Crashpad\settings.dat
Size 280B
SHA256 38262c85835c88a61beb2443659d15e3f0cdf91153c49696332b74d9f2c11be5
MD5 26a9bd4b6b6ab3789e69e4702abb0959
SHA1 621a53cdd8fb95966e939a8b55f5eafd3a02af5d
SHA512 a798919e4bb744bae1b411566cf30bf48207e03e9027449df115bc48990062b9fc64905da61e3838fb9267ea2840c06e5f3a23bfe29d7f3bd2fdcffcd2f17eff
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4\Crashpad\settings.dat
Size 280B
SHA256 c2b053802b672a0533791cd97c343d4bcc03037b7bde0da38624c92c44126068
MD5 4d2657d6890c4a181e58b7f7b7db1fdd
SHA1 2a88ec3cef3fc0c60479f8ffe6b4914993028730
SHA512 bd480a3cf0ab578a4635a0682ece4cd946a09b5c03e83c961888b12e36c631670e30bc18274c278c59e9374c5379b45b839d7049ddaf2826346fae2268048272
TLSH
T149D02200A300B808C02BB030C0E0FB0A08E0E8000C82CB82203CAB08EC88F80003ABCC
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 2e89e9d7e7d58ca84d667152e87f844cbe3254c05e95b8ac324b9c7e65d81d2c
MD5 b4b8d75deae75372544662c220f3abab
SHA1 4c21f40c3df4f4c67eb929bfe0d18570ed75be64
SHA512 fb5bf4577b41ded34bcb0b5b42c06b2d83ce5f53df65217b6dafae2aa812e66e4f588a266085224c16f1211685dcc72791c3f58533d9ec94e6da8c15e0381134
TLSH
T176D02BA61DAA2C14CD7B92DB147190D005027D64CE40EC8E209EB38365F0317781BC70
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 561fcbdabbccb18652e17aa46fbf16ce4fc26e3bb89ba3adefc5d4e9da1b036b
MD5 f3b70c48ed921dfacff713cd40e6997c
SHA1 6bba6757f64cd867cb3c359956865c85adb540b6
SHA512 4590969b94d5876dfe716790197b0368fd97b7bc3513fe97751981eb05a2e88bc051f07cf6fd3023d807a99aae0beddfe43b503a11fe288bf2bf22b643ec21d7
TLSH
T13AE0D8762EE72C14DA2BD2CB147194E409017D55C980EC8E649BF28751F5316349EC35
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a205a.TMP

Path C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe5a205a.TMP
Size 153B
SHA256 b8b6b8eecafe798091a3be402ebf0c5595711ec615a2dc8359fbd2e1a112e5bd
MD5 e84e955086c94ad136e31c7ee9cd09e8
SHA1 7b50dd660b0977fd0ec121360b89cd55c055835b
SHA512 b6f83f5525259d5c8eb9571bd1da3acb79bf1bab027348f17749477290af2ac1f1bfb71b262ae604e27885a9fbe0babbdd0afeeeaa12f7f7d534bb0239d630c7
TLSH
T1D2C08CB72D992C00CE5682CA00B1A4E442122C948940ECDA201DB18370F0122785AC20
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4\Local State
Size 4KB
SHA256 f9c6ad59cdc15482f7ec99ff7b24bf0d3b0516e2ea70059fa1bc2ff281b44ae0
MD5 0130a2d5c36ba5f59a0b9de07d34f256
SHA1 d62b8e517cd7f1a5410d291db30770fc08e216a4
SHA512 241b3d0f93d8da11a5d8efc08a8e66cb9c0b385199b8a94ebecd0f857c20d7280143c0c8e60f414475687f4ed71ab4c6108a83e2be3213caddd03b30edc882b2
SSDEEP 96:DqGNkKQsFf/TarZ58Frh/cInURoDotovFJDLB/dvIz4eS0eUnkFFq4a:GGNGaTaUooDUwj1K4eSqkU
TLSH
T1B5A1C771A435EC275EE56914B5873393AEA53077E985BF89D2E9070C00EB3881706C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4\Local State
Size 3KB
SHA256 b7ce8c324cacba2e37b964e1ec4ddf5541dca920a4b28f9922cc9640c4a55093
MD5 519a62ded81ef08fecdaef442585b08c
SHA1 9a3ce5ca94e54955c1a08c92237e118b22b053c2
SHA512 73ddf97092987f7d34cdccb2a2f29c939ca8d17cb972610b2c8f12630407bfe778223ffa1096623c7fea4f7b6aaa5e5bd97b07d5e3a16b3d91fd70536508fb40
TLSH
T15881A771A425EC2756E52A54B58B37A39D7570B3EE55BF44E2D9130C00EB38C2B09C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5a0a81.TMP

Path C:\Users\Admin\AppData\Local\Temp\aa0eoa4h.ml4\Local State~RFe5a0a81.TMP
Size 1KB
SHA256 3b051bda26740a2671aa8931283b8daddf3c0ad06a0cceadc77f293772c06e1d
MD5 a6fc7db32a62d679a75a3e79eb29f998
SHA1 aab58d069e98d5f99cb3865a7960433b0b401a95
SHA512 335ab7a0be0b1c8b27390aa365328dc32b5ed326ba942cffbde106c3a667298f377bb7ccc7b30131866895aa4d8bdb7ee4f1e2eb87e18870ef5cb73ded7f6315
TLSH
T1DC3195B2E5282C77F8A00659B34B77A32D357076E251B64952FE070C05F76CC5216C3E
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\ebtpgaru.jp2\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\ebtpgaru.jp2\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\ebtpgaru.jp2\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\ebtpgaru.jp2\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\ebtpgaru.jp2\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\ebtpgaru.jp2\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\ebtpgaru.jp2\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 7a4914c986670a6eafb2b9af4df02cc436e3c27c19a176808ee3fc6c1e18dc69
MD5 39bc4564ac5f310fa9f47a0c89c2bf7d
SHA1 8b3896e2f66e049d773a2a0e7dac6061d3974745
SHA512 8f600bb629c4b7452f68494761fb9a5d26275c0d131cbaaaeb2502e1e9cc4c34b384c7b4bab257b08fe5ffd930851018786254f7e757b654a412df4168958724
SSDEEP 48:I4X1j0dOHSvb4OJ9zCNYhRdLXuHOpWm4X8j0dOHSvb4OJ9zvYhKgdLXuHV2WZ:NlMJoYuuQHgMJvzIunZ
TLSH
T13191F0105FE50A16F3F3ED73957267216F7BFD0A4E188E1F0085821A0C72604A9AAFE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

09cd7ab6-a73a-4879-b3f1-385c8ac4a256.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\09cd7ab6-a73a-4879-b3f1-385c8ac4a256.dmp
Size 75KB
SHA256 8451bb9e4c173d734a3ba75d2024912b387c27bfe40eadab72ea4422d0ce9ae6
MD5 a67a79c053cf33638d600f912f9d4c31
SHA1 0bf6a1f1f9e783ff4a81d13b69a9b577d290403b
SHA512 609fa9541d0d270fe9e8473c54c539ffdcd8566862eaca8fd180fa5dd325cc98cbc42d39f433ae5157955eb7301a73d676ad79c533be75534fde29c3b929cf02
SSDEEP 384:UZvlJ/+qRj2y3fs3D/IL2Z7868rQewUXeZI7fn5BQ6v:slJmqRj6D6l68rbwI7P5BQ
TLSH
T15073B7627BA5187AF629433854E7A7513FF7F81117B3830F022059BA1F67384AD70ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

09cd7ab6-a73a-4879-b3f1-385c8ac4a256.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\09cd7ab6-a73a-4879-b3f1-385c8ac4a256.extra
Size 10KB
SHA256 2922b85562648ba82087c7e0177bec4855fa6ce0c3701691b807c105f8634d58
MD5 3aebf16894a6e9d55ee8feb9a8241330
SHA1 b20cfcffd3317a30f6662084587103e8e07cce6d
SHA512 0955eb4857c565525c0de5f8b4b460cb0d272ab3c044e39f0a4648861b97ae29171e62d02085638986e3bc91dbc0947bede8c8a0cf4ccc9a4f85131d89e3b637
SSDEEP 96:SEWCj9TRjY6pw6mJFFd8H0Rh7CsevBb1d0PjMLlIrLlhTLlaXv7aNOKtILfcBCqF:Sajl0LFSG7uvZ8bLCxsPywlWwfoI
TLSH
T12A227213878724B7AD4294C4BC30AE7C45EC6EAA61F958A802CC4D47FA464F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

09cd7ab6-a73a-4879-b3f1-385c8ac4a256.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\09cd7ab6-a73a-4879-b3f1-385c8ac4a256.extra
Size 10KB
SHA256 fbdcb16c2c56cd3eb35943bafcca056d1cece126e81c36b14eea8ca1f459f841
MD5 2cd04c245d171909890c3169f2239b2f
SHA1 3b860117bd872ed3bbab0facbf14e6e2cea5e7a3
SHA512 fb0ac95a9a0eb5cd1e7831ae3fda592ec573b973c50a1d056f8ba2a462e141e0ed3947456ea745345610dad3b8b590223f64c2c152ce665209dc5428cd88673f
SSDEEP 192:SajhcFgwiR4pDDnTYapdVxzPVWBHW4T/fKNUal+wfo4bL7kQGz:hjhcFgwiGDz1dWBHW4Txa5A478
TLSH
T1C622F921481CE837E7D7AC8EFA393E3AD26D7B1A10E6786C40CCCA49C1A5478A779553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

497ba25f-e69d-499f-8f24-5870d76235b2.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\497ba25f-e69d-499f-8f24-5870d76235b2.dmp
Size 73KB
SHA256 764470d953b567c01e86c379b50baefa9c97d5a040c5986fdd0736c7f579a546
MD5 dff6102807c89aaa3587825738643ede
SHA1 62cefba9cbe4b708e882ea0a5434b11704c6b3b5
SHA512 36c93318da7db2f6486502c601ced9a7b1d3fabeab86112f75f2274ddad3ed2ad69618ac7dd1b1a92bf91bc4558e94eea3f0a49a2e8719a0d93d55e95c1a349e
SSDEEP 768:WkyWsFwQWZn6TVkNNPYPfbfBXy9S7NJSp:XN4fzBX2S
TLSH
T16073C82277812839F669473158EB771037FFE85067A3870F4263596E1CB3384AE70E96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

497ba25f-e69d-499f-8f24-5870d76235b2.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\497ba25f-e69d-499f-8f24-5870d76235b2.extra
Size 10KB
SHA256 97c35b50962a64b8d82856783acce0445183e7568b76331daababfda57bc87d7
MD5 c697d4a7893ec52b6614379d02451b38
SHA1 7b157c14a2c11ed50aa01c1a027249935e07127e
SHA512 311297961e79b69c0ad7cb4ede1bb4e3299a25c7f8b79a48f4db4f36c2ca6d973436e7e299fbf5c50b16a9d624be8ccb3ec15c1ed3ae706d2c379288d24a5038
SSDEEP 96:SEWC+TRjY6pw6mJFFd8H0Rh7CsevBb1d0PjMLlIrLlhTLlaXv7aVOKtILfcBCqwh:SaG0LFSG7uvZ8bLqxsPywlsLfox4
TLSH
T14D227253879724B79D4198C4BC30AE7C45EC6FAA61F958A802CC4D47FA464F81FB84F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

497ba25f-e69d-499f-8f24-5870d76235b2.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\497ba25f-e69d-499f-8f24-5870d76235b2.extra
Size 10KB
SHA256 8184a377d212aa63a7011b1f07b52c8f80d28da6541c09d4d91368284cb254bb
MD5 eb9154f9f1718badc34883ae0ddc495e
SHA1 146d3909d84232d392ca93b80386eee191ee2a13
SHA512 2e0cc8b13d5a31f05d330a46cd94d35a375cdbf15a879d25b5617a40cf5bc77547d11ab227019e996dbb74c12189547441c5877997c657dca7fbccd3353749c3
SSDEEP 192:SaAcFgwiR4pDDnTYapdVxzPVWBH24T/fKNUalULfoxIbLK9Bz:hAcFgwiGDz1dWBH24TxaYAxIKr
TLSH
T1A922F821481CE837E7D7AC8DFA393E3AD66D7A1A10E6786C40CCCA49C1A5478A778553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

afb6fd60-db68-4549-8e62-3caa954791b9.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\afb6fd60-db68-4549-8e62-3caa954791b9.dmp
Size 76KB
SHA256 b6544c0cbee72d35699c14d588fb1e58b4aa367fb063a367a4cf6535b33d9226
MD5 febdded3a73c6be5a2eee73ddaf25c8a
SHA1 e7342cbe24a8ec2f1823b76c051baaa9fcafd0d9
SHA512 61edf3b2f64f23bc869a8b1a85682373317d45e5bffaae7e119bc1bdc47199e5c91e6cda9f120d7cf4f22aecd9dba86fd3969ed410782476d5ce8c4be4cf138a
SSDEEP 384:bnhl7kAeOIuCtv1mz2e+GzU5mRbiJYvZLBexpyOnIqiGZEaSsuODjv:1hkAeOIB8sYDSx1j
TLSH
T16873B76377890C26F465073158E7A7507BF7F8A0A7B2835FC62859BE1C67380AC70E62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

afb6fd60-db68-4549-8e62-3caa954791b9.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\afb6fd60-db68-4549-8e62-3caa954791b9.extra
Size 10KB
SHA256 acc993685f4a7fc2daff862c61b6081789a5007a92bb0e19a47eb10ef913105f
MD5 bcdc3d0cae19a450efab79bcf9a8751f
SHA1 1915485cd8ff8e6951b1740e362916521b256929
SHA512 22ce28d57ac6c2808409bf808e5d95b83acb18f07b9e9d314beab770b0041e25c12db64e9196f523e7d946718b5e86b6442899e9e41dddfd51167abbbbdc89bd
SSDEEP 96:SEWC8zfTRjY6pw6mJFFd8H0Rh7CsevBb1d0PjMLlIrLlhTLlaXv7aAOKtILfcBCb:Sa8zL0LFSG7uvZ8bLzxsPywlSOfon
TLSH
T192227253878B24B7AD4194D4BC30AE7C45EC6FAA61F958A802CC4D47FA464F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

afb6fd60-db68-4549-8e62-3caa954791b9.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\afb6fd60-db68-4549-8e62-3caa954791b9.extra
Size 10KB
SHA256 8e49cd7ab8fae870a9fc7b5fee2c2c9d7762dd3262d779d742152023ee5d2288
MD5 efa479c609e3873da14d8a26358a0b23
SHA1 39b56316c6d18568f8776e5d5fe2a50bf0c7f15c
SHA512 659dbf20433b85ec1a5ab2a12a9019ad88366f34b32e70b9592d2ea7fef9aba12dcc926a270cec19ffd7ec79e9af23c2f63b7435d82557da7e066bd1ae2d7b94
SSDEEP 192:Sa8zbcFgwiR4pDDnTYapdVxzPVWBHd4T/fKNUalaOfoLbL1bUz:hSbcFgwiGDz1dWBHd4TxajALq
TLSH
T12C320921481CE837F7D7AC8EFA393E36D26D7B1A40E6786C40CCCA4AC1A5478A778453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd6776f1-ad20-412a-9821-3ef91eb7fc06.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bd6776f1-ad20-412a-9821-3ef91eb7fc06.dmp
Size 72KB
SHA256 44f2772fcfc7c9768971415dead6d49f5e51199da037ac15465c6d5b9bad9f61
MD5 df3c08e61c5afb04ccaf005d2d02f355
SHA1 765c769e264c5c8af2e45600f40d0f24f17598ce
SHA512 8b4882f993cda5ed70d4fc86b7545a87193be6759ac9ac9622c91f4307510b0f844b5345faab64617fa83ffa38ab584d0fd4cf23a16add31cba8ed4ebdd22a41
SSDEEP 384:eekfrKmFF+4aPUzd+aFwdx5GaqeDcutkWT7trwYv:eekTc4aydriDe2cPu7t
TLSH
T1D773C96277854469F679073258F767533BF7F81027A38B4F02206AAE1CAB3847D71E62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd6776f1-ad20-412a-9821-3ef91eb7fc06.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bd6776f1-ad20-412a-9821-3ef91eb7fc06.extra
Size 1KB
SHA256 fe20a49701120116f6ce477a624b9d0eb943bfc8239b7cd93b9fa0a2bdf1de76
MD5 c55163e04c31143ee65d80c57b70a28d
SHA1 a95960ceb0ea3330447d6d2d4da7999e1989fd68
SHA512 8a6c0a2e72141ec807e4de04d11e5968e47447860ddbecbda12c4df71fa57701b31436aa1bab802173d725d29a24b5955cd69a3a2aae2539298ea3f94cea49b0
TLSH
T1073152B781EC6D568D4746A9723E2303CA49B32704D35D5C34CC4A0C828E0DDA2669C3
MD5 SHA1 SHA512 TLSH

Submit Download

bd6776f1-ad20-412a-9821-3ef91eb7fc06.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bd6776f1-ad20-412a-9821-3ef91eb7fc06.extra
Size 3KB
SHA256 8e36d39764f4be973a270567972dd2d4fe3f450f95716d94632d86b2fafca0f7
MD5 ccc0fe2df926fca95344f6d48aed584d
SHA1 0317187846775c4d3ccde5827b0de7e2d24aae13
SHA512 08c86a1241af780b622df84c53acfd963fecbd07ce908c64ae50a4b0ede93177bb83ddda23372e47875fd37e8a2f40446744dab57458594ec7a8d4f8e7b7f15e
TLSH
T1CF812132405CE9376ADF5D9EB3377E1DC99EB31598722A8C50DAC71C41A8CF46386183
MD5 SHA1 SHA512 TLSH

Submit Download

c668c00e-22bc-443f-bc81-424a497ff3c3.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c668c00e-22bc-443f-bc81-424a497ff3c3.dmp
Size 76KB
SHA256 53f12e920aba77b023bee951600abf606113e64eee5be81800f7ec42e2b5d964
MD5 88c6e2c1b056d96afcde98afcabcf2be
SHA1 063e5cc71047baa95ab853d8eef08fe0522232c5
SHA512 e8e82a008a330ab7a3c11d7f39919192ef1557828899c248da0ab21adb7340bfacdcb2de2b66f654c2bf53795d888759c67b1dee73a4e6ea7de45290efe70158
SSDEEP 384:8ELLNfFK7Jko25uhE5ovm14CkVJtv/X8oZrLLT94sjYv:rL5iJko2OtvfhLv93
TLSH
T1F9738522A791046AF166033558F767913BF7F4A02793830F82636A7E1CFB384ED71A56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c668c00e-22bc-443f-bc81-424a497ff3c3.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c668c00e-22bc-443f-bc81-424a497ff3c3.extra
Size 10KB
SHA256 102f86edc616c88790a31cae00e8e35a1b516005ff46688e8dbd63a54203295b
MD5 1689bb757a5f69f7ee8adcf86f871698
SHA1 69f85b0a5fc2845b111de3685936c64df37661e2
SHA512 e3f6d6b07ae6fbacc6a32a47f4f79129091d1f9c3a2f5e5fdf9702d6a59c0ce4de7af9552a0072489f67db2b53fcf19d1d8c867c0cfef1bd4db60ee57eab52eb
SSDEEP 96:SEWCQTRjY6pw6mJFFd8H0Rh7CsevBb1d0PjMLlIrLlhTLlaXv7aXOKtILfcBCqwk:Sa80LFSG7uvZ8bL4xsPywlxpfow
TLSH
T1B2226153879724B7AD4294C4BC30AE7C45EC6FAA61F958A802CC4D47FA464F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c668c00e-22bc-443f-bc81-424a497ff3c3.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c668c00e-22bc-443f-bc81-424a497ff3c3.extra
Size 10KB
SHA256 504023891cbecc74e463c3dede75247950f1069f1383aeb9d0a60dbe6fedba1b
MD5 97e0040b9ca80a633d4dbeea26419139
SHA1 9b81da29f11b3196f30e0d305d7ba2ff8c588d6e
SHA512 5a6fa47f4e9e30aa8bde3dd12453b8ffe52c41eafde73cd05fb371d184a0f993f7733177aa22836262af1e4a0c831742e840dfb3ecd74c50fb4ecf0d9af09837
SSDEEP 192:SaKcFgwiR4pDDnTYapdVxzPVWBHE4T/fKNUalZpfowbLYyz:hKcFgwiGDz1dWBHE4TxadAwt
TLSH
T16322FA21481CE837E7D7AC8DFA393E36D66D7B1A10E678AC40CCCA49C1A54786778553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6ae0594-d745-4386-977a-052cdd231088.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e6ae0594-d745-4386-977a-052cdd231088.dmp
Size 75KB
SHA256 e6db79264ee06218d5878ed47dc5f8d0e4bbba1c550bad0930146035b26741e3
MD5 d65b01dc38636b1fabeda4c8b7b2b500
SHA1 e8f6ac348d380d5cf5aeb047b6357af881c8dc5b
SHA512 7e426a43877568c8ac324e836be87af9c61af21707141dea11fbbfe17400f3a9a709078689a0f7ea182c3d3f2f67f7e8a7e692c644273cc24e1bdc28c96d73fd
SSDEEP 384:Glkfi2hwPEZgiKQqnjjteoXcJeQ9SZCtnodUAlb1r0Kiv:GkK2hwPEZu3J4yuodUAl
TLSH
T19573B922B7C60869FA29077154FB77503BF7F8106B96836F026019BE1CA77847DB0E96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6ae0594-d745-4386-977a-052cdd231088.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e6ae0594-d745-4386-977a-052cdd231088.extra
Size 10KB
SHA256 03e9d7dbc80b41c088f44b1832b1f9f9022d0900b8e292415f3965121fde2964
MD5 aacee3d9588a449fa92617e323f58f8c
SHA1 a75ef94faa04d6fff3e42355b69b52f66a38574f
SHA512 24c957bab951c69111847a5f5fed8ffcf57212fd3abf1e18b950845813a3115fa2123d0b7a8361c6586109bc1ad2a752bb2c24ac44075893ce54169658079bcc
SSDEEP 96:SEWCATRjY6pw6mJFFd8H0Rh7CTvBb1d0PjMLlIrLlhTLlaXv7aL8OKtILfcBCqwx:SaM0LFSG7WvZ8bLDxsPywlvmfoi
TLSH
T161226153878724B79D4294C4BC30AE7D45EC6FAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6ae0594-d745-4386-977a-052cdd231088.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e6ae0594-d745-4386-977a-052cdd231088.extra
Size 10KB
SHA256 e666bea541338c471288bb99ba143d298506872127dbe9cfceec71e048558e85
MD5 fd87060a791d3c8128ef84be78b995e6
SHA1 236a705e185cc53bb308877d1efd7307fe12e170
SHA512 09ae1544bf0ce2b377f0e13394676cabd3ce8eb7692b03333aaf5cde888461efd42d0c779b11c0b34afb8284364a92f57d6b89044bdfa2749e096b4527a02589
SSDEEP 192:Sa6cFgwiR4pDDnTYaVdVxzPVWBHP4T/fKNUalXmfoSbLg0z:h6cFgwiGD/1dWBHP4Txa0ASn
TLSH
T153220932481CE837E7D7AC8DFA393E3AD26D7B1A00E6786C40CCCA49C1A5478A779453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2308-9-0x00007FFD47EB0000-0x00007FFD48854000-memory.dmp

Download

memory/2308-10-0x00007FFD47EB0000-0x00007FFD48854000-memory.dmp

Download

memory/2308-1-0x00007FFD47EB0000-0x00007FFD48854000-memory.dmp

Download

memory/2308-5-0x00007FFD47EB0000-0x00007FFD48854000-memory.dmp

Download

memory/2308-4-0x000001CC68DB0000-0x000001CC68DD2000-memory.dmp

Download

memory/2308-6-0x00007FFD47EB0000-0x00007FFD48854000-memory.dmp

Download

memory/2308-7-0x00007FFD47EB0000-0x00007FFD48854000-memory.dmp

Download

memory/2308-23-0x00007FFD47EB0000-0x00007FFD48854000-memory.dmp

Download

memory/2308-8-0x00007FFD47EB0000-0x00007FFD48854000-memory.dmp

Download

memory/2308-16-0x00007FFD47EB0000-0x00007FFD48854000-memory.dmp

Download

memory/2308-11-0x00007FFD47EB0000-0x00007FFD48854000-memory.dmp

Download

memory/2308-21-0x00007FFD47EB0000-0x00007FFD48854000-memory.dmp

Download

memory/2308-12-0x00007FFD47EB0000-0x00007FFD48854000-memory.dmp

Download

memory/2308-18-0x000001CC68DE0000-0x000001CC68DEA000-memory.dmp

Download

memory/2308-17-0x000001CC68E60000-0x000001CC68F14000-memory.dmp

Download

memory/2308-0-0x00007FFD4803F000-0x00007FFD48040000-memory.dmp

Download

memory/2308-13-0x00007FFD47EB0000-0x00007FFD48854000-memory.dmp

Download

memory/2308-15-0x00007FFD47EB0000-0x00007FFD48854000-memory.dmp

Download

memory/2308-14-0x00007FFD47EB0000-0x00007FFD48854000-memory.dmp

Download

memory/4420-28-0x00000000068F0000-0x0000000006AB2000-memory.dmp

Download

memory/4420-31-0x0000000006FF0000-0x000000000751C000-memory.dmp

Download

memory/4420-29-0x00000000067A0000-0x0000000006816000-memory.dmp

Download

memory/4420-19-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/4420-327-0x00000000742B2000-0x00000000742B3000-memory.dmp

Download

memory/4420-27-0x0000000006670000-0x0000000006722000-memory.dmp

Download

memory/4420-32-0x0000000006B30000-0x0000000006B4E000-memory.dmp

Download

memory/4420-22-0x00000000742B2000-0x00000000742B3000-memory.dmp

Download

memory/4420-1269-0x0000000007D90000-0x0000000007D9A000-memory.dmp

Download

memory/4420-30-0x0000000006820000-0x0000000006870000-memory.dmp

Download

memory/4420-26-0x00000000064A0000-0x0000000006506000-memory.dmp

Download

memory/4420-350-0x00000000742A0000-0x0000000074A5C000-memory.dmp

Download

memory/4420-24-0x0000000005CF0000-0x00000000062AA000-memory.dmp

Download

memory/4420-25-0x00000000742A0000-0x0000000074A5C000-memory.dmp

Download

memory/4420-1262-0x0000000006CE0000-0x0000000006D02000-memory.dmp

Download

memory/4420-1263-0x0000000007520000-0x000000000787B000-memory.dmp

Download

memory/4420-1268-0x0000000007DA0000-0x0000000007E32000-memory.dmp

Download

memory/4492-153-0x000001DA98110000-0x000001DA98150000-memory.dmp

Download