b42e97c12a39ea8ce7d889b1487f497de27a49549467fa8dbf9d8ac9cca9e8cc

Analysis

max time kernel
102s
max time network
105s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
15/09/2025, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 10.7MB
Sample250915-emta5styfv
SHA256 b42e97c12a39ea8ce7d889b1487f497de27a49549467fa8dbf9d8ac9cca9e8cc
MD5 2a0955539bd323135dd9d1f0dc6cb965
SHA1 c444076370ff0453111a863ea68341f29cb5f605
SHA512 765c5901ecb08eb05a3a1095d555faf614adfa3de1117837ae56a3f8fd06e5066d2ae369d68c7a1c261ee5f0ca189a5b5b784940e8815f300d00b8e12eb80b6f
SSDEEP 49152:epj5ULc3g4k2vX9OLQTM+acHEGSEGGVjb03xFKj0ia+CtbQuIrYIvVhARgzD1Rqo:
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

credential_access discovery execution stealer

Malware Config

Signatures

Detected Nirsoft tools 24 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/5312-7-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/5312-9-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/5312-10-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/5312-15-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/4352-17-0x0000000000400000-0x0000000000416000-memory.dmp	Nirsoft
behavioral2/memory/4352-19-0x0000000000400000-0x0000000000416000-memory.dmp	Nirsoft
behavioral2/memory/4352-20-0x0000000000400000-0x0000000000416000-memory.dmp	Nirsoft
behavioral2/memory/4352-23-0x0000000000400000-0x0000000000416000-memory.dmp	Nirsoft
behavioral2/memory/5016-31-0x0000000000400000-0x0000000000414000-memory.dmp	Nirsoft
behavioral2/memory/5016-33-0x0000000000400000-0x0000000000414000-memory.dmp	Nirsoft
behavioral2/memory/5016-35-0x0000000000400000-0x0000000000414000-memory.dmp	Nirsoft
behavioral2/memory/5016-37-0x0000000000400000-0x0000000000414000-memory.dmp	Nirsoft
behavioral2/memory/2356-40-0x0000000000400000-0x0000000000445000-memory.dmp	Nirsoft
behavioral2/memory/2356-41-0x0000000000400000-0x0000000000445000-memory.dmp	Nirsoft
behavioral2/memory/5512-44-0x0000000000400000-0x00000000004A5000-memory.dmp	Nirsoft
behavioral2/memory/5512-45-0x0000000000400000-0x00000000004A5000-memory.dmp	Nirsoft
behavioral2/memory/4804-58-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral2/memory/4804-59-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral2/memory/4468-66-0x0000000000400000-0x0000000000422000-memory.dmp	Nirsoft
behavioral2/memory/4468-67-0x0000000000400000-0x0000000000422000-memory.dmp	Nirsoft
behavioral2/memory/728-70-0x0000000000400000-0x0000000000455000-memory.dmp	Nirsoft
behavioral2/memory/728-71-0x0000000000400000-0x0000000000455000-memory.dmp	Nirsoft
behavioral2/memory/4652-78-0x0000000000400000-0x0000000000482000-memory.dmp	Nirsoft
behavioral2/memory/4652-79-0x0000000000400000-0x0000000000482000-memory.dmp	Nirsoft

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4652-78-0x0000000000400000-0x0000000000482000-memory.dmp	WebBrowserPassView
behavioral2/memory/4652-79-0x0000000000400000-0x0000000000482000-memory.dmp	WebBrowserPassView

Uses browser remote debugging 2 TTPs 16 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
776	chrome.exe
2252	chrome.exe
3284	chrome.exe
4820	msedge.exe
5620	chrome.exe
1120	chrome.exe
3940	chrome.exe
5032	chrome.exe
408	msedge.exe
276	msedge.exe
1624	msedge.exe
1384	chrome.exe
4904	chrome.exe
3472	chrome.exe
1908	msedge.exe
1168	msedge.exe

Suspicious use of SetThreadContext 13 IoCs

description	pid	Process	procid_target
PID 5156 set thread context of 5312	5156	file.exe	80
PID 5156 set thread context of 4352	5156	file.exe	81
PID 5156 set thread context of 2644	5156	file.exe	82
PID 5156 set thread context of 5016	5156	file.exe	83
PID 5156 set thread context of 2356	5156	file.exe	84
PID 5156 set thread context of 5512	5156	file.exe	85
PID 5156 set thread context of 4908	5156	file.exe	86
PID 5156 set thread context of 4804	5156	file.exe	87
PID 5156 set thread context of 4460	5156	file.exe	89
PID 5156 set thread context of 4468	5156	file.exe	90
PID 5156 set thread context of 728	5156	file.exe	91
PID 5156 set thread context of 5008	5156	file.exe	92
PID 5156 set thread context of 4652	5156	file.exe	93

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4780	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	file.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134023826735454094"	chrome.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
5312	grpconv.exe
5312	grpconv.exe
5512	grpconv.exe
5512	grpconv.exe
5512	grpconv.exe
5512	grpconv.exe
5512	grpconv.exe
5512	grpconv.exe
5512	grpconv.exe
5512	grpconv.exe
4804	grpconv.exe
4804	grpconv.exe
5156	file.exe
5156	file.exe
4652	grpconv.exe
4652	grpconv.exe
4652	grpconv.exe
4652	grpconv.exe
5156	file.exe
4780	powershell.exe
4780	powershell.exe
4780	powershell.exe
4780	powershell.exe
4780	powershell.exe
4780	powershell.exe
1384	chrome.exe
1384	chrome.exe
4780	powershell.exe
4780	powershell.exe
4904	chrome.exe
4904	chrome.exe
4780	powershell.exe
4780	powershell.exe
4780	powershell.exe
4780	powershell.exe
4780	powershell.exe
4780	powershell.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	4804	grpconv.exe
Token: SeDebugPrivilege	5156	file.exe
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1384	chrome.exe
4904	chrome.exe
408	msedge.exe
276	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5156 wrote to memory of 5312	5156	file.exe	80
PID 5156 wrote to memory of 5312	5156	file.exe	80
PID 5156 wrote to memory of 5312	5156	file.exe	80
PID 5156 wrote to memory of 5312	5156	file.exe	80
PID 5156 wrote to memory of 5312	5156	file.exe	80
PID 5156 wrote to memory of 5312	5156	file.exe	80
PID 5156 wrote to memory of 5312	5156	file.exe	80
PID 5156 wrote to memory of 5312	5156	file.exe	80
PID 5156 wrote to memory of 5312	5156	file.exe	80
PID 5156 wrote to memory of 4352	5156	file.exe	81
PID 5156 wrote to memory of 4352	5156	file.exe	81
PID 5156 wrote to memory of 4352	5156	file.exe	81
PID 5156 wrote to memory of 4352	5156	file.exe	81
PID 5156 wrote to memory of 4352	5156	file.exe	81
PID 5156 wrote to memory of 4352	5156	file.exe	81
PID 5156 wrote to memory of 4352	5156	file.exe	81
PID 5156 wrote to memory of 4352	5156	file.exe	81
PID 5156 wrote to memory of 4352	5156	file.exe	81
PID 5156 wrote to memory of 2644	5156	file.exe	82
PID 5156 wrote to memory of 2644	5156	file.exe	82
PID 5156 wrote to memory of 2644	5156	file.exe	82
PID 5156 wrote to memory of 2644	5156	file.exe	82
PID 5156 wrote to memory of 2644	5156	file.exe	82
PID 5156 wrote to memory of 2644	5156	file.exe	82
PID 5156 wrote to memory of 2644	5156	file.exe	82
PID 5156 wrote to memory of 2644	5156	file.exe	82
PID 5156 wrote to memory of 2644	5156	file.exe	82
PID 5156 wrote to memory of 5016	5156	file.exe	83
PID 5156 wrote to memory of 5016	5156	file.exe	83
PID 5156 wrote to memory of 5016	5156	file.exe	83
PID 5156 wrote to memory of 5016	5156	file.exe	83
PID 5156 wrote to memory of 5016	5156	file.exe	83
PID 5156 wrote to memory of 5016	5156	file.exe	83
PID 5156 wrote to memory of 5016	5156	file.exe	83
PID 5156 wrote to memory of 5016	5156	file.exe	83
PID 5156 wrote to memory of 5016	5156	file.exe	83
PID 5156 wrote to memory of 2356	5156	file.exe	84
PID 5156 wrote to memory of 2356	5156	file.exe	84
PID 5156 wrote to memory of 2356	5156	file.exe	84
PID 5156 wrote to memory of 2356	5156	file.exe	84
PID 5156 wrote to memory of 2356	5156	file.exe	84
PID 5156 wrote to memory of 2356	5156	file.exe	84
PID 5156 wrote to memory of 2356	5156	file.exe	84
PID 5156 wrote to memory of 2356	5156	file.exe	84
PID 5156 wrote to memory of 2356	5156	file.exe	84
PID 5156 wrote to memory of 5512	5156	file.exe	85
PID 5156 wrote to memory of 5512	5156	file.exe	85
PID 5156 wrote to memory of 5512	5156	file.exe	85
PID 5156 wrote to memory of 5512	5156	file.exe	85
PID 5156 wrote to memory of 5512	5156	file.exe	85
PID 5156 wrote to memory of 5512	5156	file.exe	85
PID 5156 wrote to memory of 5512	5156	file.exe	85
PID 5156 wrote to memory of 5512	5156	file.exe	85
PID 5156 wrote to memory of 5512	5156	file.exe	85
PID 5156 wrote to memory of 4908	5156	file.exe	86
PID 5156 wrote to memory of 4908	5156	file.exe	86
PID 5156 wrote to memory of 4908	5156	file.exe	86
PID 5156 wrote to memory of 4908	5156	file.exe	86
PID 5156 wrote to memory of 4908	5156	file.exe	86
PID 5156 wrote to memory of 4908	5156	file.exe	86
PID 5156 wrote to memory of 4908	5156	file.exe	86
PID 5156 wrote to memory of 4908	5156	file.exe	86
PID 5156 wrote to memory of 4908	5156	file.exe	86
PID 5156 wrote to memory of 4804	5156	file.exe	87

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5156
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\AlternativeEdgeCookies-output_20250915040355.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5312
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\FirefoxCookies-output_20250915040355.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4352
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\InstalledApps-output_20250915040355.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2644
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /shtml "C:\Users\Admin\AppData\Roaming\watch-output_20250915040355.html"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5016
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ChromeV20-output_20250915040355.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2356
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\BrowserHistory-output_20250915040355.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5512
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\DefenderLogs-output_20250915040355.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4908
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\WorkingTasks-output_20250915040355.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4804
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\Bookmarks-output_20250915040355.txt"
  2⤵
  PID:3324
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\Bookmarks-output_20250915040355.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4460
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ProductKeys-output_20250915040355.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4468
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ExtensionsView-output_20250915040355.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:728
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\Autofill-output_20250915040355.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5008
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\AllPasswords-output_20250915040355.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4652
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\CookieExtractor_8c2ce3fa\cookieextract.ps1" -Browser Both -OutputDir "C:\Users\Admin\AppData\Roaming"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1384
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffb2f3bdcf8,0x7ffb2f3bdd04,0x7ffb2f3bdd10
      4⤵
      PID:5916
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1976,i,13182224047954858114,8404172022637052888,262144 --disable-features=PaintHolding --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=1968 /prefetch:2
      4⤵
      PID:4312
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=1988,i,13182224047954858114,8404172022637052888,262144 --disable-features=PaintHolding --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=1980 /prefetch:11
      4⤵
      PID:3848
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2196,i,13182224047954858114,8404172022637052888,262144 --disable-features=PaintHolding --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=2192 /prefetch:13
      4⤵
      PID:1824
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2368,i,13182224047954858114,8404172022637052888,262144 --disable-features=PaintHolding --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=2244 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5032
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2952,i,13182224047954858114,8404172022637052888,262144 --disable-features=PaintHolding --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=2928 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:776
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3784,i,13182224047954858114,8404172022637052888,262144 --disable-features=PaintHolding --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=3780 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:2252
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4092,i,13182224047954858114,8404172022637052888,262144 --disable-features=PaintHolding --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4088 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5620
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=4648,i,13182224047954858114,8404172022637052888,262144 --disable-features=PaintHolding --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4644 /prefetch:14
      4⤵
      PID:5500
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=4696,i,13182224047954858114,8404172022637052888,262144 --disable-features=PaintHolding --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4692 /prefetch:14
      4⤵
      PID:856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data"
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:4904
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xec,0x110,0x7ffb2f3bdcf8,0x7ffb2f3bdd04,0x7ffb2f3bdd10
      4⤵
      PID:5228
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2016,i,13387539757639140086,1598857923428493651,262144 --disable-features=PaintHolding --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=2008 /prefetch:2
      4⤵
      PID:1940
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2028,i,13387539757639140086,1598857923428493651,262144 --disable-features=PaintHolding --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=2020 /prefetch:11
      4⤵
      PID:3348
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2352,i,13387539757639140086,1598857923428493651,262144 --disable-features=PaintHolding --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=2348 /prefetch:13
      4⤵
      PID:5896
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2928,i,13387539757639140086,1598857923428493651,262144 --disable-features=PaintHolding --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=2924 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1120
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2940,i,13387539757639140086,1598857923428493651,262144 --disable-features=PaintHolding --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=2932 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3284
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3776,i,13387539757639140086,1598857923428493651,262144 --disable-features=PaintHolding --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=3772 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:3472
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4056,i,13387539757639140086,1598857923428493651,262144 --disable-features=PaintHolding --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=3748 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3940
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=4556,i,13387539757639140086,1598857923428493651,262144 --disable-features=PaintHolding --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4552 /prefetch:14
      4⤵
      PID:5108
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=4756,i,13387539757639140086,1598857923428493651,262144 --disable-features=PaintHolding --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4744 /prefetch:14
      4⤵
      PID:464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious use of FindShellTrayWindow
    PID:408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x258,0x25c,0x260,0x254,0x27c,0x7ffb2a73f208,0x7ffb2a73f214,0x7ffb2a73f220
      4⤵
      PID:5988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2080,i,15673763586496448509,3824758989243346839,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:2
      4⤵
      PID:4740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2092,i,15673763586496448509,3824758989243346839,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:11
      4⤵
      PID:4764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2496,i,15673763586496448509,3824758989243346839,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:13
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3216,i,15673763586496448509,3824758989243346839,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3240,i,15673763586496448509,3824758989243346839,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data"
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious use of FindShellTrayWindow
    PID:276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x258,0x25c,0x260,0x254,0x27c,0x7ffb2a73f208,0x7ffb2a73f214,0x7ffb2a73f220
      4⤵
      PID:3816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=1968,i,6074025893627258410,11757243978979434033,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:2
      4⤵
      PID:5632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2052,i,6074025893627258410,11757243978979434033,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:11
      4⤵
      PID:4052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2320,i,6074025893627258410,11757243978979434033,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:13
      4⤵
      PID:4688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3220,i,6074025893627258410,11757243978979434033,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3232,i,6074025893627258410,11757243978979434033,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4820

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4776

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4528

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3964

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 b95f5c1c8ea88ba2e77cd01929f8d2161c05f56d4155a4ee820317daccc4c5de
MD5 cd4b3afa1ababb88f3230bd173351eef
SHA1 0faec5542779047f46d12e16bb433db89923fa4b
SHA512 ddcc61d45f73b2f93641e027dd866846676ede378b0a41550a547d2c734c184f10fe14fb5a8a7848ad3d7b4d78017b8b900c28d7300785e272f1240f65221bf7
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ea2d248f365c1ee7c0a6b471cb307831170be346e9f71176f4133b37611690ad
MD5 98bd6d4fa95584aa4563283d7886c8c3
SHA1 6438214c2781396e9663585364d8291b46d81988
SHA512 3b14114482d2732b223f2e15d372aa4754f95fcc16890110533bf77d3b909ac7dcb2cdf8feb7b55f7977f1974b7f42f590b1ba3c07f60dae903a56f3549ec05e
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 17f1213cce5dd1b044b2b9f23365a5a6804fa9494b7f0a9b0ed8c5eb6487ad5e
MD5 fedcf77a647b3fe8f72f29221a465004
SHA1 6b475708107c3400b652fcfd35799dd0a703d389
SHA512 7d3ebd84c5ac2f9b1d701c5d5022faaa365fa380bc31e55558f6b89f82bb93e17088a1859b8608e7b22f4bb202cd1ddebd1a6a61d098e34806f5703c59593abc
SSDEEP 6:/FoR6JsfaEI+/uTsV4j+Ru3t8sq/F3VE45fTAXdX:d866CJD/85/F3V/ry
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 e889f11d54161d63dfc5b619a8fa01f417e4720cc95c4e7817b1e0b192c62a78
MD5 2629f407ff799ccc967c2bd7dfb638f9
SHA1 fe9b54480a97bc204cc648c36e4baee478ef9283
SHA512 8b5c20fc520bd88eb7a5f1c60c047fcf242c3ab14c4ddc5ef26002e11c8188f1aa69549431c1f69479669097eda6c0c81f8bf1c57cab275ac1fe7921de3ca0d5
SSDEEP 48:2YCST5QgtlgJwMCXgxBMiXWd5RGxoyCqS8aBCyd6HafzW0Yw4:/jZb/gnDWtPDqSCyGaa0YL
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 264df374d456d97adfc81c50d2dcd3c92f5326187c254f6a726d23545092f120
MD5 42a5fb424a1c5726fb5596146f21b62c
SHA1 195ea35253b302ee70c7545ac15d813775299711
SHA512 60cc75d9f0044b808f512e6a1c1df878086f74dd185801eabeeba488db2dcafdc726895227311f781fa766d4f67d9d3e6a82bd8e4657865342c63247a4a34e8b
SSDEEP 96:3U2nsmAqIAro8Qqv0nD6Jx+y82QR2RXuQ0dH4eU:31HNeD6x82QRzTF
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 2d2d68df86030836ed6860d268ceb3a06f86fa5c31dbb7f2f33ff93668236765
MD5 67dc58c143e0160a126e102bcad6f57f
SHA1 69da89b9f03a4daac26937a1bdcbb4f712170a48
SHA512 81e02a21a150522cd0ba3a13fea0ebaeda21cb25fa1c8474ca6a0ad4a49f98fffe8da3f39d86855679cfa8a603c0061c41cc7e662b5f96b7d420aee374726971
SSDEEP 768:/a4h4mDfDPLSgcRUv+Oo41DUfDPLSgcRUv+to4hkUfDPLSgcRUv+Qo494uh4:i8gbZYn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001
Size 34KB
SHA256 2a0d2b8199a58b6bf197d981dc5731eb62c388af6bc5037b960292776c77a242
MD5 e1de5c0653a46fbb9064ebed72e3d57b
SHA1 1962c4d0456c11b98f728c54a3fafdc4d67dca0f
SHA512 5f13804f038d7c26633256e3ed2d5633c19573986a3e366c9af507ec3385efd265816541754654f95576b13a59ee1e8003a1563575a4145caee6fb30ca82a75e
SSDEEP 768:EFqNiAT4jD9LBXs/YcFV3my954hiveEeUPe9DIZiD/+7Ew:EgNinP9tXs/DFNmaZeD9DwiAf
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002
Size 68KB
SHA256 569194375d5d79d291195610ec5719bb42a1cb42f58873ee4b62d9beaae54832
MD5 713908d970d7a738f4831a564abd6397
SHA1 4b6cfdca613d695218d481d4ba7f591f759e4507
SHA512 4e7476a3731a6551983b6aa32fe72d58d97d6825f6fbfffc8ca846abbaf610250d857766e8703dfeeadf8f9b2db3f846076045a2db3ccf435723cb444dfe0619
SSDEEP 1536:C+DwDqrDkQ4IU08bp8OBuwWQIYaDnCCdYXGLr/Mqu14UFsvXR5xRn8i:HwagtIj08MY1jXr/ZWzsZvRnz
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000003
Size 38KB
SHA256 420ca2eaa32a22f339066e6879d75a60848f8833bb4f10c3ad10a2da78adf04f
MD5 32305e20df23cddaa5ae886b97ba6170
SHA1 461d0572662dea04eada8017b97e2bdeb023b475
SHA512 9763137e96925327189a4cc2fa234fb89342b0f34339ca2bec5baf95b810c6b2b4ce40905224ecd7759cae0fe5c2dcbbc876a509e86a8cd67a6d49d772d73123
SSDEEP 768:vta8A+3yJu2PsUex0BUePLOKRf0peBavs6h88SQxkGxkqDPQIFCvUUPAAnqW1:vE3+CJZURx0BrPcs6m8jDxkqzQIxUPZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

DIPS-wal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS-wal
Size 8KB
SHA256 166989553f3f2ac8056e984a76323279cea77eff42134dcd5400699c709d21a2
MD5 900d138a2ffe43032acbbe8ae31a5085
SHA1 bb17dbac5aa2a585fd3f449e918646f7c4f5f8a4
SHA512 894c0412ec898f6de6e88929799af3246ec8205fff4a1825d10a0eda7944b06acb51683f5a2fe8dc89141fc1a737135a2e628ae232f9f8e8ea7a68915c9d16ea
SSDEEP 3:OlH/lImFapXImU24kH1XacAg1lllKlRW6WTZQvl/jKqK1caa+:KaIapYv244iwlGRXvtg
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 317B
SHA256 bb0a11419e86af64eea8b4452631917991b3fafcda3059a31dc7532f34bdb378
MD5 5824cfc7c4f03be461667a2a39f961bc
SHA1 214168029048924354894bb04725bce12cd13937
SHA512 f55ce22b5aec1b9849629b2a9eca150efc510c6d11a3df600657d85c70d665df77bdbde01674c4c230d82676129b630575a968a7c524e83ad934041830b8e2be
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000003.log
Size 106B
SHA256 3a0abb41f1f0fe1382e1a68d716c9fe77e222a518a2d468ad4c98dd82b8f3b15
MD5 c441b448b2ed3281ec2d040b40aaf8a3
SHA1 0cdb52276b299da33a381dc57c23a987a4670eab
SHA512 3eeb4f51e1f68b6ffda74ea9e6b027744e1b10bb30fae8f97790fd82874252a177e57bb8c9a291b4664b0116d00336576cef016d6fad344d375bbbaa0f0f9f53
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\LOG
Size 401B
SHA256 da3d940cdebd383bad9b783b47f7cf6f8affcf455cbe9432c2d6358664634434
MD5 9e3f31812c4e2cc40d4194f929b6b7e7
SHA1 40eafced230752a3353cf67808c99682a3cfa90b
SHA512 7408eb48e9bbb885b162b726cbdcda01c93684b8376ed1e84cb1b17b4c848d90745af4a270a7987c9e6415187e16a008512fd5525dda7e22cc60a3b54b28c904
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 332B
SHA256 d9dad06706ad21e714b4d74d7dd13a089645711fe9ca00820102f293fefdf264
MD5 8c7a32c1e6fc647e9cad1f21776e8941
SHA1 c2f4d091d7aa8cf95699209b2b6b74f8a403369a
SHA512 e10ecee8990637a07f6ad845eef62c0d1880cbd2549ea195072b91ad4cbbed39608203065337897e878f1d8084e48c63d51db5203c99aab09b0bba7103056f72
MD5 SHA1 SHA512

Submit Download

d1a6b19b-f83e-4a44-88b1-ecd256c777e4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d1a6b19b-f83e-4a44-88b1-ecd256c777e4.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
Size 3KB
SHA256 d82cfa6821adb8c30e04129984de3c69df4980083d4166a06d9631500a08f430
MD5 f645714e20f2ec82be7752e740ee2848
SHA1 5aa3a51b87725ad151637004d72e0228bed095f8
SHA512 92710bdcbbf49d9493a6a53d8dd14108626bb44ada621503c467700e2a913df535d4bf31389b49c032667c48d7436d20964b2953f6ed0f3e4cf6045fdcbd431a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 336B
SHA256 7f17a6f3681ab1b14fadde7574976cfa0e6cc08d9a5eee221da2834ca1cdfea4
MD5 1d9cd8e4ba789ff2ce265ff074f7bcf5
SHA1 2b929fef03071f02df40ee2f6f7af909917e734c
SHA512 2a0c1746719583f5b613f22b411fb98ad3c51baf161f92e83b94cb2e7c540509791c2f02c327ba59e95c6f69bc8d7eaefbe719b83a689642a9f9c13bdf55bddc
MD5 SHA1 SHA512

Submit Download

f1cdccba37924bda_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0
Size 131KB
SHA256 10e90f6ed898dce45d2484e785fb8f15a8e77fed55555d663f39b1fbf59513a8
MD5 5916ade7670c0f7ece8b80330292ea07
SHA1 c8c3515bd1d4a516eb78d8fef911c3597f7a7bbb
SHA512 2d56ebe27ff852fb4b98738793eb50df51117634ffe1cbc99fcb775778c237df340d48925481e3c347f0c7f712d6e518e8b666698f8ed64f8124a5f3b86fa5f9
SSDEEP 1536:JQnZbUj4iBgHYkj4ZwzKUrgIsXX5Sl+fbaK3eiVyvwFfEvDNCGIsiOGMYrA/4G9d:zyj4ZwCXpIK3xwptIswMj4GKNzRRsT
MD5 SHA1 SHA512 SSDEEP

Submit Download

f1cdccba37924bda_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_1
Size 345KB
SHA256 9eb7eee192a64878cac1a6886a622d2c4e25db9e41aee912948633c23c265122
MD5 af1929e3bed6f97b662bb159844a937c
SHA1 6a1f79dc9998423c22f68ccf3b4f0b97fa936cd9
SHA512 8b2ecdd7b7b2e0d80438ce327144ce0b9b4bcc66ddd8b0aa21159d5b8d45af33c7c9bed9c7c609472361d3b5b33d6957c593dba08204b5bfd84a31485eafc276
SSDEEP 6144:Parm1UJpokUwmyRoascxbYNFLGExzwLKDkM:ParOUJpokUwzRoascJGJGExcWB
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 f7d9480343ca14259b2e793b3bf9c13a6d778ecdd1466003596331cadf5f6cce
MD5 4e7a1e460d02a9911f55d84629fe0513
SHA1 4ced1327879cc4d7310b749f369c02e2430cf237
SHA512 bc047a2a9cbc4d43b5af05e513d8d0f42514a292750be4ba1e6e2bb5ebaf4345039c727b85bfdf7a1a676d73469b872fde678108d7eea186bbf3e54d3bc797b5
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 308B
SHA256 cbee1100a2c9add47776b7e416b58a809f6feb9fe458bef8185b0c176b5db340
MD5 4e7982b86b3d7d916b7722aa3b3f0669
SHA1 ce4e874903cb71d9012cc7654ca7a6ba5e4f7efd
SHA512 c4dda8b36e90a327061dab901730f47fc23cca129b02a157f1ed0c566a1d6dddf272a4e74d3acbf14eb3a7fac0820387a584db9e19ca299724ed7f3030f891bb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 317B
SHA256 d28b99e6ae18154dde7ee52db26af5af184b915875066e0201dc6de840fc0674
MD5 0f104768ad6161e2fcd10ec7549c6c7a
SHA1 43603b5dcca461d6237cc1917a20960a15aa16cd
SHA512 adf623853735c08902aedc7637a68538eb0d55f41c2c0bc6302df66c3bff779212ad78589db6a515db6cd5c3a5fb209f46833b08e3d555c4f878ffd2eda6b666
MD5 SHA1 SHA512

Submit Download

Session_13402382673642344

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13402382673642344
Size 2KB
SHA256 b6cfbc6d3e2281d633b99ca9e4166e6c4136996f7bcfd0dbeeb6f4a7c7c159f0
MD5 0a3392d2eda9475eed72ac27d72f8275
SHA1 40a1c759367e5c62bb05d7c14b728cb690d50be1
SHA512 9be55a9a5adc741e9645642b251fca26cc9ab9c916e848d42d4e0cfbcaa56625a84b4c6f815049bf79f1b2414da279602d3860c199763b21f1096381ffab4c5e
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 348B
SHA256 42f2e1eb2563c3de8080354f465f049ba5640bd7ba0e952debf63db803e8b9df
MD5 03f82728f9110be027a2906dc1c6f9ed
SHA1 98efa1cce4436035a75557e2726490022d4440b9
SHA512 76fe05dbd51f608cfadbffce7c5d6191a2bb2c9daebbab237217735d32fe042d14982f83eb98704f54f2417fa595a618a31ff83446eac789e8f7edc8bb27737b
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 2ad346f9d2d2581897d76672afc9529401820f6bdeb5e7bf3df4bb2275154f9b
MD5 46235f39406ca7353ddab6478b53310d
SHA1 2acc3e5b044c1b28cefb977768c4112f080c9fcd
SHA512 3e0aa6b7685ec3248fa390a08e20364c50414ef27c8b8267c307d084808d98f7ec04d908c298716c4323e8e219f12f3479915cfb120c3e4c941cdbc5728b7f9d
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 130KB
SHA256 895aa54dbb1e186665f5bdb97ee20ca496ffb178ec9fa04a436ea5549c763a5b
MD5 60cd2d28613eebe7a67f1bd7d9893cd6
SHA1 cc4510562314855c0d2681688a4a92b759dadf2d
SHA512 1f149b798e7c3d626d51f4566788f5da2e2cb3b4a7f089aac65e69a545eb4627fbb889131a387eccec600cddc7d372627b0e55ea530799aa1188e5ef017fd6f1
SSDEEP 192:oB4BvnXuvkUUo4nVaIvsb5wS8pX6w+eqXVumIb9:iovXuvepnkIvsb5wSgSVumIb9
MD5 SHA1 SHA512 SSDEEP

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 12KB
SHA256 c819ed4c156ac239e48589ff5173d566655a4d4385588847dd0f8b68a52543c6
MD5 bbf2ce804002d1e2f27f1238ad34f476
SHA1 2bb030edee294a46c897a48220dc4262cbc43cc0
SHA512 c2bd6cd71025561c7b527724280c65f95d1393a30f9f0265f5f594ea3a492c0f268e39b4ac615d714a9d71b8d40013547df54e4b86155703c3c44caaeffcd33e
SSDEEP 6:elCSCAVERLWc/XKuqHKu421DA5I/LlCSMEIn:6CBRLRXXwX4SDvRC/N
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 24KB
SHA256 18a867142f1f4857eba1bc9e4f0a7f81e4d7d95d92de8b09e7f3068f3f5158e4
MD5 b54579abe37bf9a69acafd864b5de7a8
SHA1 dccf453140647efa1928b583b6e78d9693d33835
SHA512 79508dd9a8ef3222c78c0c788d1784ce9f140961f172919ba9d1390887b960349b7212d91847bafd02656a2cded297ed1bd746c155ab7d54e1394553663bb1c2
SSDEEP 384:4C7wsdGQ95L/8zQ4III3bjMIMHB3+qksdGXy7ck7sdGsD+BIsdGfdGbm+SbOsdGw:pgzQVyiQhg
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 320B
SHA256 7253311cdd0cd8d6f6cb249944a9b1e6d3675bbdc384a67a4c758a4f693665a5
MD5 ad31cc0676ae28ed557d1dcafeabbe77
SHA1 4a9a70f04f7fceb90e3c23603e6e37714e22ffcd
SHA512 66542cf258c17057bb11b935cce9bdc390d3ba698f93f36900f3ebcef16725b6131a2cc30fb95f8eca3ae9d2f94a141abcb4bab8c0f7d87d2d0347eab75aec0d
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 97f407f7b9b73f72c6a9a6bb4c906e12fedbf40f982cb97b853d28a1f76cce22
MD5 925f9a5e454195872116a56c7c7a5bd6
SHA1 0ef2b63a3cd6e5fd976967352ef369b6b3b2bc2d
SHA512 7db3880ffb1f833ff59dc3b339f8f1fdeb4d2f5dd4d16cb5303121dc4eece66d87beb106251ae5bbf0addd9e0229a283325617f866053c7d9d6c44da2ce9965b
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 338B
SHA256 d2f6d908cf535f00dd8e26d31f593eb81f6d148505b323c3960a2eda22e9e657
MD5 d6356c4abf70ec5e1656de9a68e9bdc2
SHA1 24472a2cf318bb7ff8efdba3de4e0eae8d3b47c0
SHA512 8ae5c74585516aea90a1383469e7b6f681edee511774043291ab0567b9145af3500f0653a5e39fd136e8084b8b9188adbc7e05bea641ad8236a1e4c28ecdcbc2
MD5 SHA1 SHA512

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 7114eaf0a021d2eb098b1e9f56f3500dc4f74ac68a87f5256922e4a4b9fa66b7
MD5 a4710a30ca124ef24daf2c2462a1da92
SHA1 96958e2fe60d71e08ea922dfd5e69a50e38cc5db
SHA512 43878e3bc6479df9e4ebd11092be61a73ab5a1441cd0bc8755edd401d37032c44a7279bab477c01d563ab4fa5d8078c0ba163a9207383538e894e0a7ff5a3e15
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 82KB
SHA256 81538dd9c4a31008283e11637a29639e48fd6f0ee47947bd2829ed73e3bd4451
MD5 957c78f7034fc80099307efade80bb8e
SHA1 f6db471800cb339beca18b8eff93e81690ca06f3
SHA512 e022c563512569f6559b8230422583d1e747daadd6ade3d4fedae80e85df47b779578d63033ef1a502b788c024f070668605abbf8b787e579c1aa1cbafcb2b0a
SSDEEP 1536:bPdTiOxbytlt+0eqgYswraFwWVS0zo2OYjjPbYtfBqeMcc:zdxWXtHelYDamOeYjnrcc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 474d668707f1cb929fef1e3798b71b632e50675bd1a9dceaab90c9587f72f680
MD5 16b7586b9eba5296ea04b791fc3d675e
SHA1 8890767dd7eb4d1beab829324ba8b9599051f0b0
SHA512 58668d0c28b63548a1f13d2c2dfa19bcc14c0b7406833ad8e72dfc07f46d8df6ded46265d74a042d07fbc88f78a59cb32389ef384ec78a55976dfc2737868771
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 edafd9416105882e298dd1d5244cbcd7ffac584d36e85ee8f4a6400b0372ac0c
MD5 41101bab6ae30fbf1307fbc2c455a3f2
SHA1 81d3d478ac338cb79b03db063a62f4027233d17b
SHA512 bf2e6b60f7f378ec0c1c74920a33d880bc56cb71db942ab28b7ea310ecc8b3620e44f00a5aa839fd6547307c571b9288cadabf2c5e05633c0b049e7d2a3f5c69
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0ac8219d253ec4b43f3bc865face272d986bdf1aa53ea1296d83c52bc02996eb
MD5 1cde9e0db468ca926ef11375292dc665
SHA1 0898cfb83518f0514498567bd2f775a233acf0f7
SHA512 52e0ad55cea56cfe1876df902a45c44fcc8a946ef5eeff2e58b12668cbc895bdcd4699d2c4c5935c45d09227c3e6156c63fda07ec5234375a22a0aeebe48f4ca
MD5 SHA1 SHA512

Submit Download

0151e5ca-dee2-4d62-9c47-8c34bbab80b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0151e5ca-dee2-4d62-9c47-8c34bbab80b8.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

ee91b116cc2005be_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f6ad5e06-507a-4eed-9867-6c4de4668027\ee91b116cc2005be_0
Size 60KB
SHA256 2343b3e0d84ba77f9ddbf889de729f6666043b097d9c885fea27a5d5a15d5086
MD5 c075db669042d5d0b21388ba30ef55d6
SHA1 f29b32e7fadaedc45c00141e24396994449d6078
SHA512 a6c267b3e37e5cc9589bd76579b11af26f98ffd6105a05e092254ca70e0d0cef5794a3a6d53f3389e86f3786455ed292014624b5f5e8b8734cef604d3e308d19
SSDEEP 1536:prNatS7NV7cppYpi1z3JefpOOiiUabJifntPwqOaKy:Rjs1zZefEOkey
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 325B
SHA256 181d4f51ccc1e0b32149577238ae4695ac25200a4921f7a127f89339b0a23980
MD5 b846870da4f402c7d306ae73f8cd2e07
SHA1 4e73f4c42955c4f01b51dfb914ae1a307e487f5a
SHA512 a85df798c38660145cc5ba53427d2955353b66aab10a71b997be35c95a26e69425eeca29f4227500877f1184c826426ab97f1be356e6d1ce49ee7be9ded19e5f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2428d5c56f69ec8360fb514b13a219683c21c007cee71b482e24acb9e88f4ea8
MD5 0e41543da861be8d7effaec9e936bc69
SHA1 56154844403d38653444d534d14eda809e861c0b
SHA512 f9f9f05664caa832470bdc11157099dc53d470954bd64eec6fa76cc33ac9e11e4857b35dc83b1f563061a717dbd1c283b174231b4c1bebc5c8a684187f7996dc
SSDEEP 768:2VFiE6esE8lDldUGz3UCgqF6Q9B0iJVB6kqg5ItR59iHejQL1bXp1E4W:28eB85d73/wU0BLgStXUHeELNXp1+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bf01f4835f3a5b7d5a2ecff3b6b9bf45793d00ec5001b9059314d7d2967b85b1
MD5 48654983b26218c6965cffd8899b6f6b
SHA1 cfe11b79f2e5225682a3d816453e48dce4a6f41c
SHA512 9f4ed230b200f07738b7039cf2a671a05222a2252aea79b889cf6384c95fdf64abfe1b820b195634beb7363b04f5406ebfe8eaae9d74a219a2437b131df17c69
SSDEEP 768:wVFiE6esE8lDldUGz3UCgp0Q9B0iJVgkSYJZO7R59iHejQL1bXp1E4W:w8eB85d731U03Y27XUHeELNXp1+
MD5 SHA1 SHA512 SSDEEP

Submit Download

cookieextract.ps1

Path C:\Users\Admin\AppData\Local\Temp\CookieExtractor_8c2ce3fa\cookieextract.ps1
Size 9KB
SHA256 7d1c93f66ce2582570e64695da5ed92fba44f6a916efda4a417478ca7952c2fb
MD5 efb5f106eee5ab6f38797adb2de2f822
SHA1 cfc7a8c241c7f37faabe27084a30c629317d3f71
SHA512 0cbced89acf86c82f58fba9a1aeaccd611f8136c6e03e64ca868c6f3523ffb42c6af9a74345d03c5255706d1ee35844ebb61631fea8ffac42649dc087a2fa712
SSDEEP 192:uEQ3KqHzxZS6dHBdN6UyrpCcANLLtSa8Yr8+nlisBssqPjxX92:hEHDS6d/oUyru8YUsBRqPjxX92
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_tdzcdtt3.e5t.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tdzcdtt3.e5t.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

bhvCB2F.tmp

Path C:\Users\Admin\AppData\Local\Temp\bhvCB2F.tmp
Size 14.0MB
SHA256 7edb3d5b3a09cfc839ff0e16e231a8aafec2d928a21e51667545e5a425b37f82
MD5 3900ba2a48cc9172f04ba616174ff4ce
SHA1 7c02986e91dbf9ad33c99cba11aee1b0004c23b6
SHA512 e0e3964544ebfeb59b4ff6a52d3fe2fab5e72c13f71fe90a71bb9ac63dc2724cbf168e51b7e53a40f062edcbf997aed96c2ea39a1fc6ba1f784ee5b59c261fdd
SSDEEP 6144:fwM4kYmbzlgu3L2FCO6mniIpkeCkBG5V:fNmi
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternativeEdgeCookies-output_20250915040355.txt

Path C:\Users\Admin\AppData\Roaming\AlternativeEdgeCookies-output_20250915040355.txt
Size 7KB
SHA256 f6e1bb4197258257bc78ffda915de5d8b5a37fcd53fd5726d4a8a23ea6b01324
MD5 0fa6e35ca8614524e28f817b8da65351
SHA1 8a9cb80a80951c3304c8849b8e824f7b0d69ddad
SHA512 3e3b3af278f7993a2781808160f6a8dea6d02b5307c9330f930a83ec9a30097a3ada694014f3d00e080b495a16374e4005935282278df032964a4a181dd90ad9
SSDEEP 96:w4lBl4db482b48EVb48NkbyCQbebRndcz0aMclOLR0h:tzqa8n8EC85CLbRng0aNOLRA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bookmarks-output_20250915040355.txt

Path C:\Users\Admin\AppData\Roaming\Bookmarks-output_20250915040355.txt
Size 4KB
SHA256 59a936124b57ad442770144e0b0921f448703c2ce972c5664996d92ae5fde36e
MD5 626f60cb93efd0b01ec50e86517dbf05
SHA1 10ee211c083f171f733f8bdd9ede3e01ec88bb87
SHA512 3291f67ea82249e955e6a8ccc1fac43b966ea961806483e9e3ca0e7830b32bf0df2a7c7953230e204936fd01054b390fa0b74a4ecffa7b4da4f857dcc4fbc0ea
SSDEEP 96:eVhct6B/mnT6cQYGTVDcta+Z/D4VSct6T/FAVwctzUd/m:eVK857YGTVYAWMVx6CVjWd+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ChromeV20-output_20250915040355.txt

Path C:\Users\Admin\AppData\Roaming\ChromeV20-output_20250915040355.txt
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

ExtensionsView-output_20250915040355.txt

Path C:\Users\Admin\AppData\Roaming\ExtensionsView-output_20250915040355.txt
Size 37KB
SHA256 753b228bef36ba0e4a58cd984722c3efad09b3a1e155b72fd09a6efbce0dfc4b
MD5 e1d839b213898ae74a5eb2d62dd60b83
SHA1 253ca3321577a80b5fa54cc1d0fbeaf7a5276d49
SHA512 f35ad129d7583c46c0625c7a476b7eacf5096a9e542ec92e89478c6568335601924b246c43c3196755a274552f4d8a6af86a011a61d2a4a4cf41055ac5667aa5
SSDEEP 768:mVzBzzjzVzrzbnTz1WViKI0y3nTzTnaz/knuzZnTznMJNM8eadpcnOc2jmL6wv78:mVdnjZHXnTZyJRonTvnagnuVnTLMTMT6
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstalledApps-output_20250915040355.txt

Path C:\Users\Admin\AppData\Roaming\InstalledApps-output_20250915040355.txt
Size 165KB
SHA256 16b8850c323cd4999710b0cbce24c2b4821b163a3685bf7d9e53ed0a9b7c8ef4
MD5 4ff4d9b3016722a3c82a2840f199bbaf
SHA1 958acd0ad97f0aa34123d52b43acd98ec1fc5604
SHA512 eb64c3a3db82ea035a5fc657c20845307bf22ca38d9bcd649c575a3c65ffaa4823938f4da3bbae27b86f8e78a0014840273ca0ab44a76a6611d667fde502debf
SSDEEP 1536:MmI6U7htgoSUGOsstgGqLsTVt/rD7YcPHfYYQ80XwWK98aZPMt21Ql6fg9moI9g6:a0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

ProductKeys-output_20250915040355.txt

Path C:\Users\Admin\AppData\Roaming\ProductKeys-output_20250915040355.txt
Size 774B
SHA256 6cc62e0cd395022e5d83f40abdb9d5333b3803c7d7e1e8e041d43adba34cb795
MD5 66eb7801386ed258c944a72ec504225e
SHA1 a15bf72970b731ef3ac05d0ea2eeee96e4574e66
SHA512 a325081eb9a20a726e8279ec96d80f1c9309f4109de64f6fec936012c69fc9c0905fa97b0f2683a4f97965669f2954048d7f68c21f97003854116f4cdce80da7
MD5 SHA1 SHA512

Submit Download

WorkingTasks-output_20250915040355.txt

Path C:\Users\Admin\AppData\Roaming\WorkingTasks-output_20250915040355.txt
Size 6KB
SHA256 095d1174bb3d0c796f690ed617209beee0f471c6e7edddce39a0f6e449a5784e
MD5 68421a0cb93c720c61d871a61fc538a3
SHA1 51f6ec1669eabe5dad6ec12c21a66328f979d133
SHA512 08ff7a0784ff9e28921693bfaeba95d6dfbd82ea661c1931b8caab4fb00b5fa7ef62018fbc0b37ddc238db782d30c68ecb621501cd6b2431af580062a3e7b2de
SSDEEP 192:QV/h15fWXeppcV9l15fWXeb9VS115fWXRZgVy115fWX4Kr:a/h15fWX59l15fWXMS115fWXCy115fW9
MD5 SHA1 SHA512 SSDEEP

Submit Download

watch-output_20250915040355.html

Path C:\Users\Admin\AppData\Roaming\watch-output_20250915040355.html
Size 3KB
SHA256 de368a7c76afcb0920163cb62dffd97e0b92ae49c9283778ed86a7b2387aec91
MD5 4100239637737bd79a41b815578b6134
SHA1 36631f18d34e133cd20f924772266ee965ae9a45
SHA512 4aec41cd58f37394e347dc580498ae9e5752404451b870360c1b93ead211285afdceb4540432d8eb84ff74e4b0ba5436c4210b1e60f7f33b66af22b26c262ee0
MD5 SHA1 SHA512

Submit Download

memory/728-71-0x0000000000400000-0x0000000000455000-memory.dmp

Download

memory/728-70-0x0000000000400000-0x0000000000455000-memory.dmp

Download

memory/2356-40-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/2356-41-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/2644-26-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2644-24-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2644-27-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2644-29-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4352-19-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4352-20-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4352-23-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4352-17-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4460-62-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/4460-63-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/4468-67-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/4468-66-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/4652-78-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4652-79-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4780-123-0x0000000006DE0000-0x0000000006E02000-memory.dmp

Download

memory/4780-122-0x00000000070F0000-0x0000000007186000-memory.dmp

Download

memory/4780-117-0x0000000005DF0000-0x0000000005E0E000-memory.dmp

Download

memory/4780-104-0x0000000000E10000-0x0000000000E46000-memory.dmp

Download

memory/4780-105-0x00000000050E0000-0x000000000570A000-memory.dmp

Download

memory/4780-168-0x0000000008C80000-0x00000000091AC000-memory.dmp

Download

memory/4780-120-0x0000000007570000-0x0000000007BEA000-memory.dmp

Download

memory/4780-118-0x0000000005E30000-0x0000000005E7C000-memory.dmp

Download

memory/4780-109-0x0000000005780000-0x00000000057E6000-memory.dmp

Download

memory/4780-121-0x0000000006360000-0x000000000637A000-memory.dmp

Download

memory/4780-116-0x00000000059E0000-0x0000000005D37000-memory.dmp

Download

memory/4780-106-0x0000000005050000-0x0000000005072000-memory.dmp

Download

memory/4780-167-0x0000000007FC0000-0x0000000008182000-memory.dmp

Download

memory/4804-58-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4804-59-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4908-55-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4908-54-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5008-75-0x0000000000400000-0x0000000000454000-memory.dmp

Download

memory/5008-74-0x0000000000400000-0x0000000000454000-memory.dmp

Download

memory/5016-33-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5016-31-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5016-37-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5016-35-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5156-0-0x0000000000FB0000-0x0000000001A6C000-memory.dmp

Download

memory/5156-5-0x0000000006920000-0x000000000692A000-memory.dmp

Download

memory/5156-757-0x00000000021F0000-0x0000000002202000-memory.dmp

Download

memory/5156-34-0x0000000006460000-0x0000000006470000-memory.dmp

Download

memory/5156-1-0x0000000006A20000-0x0000000006FC6000-memory.dmp

Download

memory/5156-2-0x0000000006460000-0x0000000006470000-memory.dmp

Download

memory/5156-3-0x0000000003F10000-0x0000000003F16000-memory.dmp

Download

memory/5156-4-0x0000000006500000-0x0000000006566000-memory.dmp

Download

memory/5156-6-0x0000000007070000-0x0000000007102000-memory.dmp

Download

memory/5312-15-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5312-7-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5312-9-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5312-10-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5512-45-0x0000000000400000-0x00000000004A5000-memory.dmp

Download

memory/5512-44-0x0000000000400000-0x00000000004A5000-memory.dmp

Download