phantom_stealer | e0ef2f51891d03970f347ba0b81823d748ba4d1f973bb392af61e9e950a7a002

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
11032026MZQQQ62170011_001.js
Size 4.6MB
Sample260714-maydbsds3v
SHA256 e0ef2f51891d03970f347ba0b81823d748ba4d1f973bb392af61e9e950a7a002
MD5 1dc640ac2c98c0416625cefd4bb52ab3
SHA1 cd093a5a06be8278f206500add90cf5c9df3b8d7
SHA512 058a0870842e334fb98e99fb42b9ce0e28a9326303b77cd6f98b1cbf6243ec9f9a19147af0dd1d2ea80a033c68273bdcb4d0e9445a7a2c6869afd33c9d515231
SSDEEP 49152:wlxLmqyaW4+2PF8G+kdKJzkPenOyhpCQaxS/XhW5PQbDTPaLs7L3Z:/
TLSH
T1B726F1204FC81FBFCAAC1A18D0BE165EB3E106891567BCCAEF737D499FAA70051171A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution phantom_stealer stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
exczx.com
Port
587
Username
[email protected]
Password
at_I45@TzhxT=U},
Email to
[email protected]

Mutex

4BI8FC7UM2M71VZJVS1V

Attributes

anti_analysis
0
cb_enables_ssl
1
debug
0
keylogger
0
start_delay
0
startup
0

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 1 IoCs

resource	yara_rule
behavioral2/memory/120-22-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6020	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	icanhazip.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 6020 set thread context of 120	6020	powershell.exe	94

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3320	chrome.exe
5732	msedge.exe

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	aspnet_compiler.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	aspnet_compiler.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4180	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6020	powershell.exe
6020	powershell.exe
6020	powershell.exe
6020	powershell.exe
6020	powershell.exe
6020	powershell.exe
6020	powershell.exe
6020	powershell.exe
6020	powershell.exe
6020	powershell.exe
6020	powershell.exe
6020	powershell.exe
6020	powershell.exe
6020	powershell.exe
6020	powershell.exe
120	aspnet_compiler.exe
120	aspnet_compiler.exe
120	aspnet_compiler.exe
1852	chrome.exe
1852	chrome.exe
120	aspnet_compiler.exe
120	aspnet_compiler.exe
120	aspnet_compiler.exe
120	aspnet_compiler.exe
120	aspnet_compiler.exe
120	aspnet_compiler.exe
6020	powershell.exe
6020	powershell.exe
120	aspnet_compiler.exe
120	aspnet_compiler.exe
120	aspnet_compiler.exe
4716	firefox.exe
4716	firefox.exe
4716	firefox.exe
4716	firefox.exe
4716	firefox.exe
4716	firefox.exe
4716	firefox.exe
4716	firefox.exe
4716	firefox.exe
4716	firefox.exe
4716	firefox.exe
4716	firefox.exe
4716	firefox.exe
4716	firefox.exe
4716	firefox.exe
4716	firefox.exe
4716	firefox.exe
4716	firefox.exe
4716	firefox.exe
4716	firefox.exe
4716	firefox.exe
6020	powershell.exe
120	aspnet_compiler.exe
120	aspnet_compiler.exe
120	aspnet_compiler.exe
120	aspnet_compiler.exe
120	aspnet_compiler.exe
120	aspnet_compiler.exe
6020	powershell.exe
120	aspnet_compiler.exe
120	aspnet_compiler.exe
120	aspnet_compiler.exe
120	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	6020	powershell.exe
Token: SeDebugPrivilege	120	aspnet_compiler.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeDebugPrivilege	4180	taskkill.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
1852	chrome.exe
1852	chrome.exe
4716	firefox.exe
4716	firefox.exe
4716	firefox.exe
4716	firefox.exe
4716	firefox.exe
4716	firefox.exe
4920	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4716	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 6020	2632	wscript.exe	87
PID 6020 wrote to memory of 2424	6020	powershell.exe	89
PID 6020 wrote to memory of 2020	6020	powershell.exe	90
PID 6020 wrote to memory of 4660	6020	powershell.exe	91
PID 6020 wrote to memory of 3252	6020	powershell.exe	92
PID 6020 wrote to memory of 5208	6020	powershell.exe	93
PID 6020 wrote to memory of 120	6020	powershell.exe	94
PID 6020 wrote to memory of 120	6020	powershell.exe	94
PID 6020 wrote to memory of 120	6020	powershell.exe	94
PID 6020 wrote to memory of 120	6020	powershell.exe	94
PID 6020 wrote to memory of 120	6020	powershell.exe	94
PID 120 wrote to memory of 1852	120	aspnet_compiler.exe	96
PID 1852 wrote to memory of 3764	1852	chrome.exe	97
PID 120 wrote to memory of 1852	120	aspnet_compiler.exe	96
PID 1852 wrote to memory of 1928	1852	chrome.exe	98
PID 1852 wrote to memory of 3320	1852	chrome.exe	99
PID 1852 wrote to memory of 2992	1852	chrome.exe	100
PID 1852 wrote to memory of 5864	1852	chrome.exe	101
PID 1852 wrote to memory of 1064	1852	chrome.exe	102
PID 1852 wrote to memory of 2448	1852	chrome.exe	103
PID 1852 wrote to memory of 3340	1852	chrome.exe	104
PID 1852 wrote to memory of 4936	1852	chrome.exe	105
PID 120 wrote to memory of 1852	120	aspnet_compiler.exe	96
PID 1852 wrote to memory of 4156	1852	chrome.exe	106
PID 120 wrote to memory of 3764	120	aspnet_compiler.exe	97
PID 120 wrote to memory of 3764	120	aspnet_compiler.exe	97
PID 1852 wrote to memory of 4472	1852	chrome.exe	119
PID 120 wrote to memory of 1064	120	aspnet_compiler.exe	102
PID 120 wrote to memory of 1064	120	aspnet_compiler.exe	102
PID 120 wrote to memory of 3340	120	aspnet_compiler.exe	104
PID 120 wrote to memory of 3340	120	aspnet_compiler.exe	104
PID 120 wrote to memory of 2448	120	aspnet_compiler.exe	103
PID 120 wrote to memory of 2448	120	aspnet_compiler.exe	103
PID 120 wrote to memory of 1852	120	aspnet_compiler.exe	96
PID 120 wrote to memory of 1852	120	aspnet_compiler.exe	96
PID 120 wrote to memory of 1928	120	aspnet_compiler.exe	98
PID 120 wrote to memory of 1928	120	aspnet_compiler.exe	98
PID 120 wrote to memory of 3320	120	aspnet_compiler.exe	99
PID 120 wrote to memory of 3320	120	aspnet_compiler.exe	99
PID 120 wrote to memory of 2992	120	aspnet_compiler.exe	100
PID 120 wrote to memory of 2992	120	aspnet_compiler.exe	100
PID 120 wrote to memory of 4472	120	aspnet_compiler.exe	119
PID 120 wrote to memory of 4472	120	aspnet_compiler.exe	119
PID 120 wrote to memory of 3764	120	aspnet_compiler.exe	97
PID 120 wrote to memory of 3764	120	aspnet_compiler.exe	97
PID 120 wrote to memory of 4156	120	aspnet_compiler.exe	106
PID 120 wrote to memory of 4156	120	aspnet_compiler.exe	106
PID 120 wrote to memory of 4936	120	aspnet_compiler.exe	105
PID 120 wrote to memory of 4936	120	aspnet_compiler.exe	105
PID 120 wrote to memory of 1064	120	aspnet_compiler.exe	102
PID 120 wrote to memory of 1064	120	aspnet_compiler.exe	102
PID 120 wrote to memory of 3340	120	aspnet_compiler.exe	104
PID 120 wrote to memory of 3340	120	aspnet_compiler.exe	104
PID 120 wrote to memory of 2448	120	aspnet_compiler.exe	103
PID 120 wrote to memory of 2448	120	aspnet_compiler.exe	103
PID 120 wrote to memory of 1852	120	aspnet_compiler.exe	96
PID 120 wrote to memory of 1852	120	aspnet_compiler.exe	96
PID 120 wrote to memory of 1928	120	aspnet_compiler.exe	98
PID 120 wrote to memory of 1928	120	aspnet_compiler.exe	98
PID 120 wrote to memory of 3320	120	aspnet_compiler.exe	99
PID 120 wrote to memory of 3320	120	aspnet_compiler.exe	99
PID 120 wrote to memory of 2992	120	aspnet_compiler.exe	100
PID 120 wrote to memory of 2992	120	aspnet_compiler.exe	100
PID 120 wrote to memory of 3764	120	aspnet_compiler.exe	97

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\11032026MZQQQ62170011_001.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File "C:\Temp\ps_tHNA1DrqvL7m_1784024185165.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6020
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:2424
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:2020
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4660
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:3252
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5208
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:120
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vypddhuz.foj"
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1852
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\vypddhuz.foj /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\vypddhuz.foj\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\vypddhuz.foj --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffa5a32c728,0x7ffa5a32c734,0x7ffa5a32c740
        5⤵
        
        PID:3764
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vypddhuz.foj" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1636,i,9164222506593222853,16912133822419159308,262144 --field-trial-handle=2008,i,4716890584911858584,1952435841824982555,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:2
        5⤵
        
        PID:1928
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vypddhuz.foj" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1840,i,5258593147141269996,4590891733111848905,524288 --field-trial-handle=2008,i,4716890584911858584,1952435841824982555,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3320
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vypddhuz.foj" --force-high-res-timeticks=disabled --metrics-shmem-handle=2104,i,15020510996306211227,6649282373196637270,524288 --field-trial-handle=2008,i,4716890584911858584,1952435841824982555,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:13
        5⤵
        
        PID:2992
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vypddhuz.foj" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2960,i,10066032938658020962,6717948651809455868,2097152 --field-trial-handle=2008,i,4716890584911858584,1952435841824982555,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:1
        5⤵
        
        PID:5864
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vypddhuz.foj" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2980,i,5170131746376674181,14844253367772840136,2097152 --field-trial-handle=2008,i,4716890584911858584,1952435841824982555,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:1
        5⤵
        
        PID:1064
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vypddhuz.foj" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3188,i,15352544434589577985,4794041912342004060,2097152 --field-trial-handle=2008,i,4716890584911858584,1952435841824982555,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:1
        5⤵
        
        PID:2448
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vypddhuz.foj" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3200,i,18217306491362059407,8097922804454800314,2097152 --field-trial-handle=2008,i,4716890584911858584,1952435841824982555,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:9
        5⤵
        
        PID:3340
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vypddhuz.foj" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3760,i,11256464515610222787,17251374731048894040,2097152 --field-trial-handle=2008,i,4716890584911858584,1952435841824982555,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:9
        5⤵
        
        PID:4936
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vypddhuz.foj" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4280,i,7523762807362972003,17282539727261440397,2097152 --field-trial-handle=2008,i,4716890584911858584,1952435841824982555,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
        5⤵
        
        PID:4156
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vypddhuz.foj" --force-high-res-timeticks=disabled --metrics-shmem-handle=4112,i,12651844675631039805,15568788860066075485,524288 --field-trial-handle=2008,i,4716890584911858584,1952435841824982555,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:14
        5⤵
        
        PID:4472
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vypddhuz.foj" --force-high-res-timeticks=disabled --metrics-shmem-handle=5112,i,14891011688439063662,15047405287337026514,524288 --field-trial-handle=2008,i,4716890584911858584,1952435841824982555,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
        5⤵
        
        PID:3880
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vypddhuz.foj" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5124,i,8521260746394801356,6124006138932567064,2097152 --field-trial-handle=2008,i,4716890584911858584,1952435841824982555,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:1
        5⤵
        
        PID:1868
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vypddhuz.foj" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5196,i,13854018893498167357,17663247826678273085,2097152 --field-trial-handle=2008,i,4716890584911858584,1952435841824982555,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:1
        5⤵
        
        PID:6000
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vypddhuz.foj" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5232,i,5487615537792755811,13671275254330483145,2097152 --field-trial-handle=2008,i,4716890584911858584,1952435841824982555,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
        5⤵
        
        PID:2376
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xqw2fjxt.mmo"
      4⤵
      PID:2868
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\xqw2fjxt.mmo
        5⤵
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:4716
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 1748 -initialChannelId {c5f158f6-f2a7-48f0-809c-9cf4fe8c6050} -parentPid 4716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4716" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        6⤵
        
        PID:4584
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2328 -prefsLen 27133 -prefMapHandle 2316 -prefMapSize 270279 -ipcHandle 2304 -initialChannelId {32738e8f-c497-4382-98a7-0bbc3f288fc2} -parentPid 4716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4716" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        6⤵
        
        PID:3540
      - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e556f5a0-3c0e-4748-be2f-f898345aa49e.dmp"
        6⤵
        
        PID:5800
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2272 -prefsLen 27133 -prefMapHandle 2832 -prefMapSize 270279 -ipcHandle 2868 -initialChannelId {66675950-9ca7-4075-97ee-a49d82cd1edc} -parentPid 4716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4716" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        6⤵
        
        PID:5808
      - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0c97799e-28dc-47ff-b12b-3d4e091555b8.dmp"
        6⤵
        
        PID:5044
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3008 -prefsLen 27133 -prefMapHandle 2864 -prefMapSize 270279 -ipcHandle 3000 -initialChannelId {5941fbc9-dc05-4a14-8ad0-6900c95a478d} -parentPid 4716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4716" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        6⤵
        
        PID:4472
      - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\502e3116-da01-49b8-9764-1f2437ffa6a3.dmp"
        6⤵
        
        PID:4780
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3240 -prefsLen 27198 -prefMapHandle 3248 -prefMapSize 270279 -ipcHandle 3260 -initialChannelId {2b187e03-12f6-448d-84b1-2b79429e9549} -parentPid 4716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4716" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        6⤵
        
        PID:4348
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3208 -prefsLen 27274 -prefMapHandle 3244 -prefMapSize 270279 -jsInitHandle 3348 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3336 -initialChannelId {f40a46cb-3107-4443-b226-ee7c05b8ba20} -parentPid 4716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4716" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        6⤵
        Checks processor information in registry
        
        PID:3052
      - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ed490939-f6c1-41a6-a0a9-8e9d454b2aa9.dmp"
        6⤵
        
        PID:5400
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3260 -prefsLen 27274 -prefMapHandle 3276 -prefMapSize 270279 -ipcHandle 3804 -initialChannelId {4c6f311f-d782-4e20-9844-afab6419bce3} -parentPid 4716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4716" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        6⤵
        
        PID:3580
      - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8de70deb-e1f6-421c-a366-50de7729b7cc.dmp"
        6⤵
        
        PID:5748
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4084 -prefsLen 27274 -prefMapHandle 4088 -prefMapSize 270279 -ipcHandle 4100 -initialChannelId {44a0e90a-ff50-45ac-b501-f8fe14969dbe} -parentPid 4716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4716" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        6⤵
        
        PID:3756
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4612 -prefsLen 34773 -prefMapHandle 4616 -prefMapSize 270279 -jsInitHandle 4620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4628 -initialChannelId {7ed91d93-cae0-40ba-9a5f-56ab4edca430} -parentPid 4716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4716" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        6⤵
        Checks processor information in registry
        
        PID:2596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p"
      4⤵
      Enumerates system info in registry
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:4920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x26c,0x7ffa4afec188,0x7ffa4afec194,0x7ffa4afec1a0
        5⤵
        
        PID:3176
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=2072,i,11530713534846640329,5984333754175011118,262144 --field-trial-handle=2564,i,8737759215209923478,14352856284568684056,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:2
        5⤵
        
        PID:5560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2188,i,15671152744038918936,7540524416834640988,524288 --field-trial-handle=2564,i,8737759215209923478,14352856284568684056,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2812,i,5251932674332491707,13107170592867028909,524288 --field-trial-handle=2564,i,8737759215209923478,14352856284568684056,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:13
        5⤵
        
        PID:3244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,4044744328575385951,418042266621827,2097152 --field-trial-handle=2564,i,8737759215209923478,14352856284568684056,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
        5⤵
        
        PID:2984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,6317155423856035040,10958535182784713085,2097152 --field-trial-handle=2564,i,8737759215209923478,14352856284568684056,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
        5⤵
        
        PID:5264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3904,i,8100527211765152853,16318828911852783781,524288 --field-trial-handle=2564,i,8737759215209923478,14352856284568684056,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:14
        5⤵
        
        PID:6012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3952,i,7573583122140364778,10776821658433848521,524288 --field-trial-handle=2564,i,8737759215209923478,14352856284568684056,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:14
        5⤵
        
        PID:4160
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3956,i,3178836369143094216,10082658737742928102,524288 --field-trial-handle=2564,i,8737759215209923478,14352856284568684056,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:14
        5⤵
        
        PID:5228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4088,i,14410562482730535271,10283667677688471304,2097152 --field-trial-handle=2564,i,8737759215209923478,14352856284568684056,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
        5⤵
        
        PID:5848
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4120,i,11923593483427030510,2083036804997108317,2097152 --field-trial-handle=2564,i,8737759215209923478,14352856284568684056,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:9
        5⤵
        
        PID:5016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4168,i,11199034757570542931,8619028059041502703,2097152 --field-trial-handle=2564,i,8737759215209923478,14352856284568684056,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
        5⤵
        
        PID:3380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4204,i,11067905055338762151,1423155352201633029,2097152 --field-trial-handle=2564,i,8737759215209923478,14352856284568684056,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:9
        5⤵
        
        PID:1428
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4244,i,913732616788773194,13732012898238990779,2097152 --field-trial-handle=2564,i,8737759215209923478,14352856284568684056,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
        5⤵
        
        PID:2724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4280,i,9647636006224899410,17297884848493747949,2097152 --field-trial-handle=2564,i,8737759215209923478,14352856284568684056,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:9
        5⤵
        
        PID:5840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4312,i,3452801056007888618,4721317941535201427,2097152 --field-trial-handle=2564,i,8737759215209923478,14352856284568684056,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
        5⤵
        
        PID:4836
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4332,i,5970403487319971621,9031316205373243163,2097152 --field-trial-handle=2564,i,8737759215209923478,14352856284568684056,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:9
        5⤵
        
        PID:1516
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4348,i,4628665926086048610,1339396111961072309,2097152 --field-trial-handle=2564,i,8737759215209923478,14352856284568684056,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
        5⤵
        
        PID:5680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4380,i,1020504755743555588,7092613145714913961,2097152 --field-trial-handle=2564,i,8737759215209923478,14352856284568684056,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:9
        5⤵
        
        PID:5260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,14722899832926527421,11663831389901364555,524288 --field-trial-handle=2564,i,8737759215209923478,14352856284568684056,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:14
        5⤵
        
        PID:3752
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1160
        6⤵
        
        PID:1164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,13556382292007244527,10721902917473859425,524288 --field-trial-handle=2564,i,8737759215209923478,14352856284568684056,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
        5⤵
        
        PID:1072
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,14331909865791761299,5609955655954960679,524288 --field-trial-handle=2564,i,8737759215209923478,14352856284568684056,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
        5⤵
        
        PID:6032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,14364191942473235345,12916432035716308192,524288 --field-trial-handle=2564,i,8737759215209923478,14352856284568684056,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
        5⤵
        
        PID:3860
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=636
        6⤵
        
        PID:2148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,6046474029639031323,1614905968800065354,524288 --field-trial-handle=2564,i,8737759215209923478,14352856284568684056,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
        5⤵
        
        PID:3740
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,15420534962281387009,10879565155079787201,524288 --field-trial-handle=2564,i,8737759215209923478,14352856284568684056,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
        5⤵
        
        PID:1276
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im wscript.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ps_tHNA1DrqvL7m_1784024185165.ps1

Path C:\Temp\ps_tHNA1DrqvL7m_1784024185165.ps1
Size 3.4MB
SHA256 74b93cc3dff9f7f341dc5be53f4caa6e28676fb3fb0ee9857de223259edd30cb
MD5 2a13d1d16f2069e31e1215216dc40d2c
SHA1 35d986e1432872f65662c8233c4a0bb0a727a458
SHA512 18f42346c158c13d28b30b8997d639bc2f12eafbd9db3345725b3e2988099515ecd516c0850f0d948c8c404445b8419fb91127f1dba047231d8bce6ee05e29bb
SSDEEP 49152:kAvwHhQq3WLA0HyAtSjuvxxiB3b497IDWhYFEHq6Bd2oSJilT:p
TLSH
T13FF523248A9E17DF0820E1FEB125B4C5B5CD228B4C42422743A9C7E535F90F49BB7DB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p\Crashpad\settings.dat
Size 280B
SHA256 4646b8f6fffe3e728e6fd345bb62bb4cb17c5fa272b7eb6d6c2dd9c43b34d079
MD5 775d277d8984f75eb6f84d311a1bbedc
SHA1 c6e0ea718f4737fc78d043a4e206bec950b00a4c
SHA512 b05644d6455ff7b75a664818d9b9b9fcad58907a711fcefab54d18d24328198b05d7f15b3f84f7133eaec943cab5acf90aa9d52c333b98e65fe9df2e0a0a8734
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p\Crashpad\settings.dat
Size 280B
SHA256 53c89eda37c9a29bab2f11012e8bf315c8fc443455c8cbc7c6cd54b9f32d7fae
MD5 7831751273942e6fbbfe735674c3a7b3
SHA1 29a80a462aa3fbfe42b9d4de9d691a76e2168997
SHA512 d28354170bbea49f83d1ccdf3cb559a534a955c8da3cf1f5af3e8dc2b42db7f89c87d0b650dae7c3f33d1de84455accea210ef1f6e366d6a4a47657e9cc8fec8
TLSH
T159D00251BB0494C5E3412D32FC346B663E61C76687A673B721973D747C45EC5D2CD041
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 d0aba511be1e0da7dc7218c49b8d1d821e0dbf287e4e2d5f3789b4b7521b24a5
MD5 b371aac89d33c23e08af0fb8b3adbb22
SHA1 5795e36db6b7b2d45aaeb2e2eafe14c3cf8eb138
SHA512 dc1a8e68e13b2ca7494bef1152e26924df1a34d37967216b3be270990c13845bd6e09d36c2d3ab7ad4a70a60489d5cd5d4c1d7e7e46b55cb7e20250992de6adc
TLSH
T1DCD02BBB19FA0420BC6F97E7183154A544057D548E89ECCE502E728718702122916C64
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 cd1993dfe9063ae4ba3b414afa847836065231e5e7c1a3fbc998a2fe10ba46d4
MD5 7dd3da3ff22c18d4a6ae6e45ead4f5a9
SHA1 fe2157473efe033ab21ea96a1ad17fe34d6f5ce8
SHA512 c4e5373a5a33c38c2299a66467b82af436a194951d39a8d0650cc1c18efd51b84ecf6bad990891ea7c923c40b3dfc110c532c7f4acb44f313717459bd930e57c
TLSH
T166E068772EE71810F95FD3DB247154A948447C048985ECCF902FB2C710702012819C20
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a004f.TMP

Path C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe5a004f.TMP
Size 153B
SHA256 9257a2ebf015e5606c82aece47511c4153d8fba0fc746ec49e07a23169f84e7c
MD5 a3a7738bcf4eb40f923574864af50c19
SHA1 bbfd590909b982ed21540a665d6a618874e87054
SHA512 dacec77f53b78f5b0fda251c98b1fed9281ad3133973b98a8120761286edba99a951bf8777751ee2df5cd8cc0248601d0dd147127196427aa5e3168200bb4dcf
TLSH
T186C02BFB0C760400FE0B82D301325CEA812A7CC48D89FCCD502FB0E330301227A22C20
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 06c60a5bf63223a3205d37a68c8a42210af500e918dac2455c0f489c39a5b14d
MD5 3075042d5e55b28e353d13041efe1ff1
SHA1 6e11e50be091ac298d60dcc23a3cf7ea1cf7aecc
SHA512 9bfdb34c338a4ec34336dd1ede0822793c1a4024cbe60f58461b2d0c8c99301e132afc53547be89cfa5af97ae0c5165f84c68308e400b3c2246ccd2f4ec1954f
TLSH
T18A216D6071A642013BBD368C9156CB1ECA89B0F73114E42E76EB80D98F27F075EBC4C9
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p\Local State
Size 3KB
SHA256 5491ab3aaacabadfd2121b817a88849ed2f91c3035eff5f5553bfb346ccd6f51
MD5 662e1eb07169676985d42df4990649a7
SHA1 5e827c763cc5e811a4963aa4be69734fa52d3de5
SHA512 2bb5aa450789602891002a9b42bb2803eccad35be556ded00d0c4eec32caaa9183b7df323fe6cc2cc0516dc8bcdcd072fdfc31bf37db545d13e6fb58bc7a71f4
TLSH
T1EF81BA71A428EC235AF9D944758577939E3830B7DD05BF88F6C5531800E775C2B4E81B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p\Local State
Size 4KB
SHA256 83b9731d4f23697d774efa59437e83dedce6c293870f53c65a48aca26a69f86b
MD5 92dff1769ccfd346e868853203a2046c
SHA1 49b80edafbf1ed5e97c69b43f990fb0961fdd8c5
SHA512 c841ff70d5fc28a2914923ccae16a29a92cbeb5ebf692e21c966638f7233554f6b6b934ec8336d8c6ede27548b178b39801c5b368bc05ae42c7f8fe3e47002fe
SSDEEP 96:yIqGNkwQsFffCnD3g1cun58Frh/cInURoDotov+pDXBYsvodWD0eUnTf49bq4a:yTGNcG2D3/ooDUwmRYWDqTfeU
TLSH
T15EA19672A438EC275EF6D944B9853793AF643077E845BF9CE6D8170C04E7788274A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59eebb.TMP

Path C:\Users\Admin\AppData\Local\Temp\5iqykcoq.u3p\Local State~RFe59eebb.TMP
Size 1KB
SHA256 fe3b503c418c58d4451f1afe1aea52253dd4057c98fe97909c649bfd173d8321
MD5 592cb1b5bcf8e49307aef020c223764d
SHA1 3bd818a14f5f37136ab32cd69115576675404671
SHA512 754c898714092f8aad2054c37d1fb83dcc5a652af710b9350e097c33c03080ebabbe6e5428e1661fcc01323ba057af08e246f86bb8ae088b31d638cf32ea31e0
TLSH
T1C1319571E86C2C73BEA58A45B74DFB572F341076D1593A8862DC160806F3ADC124EC2F
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\vypddhuz.foj\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\vypddhuz.foj\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\vypddhuz.foj\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\vypddhuz.foj\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\vypddhuz.foj\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\vypddhuz.foj\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\vypddhuz.foj\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 0fbbb95585e91bf8901a955ff1d0a5851e70773f3e45dcbed2a15a54c78e99fb
MD5 3c5851e805b36cb5abca46670fd1f60b
SHA1 d8034330684f3b20760518d73cbe3de3408f743d
SHA512 b65270c8c3e96e3d84ca499af21918849afbab7d5b1f015215762b3613496bd23141fb470c68b456c29bf358c4d38853be5f00df7aedc0d5b66d70877446b29b
SSDEEP 48:q1BdOXCkg4xJ9zCNYDF3dLXuHWKL8p18BdOXCkg4xJ9zvYDF8gdLXuHWKL2m:qiJoUFdur8PDJvUF8Iu3
TLSH
T17291D0009FE61E16F2F7AE725AB27B116F37F94949088A4D04C6460C1C71B44CA6DFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0c97799e-28dc-47ff-b12b-3d4e091555b8.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0c97799e-28dc-47ff-b12b-3d4e091555b8.dmp
Size 74KB
SHA256 2f2c41701fd5332ba611febf19f28693239a564f30f67a3042b66ac79a017d56
MD5 08e520c54c81f6687b7b66b6c525fc2b
SHA1 b862e1f6b91a8ee481467739cc5a0bb68cb87162
SHA512 835b8b66cdd83df49d80502e7ac85118f73a88f3546673305ac507ae548b4ac379e05d79281f4fb909036d3d227a45b9a44bb3f80361748046a815a449926092
SSDEEP 768:DU9ZsZpWzTkxqHbsVgcRIHJDpypLfQF44K:6ZsZpW38qAVgcRIHJDpypkF44
TLSH
T18273DC5357994879D0750B7C18E77B403BF7E8994B63C39B026485BA2C63F88ADB1F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0c97799e-28dc-47ff-b12b-3d4e091555b8.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0c97799e-28dc-47ff-b12b-3d4e091555b8.extra
Size 10KB
SHA256 d118e4672d7a0fe100c45d45acc7aeee11fbf88782ff1f892e59dd6c99f8ad5f
MD5 93332373a17bda115b483710ea50db4c
SHA1 bcd57628c0fd85b6ca2dd748b1e6b0eb22c7db11
SHA512 622ce896d85db74a6ab2111a5c17686f2e3ec8f2082093213eefcb64c64f9ef93d1761c59f6c209432383a1220997ea355e44ce454013e1f2f3e146c223431e4
SSDEEP 96:SEWCDThfY6pw6mJFFd8H0Rh7CTvBb1d0djMLlIrLlhTLlaXv7aJOKtILfcBCqwvj:SaX8LFSG7WvZ85LGxsPywl18fo0
TLSH
T1ED226153878724B79D5294C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0c97799e-28dc-47ff-b12b-3d4e091555b8.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0c97799e-28dc-47ff-b12b-3d4e091555b8.extra
Size 10KB
SHA256 5431ceb077024940e4f12e74b93e34bf314c9d05b3c9f0bf89500b5621b6ff3a
MD5 549da0af60ef3deb113080dbf1d7d353
SHA1 60541bd29ffc932e6f77f90e9fcab1893ac3b97e
SHA512 9be97eceb8639d8bfe250fea67e090f78d6961a0037a45fa3a46d8e0e960e76efb44ead47178f02429cea80e609e26e1322cc469d1d9965fb36a11df06c52203
SSDEEP 192:SavcFgwiR4pDDnTYaVdVxzPjWBH04T/fKNUald8focbLHVL:hvcFgwiGD/1rWBH04TxacAcHx
TLSH
T1D722E731481CEC27E7D7AC8EBA392D36D65D7B1A10EA78AC40CCCB49C1A94786779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

502e3116-da01-49b8-9764-1f2437ffa6a3.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\502e3116-da01-49b8-9764-1f2437ffa6a3.dmp
Size 74KB
SHA256 6eb90e43f6075b8315aacfa9c49de015ce3bc00ba43428923b15c2f9aef8b821
MD5 9b56b942e123bf7959425fb7b6fa442f
SHA1 73a94c40e5892651ecb696b2e5001ff7f39fe07f
SHA512 b36885d82dd79c893aaa835f75c5db28c5af9232427020048297f9ef019d11cb33ce0ae066962f1ab61d9b29957528fd88f413afe896bd64d23c87ea2820dc5b
SSDEEP 768:oU+Z3ZpeAwpKqt8grmwtJmZIacjQLfQF44K:mZ3ZpeAwpR8grftJaIykF44
TLSH
T14773C9D75BA80479D4292B381CEBBB743BF7E85D4B93839B021491BB2C633946DB1E11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

502e3116-da01-49b8-9764-1f2437ffa6a3.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\502e3116-da01-49b8-9764-1f2437ffa6a3.extra
Size 10KB
SHA256 47b8819d1034adb3e4fc90ab795f7844179921fc415f0e4acd36fde074bc0cad
MD5 04dce3d987decc90b1bb8936a3d29c25
SHA1 8ccfcf40c64c3e0bca06385ff1ddc47483a1c6d3
SHA512 649e36cffd1d2eb0a2e3c9bd92e517560981ce59b6b57f5f9e8659f1fa7bcffeb6af2795a8de3f6619f8be4b2438c6bff61f1b9731e03a7fa6d87d3d221eb6ab
SSDEEP 96:SEWCyThfY6pw6mJFFd8H0Rh7CsevBb1d0djMLlIrLlhTLlaXv7aPOKtILfcBCqwz:Sai8LFSG7uvZ85LwxsPywlBBfoz
TLSH
T191226253879724B7AD4194C4BC30AE7C45EC6FAA61F958A802CC4D47FA464F81FB84F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

502e3116-da01-49b8-9764-1f2437ffa6a3.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\502e3116-da01-49b8-9764-1f2437ffa6a3.extra
Size 10KB
SHA256 2dd6ece348f9859583bebed77126f771e753edf70a65bfe447319a34036a453d
MD5 872fd3c23d0514d075b6681dd26e35b5
SHA1 93fd84238ead90b5a8f7eefebaaafcf8f084749c
SHA512 026dcbf8d126aaad73164b5a98db7c3916d3001cfd43bb4bb051a0fdb6fbc40b5b92b05314018c227b5e808ba95c7eaa1ce25b36f86b503ebeef9dd068f6f56e
SSDEEP 192:SaYcFgwiR4pDDnTYapdVxzPjWBHk4T/fKNUalZBfofbLHVL:hYcFgwiGDz1rWBHk4TxaJAfHx
TLSH
T1A922F832481CEC27E7D7AC8EBA393E36D65D7B1A10EA78AC40CCCB49C1A54786779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8de70deb-e1f6-421c-a366-50de7729b7cc.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8de70deb-e1f6-421c-a366-50de7729b7cc.dmp
Size 72KB
SHA256 8ab3fbbc54befacf4e47f127f2fa6f9a31dfbb9adc265d5ce4694f3d70941162
MD5 02259706da6fcdcc273edbc4ba94c2c2
SHA1 3f79252c1445884e14c508462de41a51cef4ad91
SHA512 44af46157ff802169a08feb3bbf9cbd64a64474c6ec3ff7f1858c69c05179a730b9f9a1e7d21a1d8874ef72961bb01efbc8d2c7e12309eb163430a6261e0c1db
SSDEEP 768:0UYZJZpSJQZ60oU1qCbTQbldnQehZ2OLuLfQF44K:UZJZpSJf0NqO8bl1hZ2OLukF44
TLSH
T1C273FD5367E8046AD6264F3A18EBBB103BF7E4655F5353DB022081AEECE33846D71E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8de70deb-e1f6-421c-a366-50de7729b7cc.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8de70deb-e1f6-421c-a366-50de7729b7cc.extra
Size 10KB
SHA256 f43aaa28b63b19db4ca6abbd3893347f9f0a847a46c782ca86d728b9b96dc394
MD5 bd6a1f6b56f14a2d10d0f033cfdc431e
SHA1 931ee1134ffc7dde61cd2a34386a9f0242af5661
SHA512 c905681ce687de56b8d3844eec93568dd0690c8b3d961d810710da3abd87751374215b8c38c7fcd39472531579b9e0f023fead9b8e1d79b6a20647a6a52b1951
SSDEEP 192:SaCk8LFSG7uvZ85LdxsPywlqJGhbfojTC:hN8LkC5LHw4chAjTC
TLSH
T18A228253878724B7AD5194C4BC30AE7C45EC2FAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8de70deb-e1f6-421c-a366-50de7729b7cc.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8de70deb-e1f6-421c-a366-50de7729b7cc.extra
Size 10KB
SHA256 297033bde7107693324fe7f3d5e4b84a6f70f0e4778fb4d98380d2a51cb4ee65
MD5 c6eb6fb1459835443194b7954cdcda66
SHA1 debfaefc5a3268b38f861961a8083796f9be6cb4
SHA512 cb51910dba2bc4ae02a7658c9c84e167585aff36d802ba090d88f7a536b6f5154eed7a1e093fe43a9d02a85456480114440a3160926e890e3b00c928e0085e0e
SSDEEP 192:SaC6cFgwiR4pDDnTYapdVxzPjWBHL4T/fKNUalyJGhbfojTybLHVL:hVcFgwiGDz1rWBHL4TxaochAjTyHx
TLSH
T19E32E732481CEC27E7D7AC8EBA393E36D65D7B1A10EA78AC40CCCB49C1A94746779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e556f5a0-3c0e-4748-be2f-f898345aa49e.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e556f5a0-3c0e-4748-be2f-f898345aa49e.dmp
Size 75KB
SHA256 5178f0eb5e4b40a539519435cf04e12f36b8349b72b590fea86c4d128f555181
MD5 708b41cd88335283f13982b0ef63de33
SHA1 4a8d5f8ed152791550b6dbf8e236afde5d1e23bd
SHA512 50354f064b8f8d5c6b05c9a698762f282c1e021e9fa53e2bee4ddb97d6fce8bc3eb56a50636bc7eb164a21bc0c432c600a538cb5a9b0b38757e0f392b294d256
SSDEEP 768:eU5ZIZpi3F0HVg677KFL9MdrdTI9vLfQF44K:fZIZpi3F0HVZ7KFL9MdrdTI9vkF44
TLSH
T16273DA5377C844A9D4E50B3428EBB70A7BF7E4798B93439B021485FE2C67788AD71E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e556f5a0-3c0e-4748-be2f-f898345aa49e.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e556f5a0-3c0e-4748-be2f-f898345aa49e.extra
Size 1KB
SHA256 daefd1b1138cdcc1871dfc4883669e28b38b63df956a3c6e8ddfbd97bf481594
MD5 300835a3b6bfcbe0940a21317c134eb6
SHA1 2100ffa7040a2bcc54c44e7bf0b04662029fdc94
SHA512 0138599b341c3513b15106bb77daeccfca9362922b5621ea0b8b67e512d366d6062e3c93d037e620ee16c4a3836e3748f4a335bc4eac7eeac534df0c3c5116b5
TLSH
T1733152B782EC6D1289578599723F2302C989B32704921E4D24CC4A48858E0DD96669C3
MD5 SHA1 SHA512 TLSH

Submit Download

e556f5a0-3c0e-4748-be2f-f898345aa49e.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e556f5a0-3c0e-4748-be2f-f898345aa49e.extra
Size 3KB
SHA256 744974f1779dc15306eca01c32bff996ef5f06ab808f1652cc33134a1d535ef3
MD5 1b5a28a2bcbce79b03ff7d75659e9974
SHA1 fcc0ef8ba379a9e445d9a52cf876a37dae12e8d7
SHA512 ff3fc31b9a84fcc3ceb67afa618dd8ae43f4e923c2f66df31b42942767f0bd8d946a3c5b4e2261c66986c634ff6e06669a96fae0f1e288ebe8d1dbeb66c5f329
TLSH
T107811172405CED275AEB5CCEB3376D1D889EB35998662A8C54CAC35C41B8CF06386283
MD5 SHA1 SHA512 TLSH

Submit Download

ed490939-f6c1-41a6-a0a9-8e9d454b2aa9.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ed490939-f6c1-41a6-a0a9-8e9d454b2aa9.dmp
Size 74KB
SHA256 c3e14d8ba3a40c88534b63314b8dd66a9865e0c9927c93dfef30bb97bc11ae49
MD5 a0caf016c18bf34b71f3104946249ec1
SHA1 4afab314cc109e32b76dee10c900bb87e2680824
SHA512 532cc9ae28b13b7a3407d67ae4764680a39a41629ea865053d0794866ea3d8664b35e264ab9a0253df92bdc2b8cce6d0ce1083fe6e0398679e707561ae7af38d
SSDEEP 768:6UYZVZpuydZPItn8oS3ZnIk8GoAJD8vLfQF44K:GZVZpuydZAn8oSWk8GoAJD8vkF44
TLSH
T11073EA7367C8046AE4250B3458EB7B503BF7E86A5BD3439B121781BE2C73394AD72E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed490939-f6c1-41a6-a0a9-8e9d454b2aa9.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ed490939-f6c1-41a6-a0a9-8e9d454b2aa9.extra
Size 10KB
SHA256 220e49bc072856b6c2a08048fd32bc79b4a2ca6c4e8bc39edfdead58d185cda0
MD5 4676256ed94fcc0e3f730eb4c81252c9
SHA1 e1de520f48af82ef22cdb9ddd513a909d6a25eef
SHA512 a40d56cf935f02e7afbaf8dc1dbb1aa6bd733df241f95d098e2467b126aab3f992833abd76e28bd0aa11718f572e7934fddf7e177d1768bed06862527652219a
SSDEEP 96:SEWC77ThfY6pw6mJFFd8H0Rh7CsevBb1d0djMLlIrLlhTLlaXv7a6OKtILfcBCqa:Sa7v8LFSG7uvZ85LJxsPywlz2foA
TLSH
T122227253878724B79D5194C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed490939-f6c1-41a6-a0a9-8e9d454b2aa9.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ed490939-f6c1-41a6-a0a9-8e9d454b2aa9.extra
Size 10KB
SHA256 da4d0ebd01353600695d18970cfe8ac1a950c7b0d56ce9414ef8734990044f1d
MD5 29393cd57a1993b4d599fc0fa16561a6
SHA1 b8beb88acd9bd345363fb8e8e1c2810961346455
SHA512 9eb5aaab437d2e6113052b1c50652b9cae2eeef5436f2866ee058f80a17630181993d46879ca1838f975f1f801047eeead5263b0864fee8f0050c997df332ebe
SSDEEP 192:Sa7XcFgwiR4pDDnTYapdVxzPjWBHf4T/fKNUalr2fogbLHVL:h7XcFgwiGDz1rWBHf4Txa0AgHx
TLSH
T1C222E832481CEC27E7D7AC8EBA393E36D65D7B1A10EA78AC40CCCB49C1A54786779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/120-23-0x00000000742A2000-0x00000000742A3000-memory.dmp

Download

memory/120-364-0x00000000742A2000-0x00000000742A3000-memory.dmp

Download

memory/120-26-0x0000000006700000-0x00000000067B2000-memory.dmp

Download

memory/120-24-0x0000000005FD0000-0x000000000658A000-memory.dmp

Download

memory/120-28-0x0000000006980000-0x0000000006B42000-memory.dmp

Download

memory/120-22-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/120-29-0x0000000006830000-0x00000000068A6000-memory.dmp

Download

memory/120-25-0x0000000006690000-0x00000000066F6000-memory.dmp

Download

memory/120-1314-0x0000000006E10000-0x0000000006E32000-memory.dmp

Download

memory/120-1315-0x00000000075B0000-0x000000000790B000-memory.dmp

Download

memory/120-30-0x00000000068B0000-0x0000000006900000-memory.dmp

Download

memory/120-31-0x0000000007080000-0x00000000075AC000-memory.dmp

Download

memory/120-1320-0x00000000082B0000-0x0000000008342000-memory.dmp

Download

memory/120-1321-0x0000000008220000-0x000000000822A000-memory.dmp

Download

memory/120-32-0x0000000006C70000-0x0000000006C8E000-memory.dmp

Download

memory/1852-152-0x0000019CA6890000-0x0000019CA68A0000-memory.dmp

Download

memory/6020-180-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp

Download

memory/6020-1-0x00007FFA5882F000-0x00007FFA58830000-memory.dmp

Download

memory/6020-142-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp

Download

memory/6020-21-0x0000017AE9EA0000-0x0000017AE9EB8000-memory.dmp

Download

memory/6020-20-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp

Download

memory/6020-19-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp

Download

memory/6020-18-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp

Download

memory/6020-17-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp

Download

memory/6020-16-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp

Download

memory/6020-15-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp

Download

memory/6020-14-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp

Download

memory/6020-13-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp

Download

memory/6020-12-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp

Download

memory/6020-11-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp

Download

memory/6020-9-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp

Download

memory/6020-10-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp

Download

memory/6020-8-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp

Download

memory/6020-6-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp

Download

memory/6020-4-0x0000017AEA570000-0x0000017AEA592000-memory.dmp

Download

memory/6020-5-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp

Download

memory/6020-1322-0x00007FFA586A0000-0x00007FFA59044000-memory.dmp

Download