phantom_stealer | b79d958cdf29416de5a7f1bea0de9a8010a0ae3136f00cf078de06e4c301e888

Analysis

max time kernel
149s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Protzected_Script.ps1
Size 3.2MB
Sample260913-pg6z6aba95
SHA256 b79d958cdf29416de5a7f1bea0de9a8010a0ae3136f00cf078de06e4c301e888
MD5 6b48c391e708cc867e8ed1d07780753a
SHA1 502a3e57af8319bf13148a77f450236b5a774d3e
SHA512 2dc531f8a23fb7a10c027ffe1a3182caba09165d3da3a1746527b22f978f0a8ba0f98eeafa63ab4978623d1addb7cc0892bd7d4fad8dfb2011ec9ce08f893fd5
SSDEEP 49152:iVuGF/IACfTwGm+DCzXItO6BA4wy0cWw7Bg:M
TLSH
T19FF533118E76BEF9CD6C4729107F7A182A21AD85D458B1DE7FCD64DB136AF0202B7838
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution phantom_stealer persistence stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
exczx.com
Port
587
Username
[email protected]
Password
$+WKpO!O6}Mcj=6&
Email to
[email protected]

Mutex

4BI8FC7UM2M71VZJVS1V

Attributes

anti_analysis
0
cb_enables_ssl
1
debug
0
keylogger
0
start_delay
0
startup
0

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 1 IoCs

resource	yara_rule
behavioral2/memory/940-24-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	icanhazip.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3648 set thread context of 940	3648	PowerShell.exe	93

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3648	PowerShell.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2168	chrome.exe
2872	msedge.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	aspnet_compiler.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	aspnet_compiler.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3648	PowerShell.exe
3648	PowerShell.exe
3648	PowerShell.exe
3648	PowerShell.exe
3648	PowerShell.exe
3648	PowerShell.exe
3648	PowerShell.exe
3648	PowerShell.exe
3648	PowerShell.exe
3648	PowerShell.exe
3648	PowerShell.exe
3648	PowerShell.exe
3648	PowerShell.exe
3648	PowerShell.exe
3648	PowerShell.exe
940	aspnet_compiler.exe
940	aspnet_compiler.exe
940	aspnet_compiler.exe
940	aspnet_compiler.exe
3068	chrome.exe
3068	chrome.exe
940	aspnet_compiler.exe
940	aspnet_compiler.exe
940	aspnet_compiler.exe
3648	PowerShell.exe
3648	PowerShell.exe
940	aspnet_compiler.exe
940	aspnet_compiler.exe
940	aspnet_compiler.exe
940	aspnet_compiler.exe
940	aspnet_compiler.exe
3140	firefox.exe
3140	firefox.exe
3648	PowerShell.exe
3140	firefox.exe
3140	firefox.exe
3140	firefox.exe
3140	firefox.exe
3140	firefox.exe
3140	firefox.exe
3140	firefox.exe
3140	firefox.exe
3140	firefox.exe
3140	firefox.exe
3140	firefox.exe
3140	firefox.exe
3140	firefox.exe
3140	firefox.exe
3140	firefox.exe
3140	firefox.exe
3140	firefox.exe
3140	firefox.exe
3648	PowerShell.exe
940	aspnet_compiler.exe
940	aspnet_compiler.exe
940	aspnet_compiler.exe
940	aspnet_compiler.exe
940	aspnet_compiler.exe
3648	PowerShell.exe
940	aspnet_compiler.exe
940	aspnet_compiler.exe
3648	PowerShell.exe
3648	PowerShell.exe
940	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	3648	PowerShell.exe
Token: SeDebugPrivilege	940	aspnet_compiler.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
3068	chrome.exe
3068	chrome.exe
3140	firefox.exe
3140	firefox.exe
3140	firefox.exe
3140	firefox.exe
3140	firefox.exe
3140	firefox.exe
3140	firefox.exe
3140	firefox.exe
7144	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3140	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 1568	3648	PowerShell.exe	88
PID 3648 wrote to memory of 5116	3648	PowerShell.exe	89
PID 3648 wrote to memory of 1004	3648	PowerShell.exe	90
PID 3648 wrote to memory of 2716	3648	PowerShell.exe	91
PID 3648 wrote to memory of 5976	3648	PowerShell.exe	92
PID 3648 wrote to memory of 940	3648	PowerShell.exe	93
PID 3648 wrote to memory of 940	3648	PowerShell.exe	93
PID 3648 wrote to memory of 940	3648	PowerShell.exe	93
PID 3648 wrote to memory of 940	3648	PowerShell.exe	93
PID 3648 wrote to memory of 940	3648	PowerShell.exe	93
PID 940 wrote to memory of 3068	940	aspnet_compiler.exe	95
PID 3068 wrote to memory of 5960	3068	chrome.exe	96
PID 940 wrote to memory of 3068	940	aspnet_compiler.exe	95
PID 940 wrote to memory of 3068	940	aspnet_compiler.exe	95
PID 940 wrote to memory of 5960	940	aspnet_compiler.exe	96
PID 940 wrote to memory of 5960	940	aspnet_compiler.exe	96
PID 3068 wrote to memory of 1388	3068	chrome.exe	97
PID 3068 wrote to memory of 2168	3068	chrome.exe	98
PID 3068 wrote to memory of 1928	3068	chrome.exe	99
PID 940 wrote to memory of 1928	940	aspnet_compiler.exe	99
PID 940 wrote to memory of 3068	940	aspnet_compiler.exe	95
PID 940 wrote to memory of 3068	940	aspnet_compiler.exe	95
PID 3068 wrote to memory of 8	3068	chrome.exe	100
PID 3068 wrote to memory of 4304	3068	chrome.exe	101
PID 3068 wrote to memory of 2740	3068	chrome.exe	102
PID 3068 wrote to memory of 4668	3068	chrome.exe	103
PID 3068 wrote to memory of 2428	3068	chrome.exe	104
PID 940 wrote to memory of 5960	940	aspnet_compiler.exe	96
PID 940 wrote to memory of 5960	940	aspnet_compiler.exe	96
PID 940 wrote to memory of 2168	940	aspnet_compiler.exe	98
PID 940 wrote to memory of 2168	940	aspnet_compiler.exe	98
PID 940 wrote to memory of 1388	940	aspnet_compiler.exe	97
PID 940 wrote to memory of 1388	940	aspnet_compiler.exe	97
PID 3068 wrote to memory of 1220	3068	chrome.exe	105
PID 940 wrote to memory of 2740	940	aspnet_compiler.exe	102
PID 940 wrote to memory of 2740	940	aspnet_compiler.exe	102
PID 940 wrote to memory of 1928	940	aspnet_compiler.exe	99
PID 940 wrote to memory of 1928	940	aspnet_compiler.exe	99
PID 940 wrote to memory of 4668	940	aspnet_compiler.exe	103
PID 940 wrote to memory of 4668	940	aspnet_compiler.exe	103
PID 940 wrote to memory of 4304	940	aspnet_compiler.exe	101
PID 940 wrote to memory of 4304	940	aspnet_compiler.exe	101
PID 3068 wrote to memory of 1432	3068	chrome.exe	106
PID 940 wrote to memory of 3068	940	aspnet_compiler.exe	95
PID 940 wrote to memory of 3068	940	aspnet_compiler.exe	95
PID 940 wrote to memory of 5960	940	aspnet_compiler.exe	96
PID 940 wrote to memory of 5960	940	aspnet_compiler.exe	96
PID 940 wrote to memory of 2428	940	aspnet_compiler.exe	104
PID 940 wrote to memory of 2168	940	aspnet_compiler.exe	98
PID 940 wrote to memory of 2168	940	aspnet_compiler.exe	98
PID 940 wrote to memory of 1388	940	aspnet_compiler.exe	97
PID 940 wrote to memory of 1388	940	aspnet_compiler.exe	97
PID 940 wrote to memory of 2740	940	aspnet_compiler.exe	102
PID 940 wrote to memory of 2740	940	aspnet_compiler.exe	102
PID 940 wrote to memory of 1220	940	aspnet_compiler.exe	105
PID 940 wrote to memory of 1220	940	aspnet_compiler.exe	105
PID 940 wrote to memory of 1928	940	aspnet_compiler.exe	99
PID 940 wrote to memory of 1928	940	aspnet_compiler.exe	99
PID 940 wrote to memory of 4668	940	aspnet_compiler.exe	103
PID 940 wrote to memory of 4668	940	aspnet_compiler.exe	103
PID 940 wrote to memory of 4304	940	aspnet_compiler.exe	101
PID 940 wrote to memory of 4304	940	aspnet_compiler.exe	101
PID 940 wrote to memory of 3068	940	aspnet_compiler.exe	95
PID 940 wrote to memory of 3068	940	aspnet_compiler.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Protzected_Script.ps1
1⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1568
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5116
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1004
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2716
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5976
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tnyb2aby.pkh"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tnyb2aby.pkh /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\tnyb2aby.pkh\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\tnyb2aby.pkh --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x138,0x13c,0x140,0x114,0x144,0x7ffb40c7c728,0x7ffb40c7c734,0x7ffb40c7c740
      4⤵
      PID:5960
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tnyb2aby.pkh" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1908,i,18233121181785923857,10936478596669954933,262144 --field-trial-handle=2636,i,10535226743258900076,1523946472758506300,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:2
      4⤵
      PID:1388
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tnyb2aby.pkh" --force-high-res-timeticks=disabled --metrics-shmem-handle=2140,i,15753089607133957226,9659829151613317827,524288 --field-trial-handle=2636,i,10535226743258900076,1523946472758506300,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:11
      4⤵
      System Time Discovery
      PID:2168
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tnyb2aby.pkh" --force-high-res-timeticks=disabled --metrics-shmem-handle=2276,i,12124437069535848181,11261910025548184751,524288 --field-trial-handle=2636,i,10535226743258900076,1523946472758506300,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:13
      4⤵
      PID:1928
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tnyb2aby.pkh" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,12353843959993387236,2322468516544495558,2097152 --field-trial-handle=2636,i,10535226743258900076,1523946472758506300,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
      4⤵
      PID:8
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tnyb2aby.pkh" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,398511399596380802,12496969686789796573,2097152 --field-trial-handle=2636,i,10535226743258900076,1523946472758506300,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
      4⤵
      PID:4304
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tnyb2aby.pkh" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3416,i,6383161900287296676,9122664880413520876,2097152 --field-trial-handle=2636,i,10535226743258900076,1523946472758506300,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
      4⤵
      PID:2740
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tnyb2aby.pkh" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3436,i,17420981213562082969,1412183605124756498,2097152 --field-trial-handle=2636,i,10535226743258900076,1523946472758506300,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:9
      4⤵
      PID:4668
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tnyb2aby.pkh" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4016,i,3027298875444771448,16954218521742354933,2097152 --field-trial-handle=2636,i,10535226743258900076,1523946472758506300,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:9
      4⤵
      PID:2428
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tnyb2aby.pkh" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3892,i,5869534772891446595,310962453871277991,2097152 --field-trial-handle=2636,i,10535226743258900076,1523946472758506300,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:1
      4⤵
      PID:1220
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tnyb2aby.pkh" --force-high-res-timeticks=disabled --metrics-shmem-handle=4588,i,17153794159556546828,7285966408582118513,524288 --field-trial-handle=2636,i,10535226743258900076,1523946472758506300,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:14
      4⤵
      PID:1432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gsnbufzh.lgm"
    3⤵
    PID:5140
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\gsnbufzh.lgm
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:3140
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {af2dfce9-8b29-42b7-a418-ff28c1086374} -parentPid 3140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3140" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:960
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2184 -prefsLen 27133 -prefMapHandle 2188 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {b2fc5948-b272-41e7-8075-14a06c422a3a} -parentPid 3140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:5604
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\5ead2488-3038-46f7-a117-f7cb16c536a9.dmp"
        5⤵
        
        PID:928
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2272 -prefsLen 27133 -prefMapHandle 2904 -prefMapSize 270279 -ipcHandle 2928 -initialChannelId {5ee296f4-c0bc-4a50-a2c1-5c6509e29fc0} -parentPid 3140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3140" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:3512
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ee2445bc-261d-4dc7-afb7-9f1991199d57.dmp"
        5⤵
        
        PID:4080
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2928 -prefsLen 27133 -prefMapHandle 3348 -prefMapSize 270279 -ipcHandle 3316 -initialChannelId {5e60f5d7-869b-432e-b755-40b9f7479666} -parentPid 3140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3140" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:2872
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\35c37900-2770-400f-a6c0-0d81df40759b.dmp"
        5⤵
        
        PID:2116
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3316 -prefsLen 27198 -prefMapHandle 3508 -prefMapSize 270279 -ipcHandle 3344 -initialChannelId {9d6653cf-208b-4510-a4bd-b5b75ec58fcb} -parentPid 3140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3140" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:3632
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3808 -prefsLen 27274 -prefMapHandle 3812 -prefMapSize 270279 -jsInitHandle 3816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3824 -initialChannelId {1a1cf727-2bff-4b1f-a43e-ddab0aa76ab9} -parentPid 3140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:3520
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\294f3b40-60ad-448a-9350-df0e8e52b639.dmp"
        5⤵
        
        PID:1940
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3512 -prefsLen 27274 -prefMapHandle 3672 -prefMapSize 270279 -ipcHandle 3432 -initialChannelId {a75ed070-71fa-492e-8047-fbbda1f07fbe} -parentPid 3140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3140" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:4932
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\710e1b7b-b014-45f3-8cb0-5c6fe95f9565.dmp"
        5⤵
        
        PID:1708
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3964 -prefsLen 27274 -prefMapHandle 3948 -prefMapSize 270279 -ipcHandle 4004 -initialChannelId {3aa7b171-822f-46d6-91e3-c8b273de29c2} -parentPid 3140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3140" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:2212
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4548 -prefsLen 34773 -prefMapHandle 4552 -prefMapSize 270279 -jsInitHandle 4560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4568 -initialChannelId {3ec397e8-c469-4c07-8944-6d8294439559} -parentPid 3140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:2836
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3172 -prefsLen 35010 -prefMapHandle 5040 -prefMapSize 270279 -ipcHandle 5056 -initialChannelId {cbcc8a11-387f-456d-8886-3b07f3dd1006} -parentPid 3140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:6752
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5132 -prefsLen 32900 -prefMapHandle 5136 -prefMapSize 270279 -jsInitHandle 5140 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5148 -initialChannelId {0545368c-e2b0-4665-945e-aa71bcb5b59e} -parentPid 3140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:6760
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5380 -prefsLen 32952 -prefMapHandle 5384 -prefMapSize 270279 -jsInitHandle 5388 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5400 -initialChannelId {f66465d1-7f82-4fb3-ab38-9e0f217eb679} -parentPid 3140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:6784
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5412 -prefsLen 32952 -prefMapHandle 5416 -prefMapSize 270279 -jsInitHandle 5420 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5428 -initialChannelId {b951fae8-a960-48fa-b3f3-4d7f883c024a} -parentPid 3140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:6792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge"
    3⤵
    - Enumerates system info in registry
    - Suspicious use of FindShellTrayWindow
    PID:7144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x230,0x260,0x264,0x22c,0x270,0x7ffb3be5c188,0x7ffb3be5c194,0x7ffb3be5c1a0
      4⤵
      PID:4740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1836,i,6439228580175307601,12813461676799433912,262144 --field-trial-handle=2472,i,7270011150403638102,15647399750956994409,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:2
      4⤵
      PID:2556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2068,i,18255857420225916998,3924656134544300311,524288 --field-trial-handle=2472,i,7270011150403638102,15647399750956994409,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:11
      4⤵
      System Time Discovery
      PID:2872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2652,i,6936795238031439402,3862342323349921906,524288 --field-trial-handle=2472,i,7270011150403638102,15647399750956994409,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:13
      4⤵
      PID:5460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,13423409552437900432,13320908501453422874,2097152 --field-trial-handle=2472,i,7270011150403638102,15647399750956994409,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
      4⤵
      PID:3888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,14866112706367892165,17122653363844544573,2097152 --field-trial-handle=2472,i,7270011150403638102,15647399750956994409,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3928,i,16187196262316038487,4794851882165706510,524288 --field-trial-handle=2472,i,7270011150403638102,15647399750956994409,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:14
      4⤵
      PID:724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3924,i,1303151676527404,14918232902334877513,524288 --field-trial-handle=2472,i,7270011150403638102,15647399750956994409,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:14
      4⤵
      PID:2968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3960,i,9654839981967865547,8452525199681826964,524288 --field-trial-handle=2472,i,7270011150403638102,15647399750956994409,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:14
      4⤵
      PID:2132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4012,i,15497983627252088413,2938367701018005274,2097152 --field-trial-handle=2472,i,7270011150403638102,15647399750956994409,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
      4⤵
      PID:1524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4052,i,775450299305562134,17037860306332602718,2097152 --field-trial-handle=2472,i,7270011150403638102,15647399750956994409,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:9
      4⤵
      PID:6148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4104,i,13067604336399123243,15893308677081256527,2097152 --field-trial-handle=2472,i,7270011150403638102,15647399750956994409,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
      4⤵
      PID:6176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4160,i,8507911494517770592,16587559559734038084,2097152 --field-trial-handle=2472,i,7270011150403638102,15647399750956994409,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:9
      4⤵
      PID:6244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4184,i,9571235736624964734,16690619943740332554,2097152 --field-trial-handle=2472,i,7270011150403638102,15647399750956994409,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1
      4⤵
      PID:6268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4212,i,163356818241848775,14175366280728068704,2097152 --field-trial-handle=2472,i,7270011150403638102,15647399750956994409,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:9
      4⤵
      PID:6276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4228,i,5948703450967151977,18288603449546004344,2097152 --field-trial-handle=2472,i,7270011150403638102,15647399750956994409,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:1
      4⤵
      PID:6280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4256,i,13570917995374461175,17407613824862854802,2097152 --field-trial-handle=2472,i,7270011150403638102,15647399750956994409,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:9
      4⤵
      PID:6292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4176,i,4725525407060389808,13281018037700056748,2097152 --field-trial-handle=2472,i,7270011150403638102,15647399750956994409,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
      4⤵
      PID:6300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4308,i,8424737347408716058,2880595774119734258,2097152 --field-trial-handle=2472,i,7270011150403638102,15647399750956994409,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:9
      4⤵
      PID:6308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,17568857045923138619,3133416154444982189,524288 --field-trial-handle=2472,i,7270011150403638102,15647399750956994409,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:14
      4⤵
      PID:6332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1152
        5⤵
        
        PID:4856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,3047801460854179957,17035765108798580807,524288 --field-trial-handle=2472,i,7270011150403638102,15647399750956994409,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:14
      4⤵
      PID:3384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,6045084665402972739,13169324883515855152,524288 --field-trial-handle=2472,i,7270011150403638102,15647399750956994409,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
      4⤵
      PID:6900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,10571373231899598406,8997381996283873295,524288 --field-trial-handle=2472,i,7270011150403638102,15647399750956994409,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
      4⤵
      PID:6840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=624
        5⤵
        
        PID:4372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,16897740668556859204,3148101550592695625,524288 --field-trial-handle=2472,i,7270011150403638102,15647399750956994409,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
      4⤵
      PID:7052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,13195292971547865599,1620271574619318482,524288 --field-trial-handle=2472,i,7270011150403638102,15647399750956994409,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
      4⤵
      PID:7092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge\Crashpad\settings.dat
Size 280B
SHA256 72b7879497e8ac51d83e54c27bf274f82d7f214ffe191225f29de4721144f6b4
MD5 21e465e6138727459c23f18f89121982
SHA1 d5d57f757374ff1d6baeba07b3c60bba1c1e0832
SHA512 ae4773ae5b806e7230e833aca8c261a65084f012f7547a3b6e22ab4b3b9728de4c3cdc2ec2524e1ea1c441d695dc072f6079adddc1a62efd1a581c19b14018e8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge\Crashpad\settings.dat
Size 280B
SHA256 acb9f32b082d7065c88a37400de4d01c2e583ea74e52fe308d440461e5a8f946
MD5 4bfb5eac62f8ce02a58000d39c4bf617
SHA1 1cc2df14a2235f786aff9218dc5d9819a90469e2
SHA512 eeb57cef40ba85876782270d1d09541db37bc6192719301a89eb1c421e796a94b0267b75e99fa488cdc02a42ddeac5082dc54c8bf6ed06f1490e7eaec9ccc5bc
TLSH
T1B3D022B0BE220020F380B2FA08E02BA8C280CBAC000A0B232220202088C030EE0230FC
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge\Local State
Size 3KB
SHA256 7e2a24dfa1b6d99acad71dfe5246fd20bfda328dc8a2f62ea72d2c96302b273b
MD5 f2721f863e7aed380fe898f6d8052640
SHA1 1bb892d30d770e577a18082abbd620af07f74b27
SHA512 8dbed13d7f9c7bd79dfc304c70672b8d7d8b01ad44d024f3e180d22cd1b62a7a7d1f47c7ad2786f7a49e8bcaeff67160623305f6543104a14a5ba43532d99064
TLSH
T1A881A6716424EC334AF56A48749A3BD38E7830B7E815AF95F6D9571804FB24C2B4AC2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge\Local State
Size 4KB
SHA256 46453e2b931e83d7cb58fa50d6c4d96a58ece2a70f11624c6f883cd6c2402f6d
MD5 dfebcebf40e69382dd27da9f1bc3fe00
SHA1 ab5349739311659b94f36f5927f56663e73ec1af
SHA512 fa759f267c6955f2fc7224f5072997bbec05c645ef6d3f82ea6183b4f117f1140023301e2007f086e622c01bece1adb662ab6d97594bf6908223692aeca185d4
SSDEEP 96:QqGNkLQsFfmXLjOFC58Frh/cInURoDotovETD+BizvcSdZca0eUn4vQV69q4a:bGNT7XHOLooDUwC+EZcaq4vQc2
TLSH
T179A197716474EC275EF5AE04B4863793AEB43177E844BF99E6DC1A0C04EB3482749C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59e797.TMP

Path C:\Users\Admin\AppData\Local\Temp\sa5m13y2.dge\Local State~RFe59e797.TMP
Size 1KB
SHA256 f7cf5afdfb175d11fdaf065d5d753e8102060ac64d45587ec1b88de9473680e7
MD5 176255c6eb9aa48a95b28ac5b585eb5a
SHA1 16d8ca81c6e11b9494a8193ee32e2750777bfd57
SHA512 cfd77f968ddc09adb7c9a3c9b19dc9cff57d533c65f38b5bf1be554c97d1cc7ee9be3e30daa331673de9c5094ca2218848a2d97d1592ef4f32d74524cfa9bd4a
TLSH
T1213162B168682C33EDB05B4A714ABF935E7471BAE1556E8862EC0D1D05F728C264AC3F
MD5 SHA1 SHA512 TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Temp\tnyb2aby.pkh\Default\Extension Rules\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\tnyb2aby.pkh\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\tnyb2aby.pkh\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\tnyb2aby.pkh\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\tnyb2aby.pkh\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\tnyb2aby.pkh\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\tnyb2aby.pkh\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 17d06e987c0b7855a2eb025d687b1589de4e2875625edcf0ad3abf373d4d8fe3
MD5 5637cb931c519e768a33723fcfcffa1a
SHA1 fb74d15cdfefd01f1ca65343f889b70208d3c29b
SHA512 e10dcd630a9f6e463c0b0e2b6caea05d98db71468c97bb3083ba37db90117b353b9aca3a39b949e333ebd64447c5873c2021def55f0c69bd68f34156e2c38dfe
SSDEEP 48:p/1fdOMiJOViPmiW4iFBJ9zCNYnYdLXuH0ps/8fdOMiJOViPmiW4iFBJ9zvYnrgk:VGJO8PBkFDJoVuUQzJO8PBkFDJv0IuT
TLSH
T1EA91F4105FD65B5AF3F7AE7355733700BB7BB9584A1C4E4E008945040C32B18A5ADFA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

294f3b40-60ad-448a-9350-df0e8e52b639.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\294f3b40-60ad-448a-9350-df0e8e52b639.dmp
Size 73KB
SHA256 82c4b9e527629d9cca707c215395aacdb7660d75ce1d1d049ed47ec49bcbcd72
MD5 48eccae41c455103ea75fc60e5d12d73
SHA1 b03ef0f4a51713184194384a85e53355ae553dfe
SHA512 56599e91879401406fd46253a9453c7130a5d375fb671c17e6afcff87d2ac2e9288201e6f34f97b31e3cc530f87679dee626b2551f34a5d614672f2770528abe
SSDEEP 384:o/B28QzP3dwRqST/bFQJrzRX0R7Y0l5KkijLit7c1ZV/U2jYK0jiKrknstR:o/BnQT3eqSDbFQEp2jirkK
TLSH
T15F73CC3257C51A32D565C731A8E7EB023BF6E42807A3839F271161BE6D677C06E30E66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

294f3b40-60ad-448a-9350-df0e8e52b639.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\294f3b40-60ad-448a-9350-df0e8e52b639.extra
Size 10KB
SHA256 9d56bd3860c09db21abcad7828f657f3d85c52904aa56d134ca8a0a9c57b07ab
MD5 bbe1f6a854daf7a66183817c3f69184b
SHA1 913e94e1e68398b9d02349022f9e4588c91263fc
SHA512 6b0dda1ec73da3aee4c5aa1f44c1f39b7e016e54a86fa11dd275ad92941692844e913d9b512dada0d0c3b5962d5684d7382bc87a3c70c77ce2b05ad71012f933
SSDEEP 96:SEWC3TnrY6pw6mJFFd8H0Rh7CsevBb1d0+YjMLlIrLlhTLlaXv7aFOKtILfcBCqc:SaDmLFSG7uvZ8+8LaxsPywlxdtfo3
TLSH
T151227253879724B7AD4194C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

294f3b40-60ad-448a-9350-df0e8e52b639.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\294f3b40-60ad-448a-9350-df0e8e52b639.extra
Size 10KB
SHA256 98cb1ddc1ad8733198b3de343bd9969d105a62bcaf6b16d1de131fdd22d482ca
MD5 1b4c726a18c8e4c38a0b73d42096d96d
SHA1 b9f9caf11f57b8ac557db4a0ac3c097c16d1f629
SHA512 91fa9bba8c3b7e7be11bd7852f8ab906daa4f48c7d567dd0dbfa64e0c17fa2631980f1868472b3c9071184f6d64ee6fd3c74a00d857d603b84dd859e3f1e735b
SSDEEP 192:Sa5cFgwiR4pDDnTYapdVxzPRWBHa4T/fKNUal5dtfo7bLXJ:h5cFgwiGDz15WBHa4TxaLA7Z
TLSH
T1A222E731881CE837E7D6AC8DFA392E3AD26D7B1A10E6786C41CCCB49C1A94786779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35c37900-2770-400f-a6c0-0d81df40759b.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\35c37900-2770-400f-a6c0-0d81df40759b.dmp
Size 73KB
SHA256 84144db9588fa96c37d8144c8c4b047f0903310f944634a05f2df8c8bada5237
MD5 3c667b163a8abc30266683ed7464a60a
SHA1 64ccf072228265e00ecd128e42b185f3e25ac2bf
SHA512 b065828f04d1f20dfd05a2e43738a3e82334efd090179d9c645fb527aa46023575b32c8d855e2fce50c961e2160b3e1c36b36ff72c02e930b7902b5aebc5a1cc
SSDEEP 384:oNB2ygTZ4bHllBSo8H+0+MFmVlR0XReBC66PE5fdc7r0nstR:oNBVK4bHZM+0lFRXkE66/7r0K
TLSH
T14873531253CE1862E565C735A8EBEB423FF6E4143793836F0322516A6C777C4AD30E6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35c37900-2770-400f-a6c0-0d81df40759b.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\35c37900-2770-400f-a6c0-0d81df40759b.extra
Size 10KB
SHA256 671bfe6198e04e518fccf42e8c3a4d9a5dabdc10a55036d53325458bd69409f6
MD5 81e3dbec4dae4023fd374742c1330f84
SHA1 0d7fa901f9c50f8e0c41a0a48478b4ead70e84dd
SHA512 815b98b76b84a8d604132e19836df35a124e2f15ef667403ae133e8f201e817c232e5035e5cf166c8816612ed5a4e3188e2dcb87a815aa00d427b8f7f780a140
SSDEEP 96:SEWCDTnrY6pw6mJFFd8H0Rh7CsevBb1d0+YjMLlIrLlhTLlaXv7a4OKtILfcBCqA:SaXmLFSG7uvZ8+8LrxsPywlNKfoNO
TLSH
T15F227353879724B79D4194C4BC30AE7C45EC6FAA61F958A802CC4D47FA464F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35c37900-2770-400f-a6c0-0d81df40759b.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\35c37900-2770-400f-a6c0-0d81df40759b.extra
Size 10KB
SHA256 dd76ddd97794fb0cd1731b3e0ffd27ab0edb0f0c7c8077698fb5cbaaaeb1ca6e
MD5 8756656fc2b19bdff5ee5072df09f129
SHA1 20fbbf892fd6b4ebd61ec97596fa6e2b3f24cf09
SHA512 83f0646f4a57b76e255d7d05564080d51262de0de7ce786a665b6779c62f54b5a363c6820b342a626eebff18bf01934878ab87dffaf2d9a2abed0b1bf6e1920b
SSDEEP 192:SaFcFgwiR4pDDnTYapdVxzPRWBHF4T/fKNUal1KfoNWbLXJ:hFcFgwiGDz15WBHF4TxaWANWZ
TLSH
T1F122E831881CE837E7D7AC8DFB392E3A926D7B1A10E6786C41CCCB49C1A94786779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5ead2488-3038-46f7-a117-f7cb16c536a9.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\5ead2488-3038-46f7-a117-f7cb16c536a9.dmp
Size 77KB
SHA256 ff6cbabdb15287e3eb6824d9d2ceba60e5caf67e7b023098bd24efa570e94aad
MD5 4b255442dfd291c1a7b33d488b843289
SHA1 e579b6ac930b39b0aa391081f2fa7ed3b5c31d69
SHA512 c1ded61368d238115e9451bbf6a921790b38c93376946f328682c01ecfbd0f763421e48ea86859811cd0c95e57762f1416b7295efed04eec0a1b8110e7c0785c
SSDEEP 384:QdtLNP9VHXteCl5j7VkH9C35lmlN4GwddMmrnstR:YZHVq9YlS4vJK
TLSH
T17A73EB1253C65822D42AC73168E76B02BBF6E4183793435F0B2655BE6CA77C06D70FBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5ead2488-3038-46f7-a117-f7cb16c536a9.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\5ead2488-3038-46f7-a117-f7cb16c536a9.extra
Size 1KB
SHA256 8c3fc5f427df95cee1cc0a98d920f6b188b60ebdbb6fa7bf083d5a61700aecf7
MD5 ac7f3d8d5134f40d59559b83e6943ca9
SHA1 3e004c8eb34295117e2adc718020e831602f85cd
SHA512 bcc877b0912f10f7a583cc20af948b0a4ea6abbf43acdfb4e163c0504e18833dffc0af7dc8bd54f76f3dbec108b7e87edc0c22d96849c0db4b3705044491caea
TLSH
T14D3174B781EC2D268D578A98B37F1303CA9A772700D35D4C34CC4A0C869E0DD9766AC3
MD5 SHA1 SHA512 TLSH

Submit Download

5ead2488-3038-46f7-a117-f7cb16c536a9.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\5ead2488-3038-46f7-a117-f7cb16c536a9.extra
Size 3KB
SHA256 a833bc5aedd77dc3f49223c582cc9f2552dd1d65df16f47d798ee991c8ef4d2b
MD5 a03d079204221a579aec9ef2941d2f23
SHA1 18d0d838f6e51c645fda2c72405ff8f8e979b638
SHA512 ec269504e8cb98ccda19dd709db086c0d5118cf82c4ddb76b785f5527ccdd4f4093fc39aea2024aec68672442c39ac5fbeb9c2ae25d8e6883f28780048131902
TLSH
T13A812332905CE9375AEB5DDEF3376E1E889FB31994A23A8C50CAC75C41B8CB46386143
MD5 SHA1 SHA512 TLSH

Submit Download

710e1b7b-b014-45f3-8cb0-5c6fe95f9565.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\710e1b7b-b014-45f3-8cb0-5c6fe95f9565.dmp
Size 71KB
SHA256 717fa5ccd9aa856637dc5b82c5fe9604ee74826810dc6f86cf3cc5d44f978f03
MD5 00b73385af54a69e61f55f402fd87e77
SHA1 e63aa61c1313562993e66942be6108f9c9258761
SHA512 d80108685545e509d4b14301e50911d59b847a16e465ce991f1273c055c88d262c777aca5a14eede6b581bac3e337055a217094af9a57e3b474ae8e46b0fa94e
SSDEEP 384:3B2HxwOThFjbcFlpmIoK6JXldpQw4e8KeDBXBHI2nstR:3BMFXjbcBmIYXXbe9BHtK
TLSH
T19563E69253E56822E465C33168E7AB123BF2F4144793839FC329617E7C6B7C06D34EA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

710e1b7b-b014-45f3-8cb0-5c6fe95f9565.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\710e1b7b-b014-45f3-8cb0-5c6fe95f9565.extra
Size 10KB
SHA256 a931e2acc6eced23f8f5cb2a058956c2a2f53f429a931dcc26afe5369198e038
MD5 c35ef2fdaf241e18e043624b4b769b01
SHA1 f0ef0816217418a6cefe7eb2dc6fe1e5c6e42b39
SHA512 fe59459d88db660ff75921df830f51530b4eedf935f3903ad8ed5cce7d54b5dbb8ae363044c90199804cc4d4e129cb6b87c3ffe10ba5600fe408a21c8976db03
SSDEEP 96:SEWCYfTnrY6pw6mJFFd8H0Rh7CsevBb1d0+YjMLlIrLlhTLlaXv7amSOKtILfcBs:SaYLmLFSG7uvZ8+8LmhxsPywlQPfoO
TLSH
T1A8228353879724B7AD4194C4BC30AE7C45EC6FAA61F958A802CC4D47FA464F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

710e1b7b-b014-45f3-8cb0-5c6fe95f9565.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\710e1b7b-b014-45f3-8cb0-5c6fe95f9565.extra
Size 10KB
SHA256 4dc9ab0d35c241d31ac556bf1c3ce4ee48d985385c42d56110c3cafeb6ad1341
MD5 54aa8869603ed4cddd3e1da8c1b958ab
SHA1 4d223cda30f0aa447e18d23f272f7da11ba5139f
SHA512 fbd8443e4e1642d6afdc7e17edb90ed2df886f6fdfcd8aa8e49e9765143de22d2ae2704c6c4d2d4d43cc1e5e471b8fc74d9fd10897184a143dcf3954cef0d313
SSDEEP 192:SaYhcFgwiR4pDDnTYapdVxzPRWBHbI4T/fKNUaloPfoWbLXJ:hMcFgwiGDz15WBHbI4TxagAWZ
TLSH
T16732E831881CE837E7D6AC8DFA392E36D66D7B1A10E6786C40CCCB49C1A9474A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee2445bc-261d-4dc7-afb7-9f1991199d57.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ee2445bc-261d-4dc7-afb7-9f1991199d57.dmp
Size 74KB
SHA256 2dfa07e4355ba98c2578c79972b35740ed57398cbcb6e485e1ed51bd22970aa2
MD5 a77006f1cd67d6fddd1d6c06b2cfbcf4
SHA1 76b65d666487d49b353953c2c47d4310ed1b66b4
SHA512 4e1366f5dfe8bf1809e9ed4505482d2bc5770b19999469832ab7b8d8468890428c28328a960aff2e3c8d6fefdbe3765f1f584f8690620b3b58cf4fca3370163a
SSDEEP 384:oyB26XQYIUMbBQguU1a1WYlKaXi35EgWlZbnstR:oyB9gYIUGtuU3ogWl9K
TLSH
T19673B65373C63B22D6A6D73098E76F823BF6F4140752437F1312916A5CAB3C86D30AA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee2445bc-261d-4dc7-afb7-9f1991199d57.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ee2445bc-261d-4dc7-afb7-9f1991199d57.extra
Size 10KB
SHA256 316a27deabdc2af920f77cd7a491693fb9f4169e76a6d64ea81f4603d34537b3
MD5 568fafdc10c9e7cd1a6dcdb6b36749b9
SHA1 c3e37b3afe940b08e3de9adfb8a13c8f4af4eb7a
SHA512 4cdd5cfb5de8305b50731265d85b13dd9f898d4a863c66cae56fadd1900bb70ff36a5a6fd8b7b73428db7b4642ab169e9d91c7cc3f569b3312c7b24297351b26
SSDEEP 96:SEWCNTnrY6pw6mJFFd8H0Rh7CsevBb1d0+YjMLlIrLlhTLlaXv7aZOKtILfcBCqF:SaVmLFSG7uvZ8+8LWxsPywlwpfol
TLSH
T139227353879724B79D4194C4BC30AE7C45EC6FAA61F958A802CC4D47FA464F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee2445bc-261d-4dc7-afb7-9f1991199d57.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ee2445bc-261d-4dc7-afb7-9f1991199d57.extra
Size 10KB
SHA256 1b23e56bb313de561761346b3117eab0c92279b9adea17a1610e59c81dc1a5b2
MD5 29a533f8f08eaec53f5a99761780e3e1
SHA1 3d1b0d394297072de740c6d9666eb416d44329a1
SHA512 4c0978ec70b29cac28d04a8136d80412a7a6bbbfa644f0cbc779857df01a28a36346fe3362733e0770498b521281dd48d8d0b5c038a5c715b00ac831b3cd72a7
SSDEEP 192:SaHcFgwiR4pDDnTYapdVxzPRWBHS4T/fKNUalopfopbLXJ:hHcFgwiGDz15WBHS4TxaGApZ
TLSH
T17F22D731881CE837E7D7AC8DEA392E3A926D7B1A10E6786C41CCCB49C1A94786779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 7238e72b7599bccf96e0ef86debb61f438e6d1df182995439d9fad2277d6522e
MD5 517bb9734b418e1bf7baf5ea4f8ed892
SHA1 65027f14b6293e773c6eaf00d4bf9a506446eacb
SHA512 3ad97e404dada087c517eb119b2dcedc361927696018d24f358e7b5dd357afd780bb51d27f8fb9242208f15e144efbb4f481266218666fe006b0e571e98ee71b
SSDEEP 192:yOv5zbo8bjlyjHcyMP1d66JoztdzgCl6mc0d:xbo8bjlyjhMdd66Joz/zgC1j
TLSH
T177E1FC64EA38463FC418123BCCA21F404F35399BA84E7F1935EC64082D9B2DE769D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 3aaaef73d686e2f9c26094cf3eda221c7e3360afc58d0799be7592b2f02cec30
MD5 eaa1bcbcb8bd049d7f64e76ef380ca1e
SHA1 d802d82b937e540e2afba62672568f338d2a95f5
SHA512 b4532a9a1d027139daef115a9d41b4e01d60fac32c185cbab93d981a9122ad90fb80c4c0599beb52a47f0b9f5520c976e3bcfc025583d4d6a0dc3a698de40076
TLSH
T17E61B859F628863FE048413ADC925B446F307816A8AF7F2A35AC604D1E5B3CE378D03E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 4833b939ef43fd32d9812fddc27221ba1298d3f90b3197c7fa763d8c2c6e5f8b
MD5 3cdf08d6f3db6be95b8b6dd83f87ba67
SHA1 93fc512911f858e7d8ee9d6515ab4eb7cbcbdd09
SHA512 b450e8e096ad8de969729fb85fbafaef00ed97cabc67daebb8017bc9136a1046ab4f8ecaead4ad2635ee6b4f1cfc5d63fe6de6885d71911d4cc3a1fa48c8d6dc
SSDEEP 192:gMP1d66JoztdzgCl6mc0dUOv5zbo7qZjlyjHcN:gMdd66Joz/zgC1jVbomZjlyji
TLSH
T1F5E1FD64EA38863FC418027BCCA21B444F39399B984E7F1975EC601C2D572DE769E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18fea827-612c-4816-bbec-f66adad6fad6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\18fea827-612c-4816-bbec-f66adad6fad6
Size 3KB
SHA256 f9cee07f81f84c31661fb064a0a455173f97e82b49d0f761eee614b1cb724337
MD5 9086545766b35a9e97bea45998e3ea03
SHA1 3424aa1a88328681f63ca32a4bfb6cd0e6491fbf
SHA512 28e3acb946a54a66fe73847e63bae2dbbaca1b414c93a13146ff3545968db97f59c4ce1c01a82473241367055223816273e461785719ae28a65694ffa19851ab
TLSH
T14B615521D558B5738AE8A140E3376E958ADF338F58971FCD11A98E1482EC464478F35B
MD5 SHA1 SHA512 TLSH

Submit Download

29241df6-c891-4171-acac-34903b44be14

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\29241df6-c891-4171-acac-34903b44be14
Size 235B
SHA256 ee8aefb71c7e287f085a454ee4c5f351955104c9992c7e078f0ea143aab6ce91
MD5 7eb9ff19ad563dbe38e42c07ff01740b
SHA1 de177943ccd93fc85c917e4b68d0d5dd8dadbb97
SHA512 000fc9cbab1abf354ce15638e7821eb9984d2c50154e2c325c1317443cb53b462dd07fa75824ee248f403b968d28f5ef4aa9218c3546688d98f9624e463d6a06
TLSH
T1B3D0979028C8732D08108F0BB4E068C730558C3712609860C5A04174DAFC9C48261C26
MD5 SHA1 SHA512 TLSH

Submit Download

39ede2a6-feb4-4ed0-94c6-065643ef5532

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\39ede2a6-feb4-4ed0-94c6-065643ef5532
Size 3KB
SHA256 9e7ed5e624f511ac810e1bb3bba1b8b367ceaaa8fb678fdd3510206b76febf1b
MD5 8e653802901c3021977051e9000f1b2c
SHA1 0eab221b4bfd6adb765d43de99e53d57cfc640b4
SHA512 7cc558b68438a12fe828f8995bbcf4cc2229c9fe2c1a2934684496fc930743397aa79115255b63c7b3ec910ec62ac18d946e93f17b95f13df2caadf2fdabc25b
TLSH
T1F3614321D568B5738AECA140E3376F998ADB33CF54C70ECD21A98E1843F8464178B35B
MD5 SHA1 SHA512 TLSH

Submit Download

3dca93f4-4785-4427-a26f-0703731b844b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\3dca93f4-4785-4427-a26f-0703731b844b
Size 235B
SHA256 351810143af641e97e91df3cc0c8d9685c71662e979624b85a12f0bbbbefd53e
MD5 a2e8f57fdcee1af836e00f1cede03447
SHA1 0cd29f17748f878c7d62fcbdf0cabae293c8ee4a
SHA512 fb3138f41726d82443455290985e2c4165102876d48cabe848fed32fc9960e4a10a3a428a510f05cfa919aeed5217e26ed322aa6f77ae227e975eb2625f854ec
TLSH
T1D5D097D42498B72E08000F0AB0E03AC371888D332079682085600438FABE9CA419280A
MD5 SHA1 SHA512 TLSH

Submit Download

58b9c138-f1bd-45a0-aa0c-59aacf76cded

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\58b9c138-f1bd-45a0-aa0c-59aacf76cded
Size 2KB
SHA256 317888fe34ccf5116e9591e4ef5a3d002b2454cb3bfdc75d24ce0d8cf4d2785d
MD5 38e22fe4db321a5ad2a70e2d1704965f
SHA1 408e78ee4b764be00440b3c2e07260619d0a30b3
SHA512 ea62a2975cb98bcd9f661492a92171a94511124b8819ad8a1df1de79431ae6c74936e5d830814295f13968fbc3f613cf5be4d9247da67b147883dba5c0a6979a
TLSH
T19C41542C75B94D779CEAE58D9442234D63604E8388C62C836E51EF4CCDE27AD337A427
MD5 SHA1 SHA512 TLSH

Submit Download

87cbd0c1-fad3-4a66-b110-b46afabf239e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\87cbd0c1-fad3-4a66-b110-b46afabf239e
Size 3KB
SHA256 35726241cd86b01f05e63fc0e6c604827e4be2388a138e16fa431ae9607026f2
MD5 4168bd86d45171418edc703a7ee7588b
SHA1 f9eed24648a56758a36d7aa48bcd833959e9f091
SHA512 b4e36fb59adcce292037007656f88f56897427319cecc0eb63ebba42c65b47bfcba93ea5ff745322e0f9a218964576491df8ecd1e9a3400b8929a1ed692d449f
TLSH
T1EB613322D564B5738AE8A140E3376F9589DB338F54961FCD15A98F1842F8464078B36B
MD5 SHA1 SHA512 TLSH

Submit Download

8a80a655-b320-4334-97e8-8465785aebb5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\8a80a655-b320-4334-97e8-8465785aebb5
Size 3KB
SHA256 a3a196ea1d7ae020c3497df06aec7fe18c8cbbeb4794aa0ddd79fbe80f28dbcd
MD5 5328034c66d8716088883d0a0fa93db8
SHA1 8cc91d05675c2f28bab8d7efb450a32c5f31624a
SHA512 f1cc7589048e6cb466933fb312799b7d8611250e60a8a514723617b562f4178974f972195dcc4b0deb23b421f61ca910814ffe7f5fa90686df4c159771395bec
TLSH
T196616321D568B5738BE8A141E3276F998ADA33CF94870FC921E98E1442FC064178F25B
MD5 SHA1 SHA512 TLSH

Submit Download

a3e50189-5b7f-4beb-8c59-b15a851e45c1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\a3e50189-5b7f-4beb-8c59-b15a851e45c1
Size 896B
SHA256 6c05365744fa9f2b5f996bf8af682dbdb0dcb82acce59516d9b62dea5a0fba1e
MD5 6a6010a97b31c67c0dffd04c45cabcfb
SHA1 9311af859e75694d12358a866020a932bae9ccd3
SHA512 afb8a58a02edc5137ff0b815de66f9a2d47cb9916b194019fd531f0646da00ff124ef1dd7c45b9dfadbefecfce8ed95719448804bfa1f55489a169469d59934c
TLSH
T10811D0418A3476B2CC78924BD990770297A47523C0CA5E487EA55B184DFB55FB376207
MD5 SHA1 SHA512 TLSH

Submit Download

b28e8c66-e2c8-4c19-b5b6-b22e5de612a6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\b28e8c66-e2c8-4c19-b5b6-b22e5de612a6
Size 16KB
SHA256 407f985b3cf9af8dfbe7c7bf0f982fa050d97a6db8584c051451f5ed51c1e794
MD5 94494f6b83e4cabd4df4b1ccede1b359
SHA1 b2cc7c6525789ca94d2482703625490514e7955f
SHA512 712d5a38ff6e52047f42cfb5d30be49d2459779e089c9542844defcdc8cf9d6165483f01a74bfff91ae3fd1a51e99d1e655a5c77ef5c23fb879e9009f17ba13e
SSDEEP 384:gkMR0h6nKQbKyR0mg7/bickKqfzHTVp+mL:gL0YKZKffdL
TLSH
T14172B956686045BAC591E3A9D4FC7FC3E2F538CB4C419FCA9BE0BD081DDA0AE112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbd328f6-8113-4190-a409-73035956dc99

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\dbd328f6-8113-4190-a409-73035956dc99
Size 3KB
SHA256 1a4c73b4f82fe69fb5cc8edbc376ccbe0e43f613374351b41aada56e949f3c76
MD5 e5d8c655d8e04de2362b2098d9ad6030
SHA1 4815516280237c6a45835a648310818257b3f020
SHA512 a61e3cfb1918debe12091afc66d4d3810b205f9a38a56259687c2dd45363d3a9eb3945ee2ae19cf443acc95015366b3803ed50d3dc641d8d30bb3db0f4738715
TLSH
T141615421D558B5738AECA144E3376F958ADF338F58C60FCD15A98E1482E8468538B25B
MD5 SHA1 SHA512 TLSH

Submit Download

ed7b520b-c13a-466c-b8fd-1fdcc8d01386

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\ed7b520b-c13a-466c-b8fd-1fdcc8d01386
Size 883B
SHA256 c1b2537c4646c1ee24439234f7b7b97b12ed1d74d63477d574da9b4c4a4bfcf9
MD5 a7f2486542f874abfa528330f7b9a953
SHA1 5cf2cdbdac11c33063442af1710803a1a587af52
SHA512 3afde552cf514686266e5646019b47319193e218e3d3f17ee20d60da1eeb45df665901a9a0ed1ebbb60f994f4665cb6fbcec5e0d5e3d1ace31858e1a30884dd6
TLSH
T198110C81D630B5B2CC7C924BC8613B06A7E4752380CE9A083EF15A040DFA65EA3BA707
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\prefs-1.js
Size 6KB
SHA256 6dd33954c1341d022d212da9d86050e9600c04f546965e982a0c0436273b75b4
MD5 358a6f52d640de898775085fe497c594
SHA1 273c3f5b57473f142117fbde201619fdf9ae3158
SHA512 c355c2fd2f5bc90b230a1b83161413b284acbe05ead6c4dbb572684cba6095bfba3e2329d2334eea293b20b2d2a77556ade625e77861d3e8318a10410c59bee3
SSDEEP 96:xHSUTUNqGq3Jfb4FR1zSkSSl4dv9j9nbHtXsdSBw88u8L4cnKM5I3J:EAR3JfsFRZSSAtX6SBw88y
TLSH
T1BEE12E7894088B7F74B677ACAC688C319AB2013BBBBF68D750B55485054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\prefs.js
Size 6KB
SHA256 4ead28095f94e7b91745c3533ac7c445425b3370c0efc3f6a3e1a2858725cb41
MD5 107fb11d4925d6270a40cf37df99f677
SHA1 437dde31fb545d82031b5690ac413bd955bc0779
SHA512 df73277c6255a41269553769bb3ae376fc0cd2660e8f07e97d9372c7b1eca0219f0ab46201561d34554d794fa3a2c4b4f2b4ef96383167213cab156b40ca474a
SSDEEP 96:xHSUTUNqGq3Jfb4e51zSaSSl4dv9jcnbHtXsdSBw88u8L4cnKM5I3J:EAR3Jfse53SSRtX6SBw88y
TLSH
T1E9E12E7894488B7F74B6776CAC688831AAB2013BBBBF28D740B55485015CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/940-42-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-28-0x0000000006600000-0x0000000006666000-memory.dmp

Download

memory/940-225-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-226-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-230-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-231-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-227-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-235-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-236-0x0000000074D82000-0x0000000074D83000-memory.dmp

Download

memory/940-237-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-250-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-264-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-271-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-270-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-275-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-282-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-284-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-294-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-304-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-308-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-307-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-334-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-335-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-187-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-180-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-168-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-151-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-120-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-85-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-46-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-1335-0x0000000007E30000-0x0000000007E3A000-memory.dmp

Download

memory/940-1334-0x0000000007ED0000-0x0000000007F62000-memory.dmp

Download

memory/940-34-0x0000000006C90000-0x0000000006CAE000-memory.dmp

Download

memory/940-33-0x0000000007050000-0x000000000757C000-memory.dmp

Download

memory/940-32-0x0000000006880000-0x00000000068D0000-memory.dmp

Download

memory/940-31-0x0000000006800000-0x0000000006876000-memory.dmp

Download

memory/940-392-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-30-0x0000000006950000-0x0000000006B12000-memory.dmp

Download

memory/940-29-0x00000000066D0000-0x0000000006782000-memory.dmp

Download

memory/940-194-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-27-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-26-0x0000000005E10000-0x00000000063CA000-memory.dmp

Download

memory/940-25-0x0000000074D82000-0x0000000074D83000-memory.dmp

Download

memory/940-754-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-24-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/940-1331-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-1330-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-1328-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-1326-0x0000000007580000-0x00000000078DB000-memory.dmp

Download

memory/940-1325-0x0000000006E10000-0x0000000006E32000-memory.dmp

Download

memory/940-1278-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-1236-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-1155-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-1137-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-1136-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-806-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-807-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/940-903-0x0000000074D70000-0x000000007552C000-memory.dmp

Download

memory/3068-40-0x000001F3026F0000-0x000001F302700000-memory.dmp

Download

memory/3648-14-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/3648-4-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/3648-8-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/3648-12-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/3648-7-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/3648-6-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/3648-5-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/3648-3-0x000001F046310000-0x000001F046332000-memory.dmp

Download

memory/3648-13-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/3648-11-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/3648-9-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/3648-16-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/3648-15-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/3648-17-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/3648-18-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/3648-19-0x000001F045FC0000-0x000001F045FCA000-memory.dmp

Download

memory/3648-20-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/3648-21-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/3648-23-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/3648-10-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/3648-0-0x00007FFB4844F000-0x00007FFB48450000-memory.dmp

Download