03b9d024bbfa55f9e7dd65afab96792effe79f17b1b642b4b88ddeb07a824339

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 06:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PRE ALERT 510739420.js
Size 858KB
Sample260604-g4aapsby7k
SHA256 03b9d024bbfa55f9e7dd65afab96792effe79f17b1b642b4b88ddeb07a824339
MD5 a7d9c23bd247f8dbffb7b66a1b74a729
SHA1 938c4a47a185e89dbffc0d1caf4b323f92101fb1
SHA512 c856fdd5540038008b1277758a95b5919dffe4e40732069e72e9aba0842a91478e377f484986b1422b894f5df0b843161e301ba8a6748e77cea682340ff07ce9
SSDEEP 3072:WV/m1osVVwbwi4UiIsDoGL/ZQvUzQ5PlDHtNQRvrTxoZvkOi9L61YcruORLd/UGJ:+m1S
TLSH
T1B615D53DCD14412FF872DA18C495859FF481659B222CEA47D0CA2F5F6EB2886B7C329D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 10 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5432	powershell.exe
3	5432	powershell.exe
4	5432	powershell.exe
5	5432	powershell.exe
6	5432	powershell.exe
7	5432	powershell.exe
8	5432	powershell.exe
9	5432	powershell.exe
10	5432	powershell.exe
11	5432	powershell.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Environment\UserInitMprLogonScript = "wscript.exe \"C:\\Users\\Admin\\AppData\\Local\\BarcelonaEquilibriumSolicitorStationIndividuals\\ItineraryQuarterStudentsAcademiesBarbados.js\""	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 33 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	powershell.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5432	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5008	chrome.exe
5456	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
3992	chrome.exe
3992	chrome.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	5432	powershell.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeDebugPrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeDebugPrivilege	2492	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3992	chrome.exe
3992	chrome.exe
6084	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5156 wrote to memory of 4688	5156	wscript.exe	81
PID 4688 wrote to memory of 5432	4688	conhost.exe	82
PID 5432 wrote to memory of 3992	5432	powershell.exe	84
PID 3992 wrote to memory of 5660	3992	chrome.exe	85
PID 3992 wrote to memory of 3900	3992	chrome.exe	86
PID 3992 wrote to memory of 5008	3992	chrome.exe	87
PID 3992 wrote to memory of 3596	3992	chrome.exe	88
PID 3992 wrote to memory of 5104	3992	chrome.exe	89
PID 3992 wrote to memory of 5280	3992	chrome.exe	90
PID 3992 wrote to memory of 4588	3992	chrome.exe	91
PID 3992 wrote to memory of 2152	3992	chrome.exe	92
PID 3992 wrote to memory of 3836	3992	chrome.exe	93
PID 3992 wrote to memory of 2136	3992	chrome.exe	94
PID 5432 wrote to memory of 2152	5432	powershell.exe	92
PID 5432 wrote to memory of 2152	5432	powershell.exe	92
PID 3992 wrote to memory of 3316	3992	chrome.exe	96
PID 5432 wrote to memory of 6084	5432	powershell.exe	97
PID 6084 wrote to memory of 5232	6084	msedge.exe	98
PID 6084 wrote to memory of 2780	6084	msedge.exe	99
PID 6084 wrote to memory of 5456	6084	msedge.exe	100
PID 6084 wrote to memory of 4860	6084	msedge.exe	101
PID 6084 wrote to memory of 4808	6084	msedge.exe	102
PID 6084 wrote to memory of 5480	6084	msedge.exe	103
PID 6084 wrote to memory of 2300	6084	msedge.exe	104
PID 6084 wrote to memory of 1696	6084	msedge.exe	105
PID 6084 wrote to memory of 1704	6084	msedge.exe	106
PID 6084 wrote to memory of 5504	6084	msedge.exe	107
PID 6084 wrote to memory of 2312	6084	msedge.exe	108
PID 6084 wrote to memory of 4996	6084	msedge.exe	109
PID 6084 wrote to memory of 2340	6084	msedge.exe	110
PID 6084 wrote to memory of 2424	6084	msedge.exe	111
PID 6084 wrote to memory of 4548	6084	msedge.exe	112
PID 6084 wrote to memory of 2492	6084	msedge.exe	113
PID 5432 wrote to memory of 2492	5432	powershell.exe	113
PID 5432 wrote to memory of 2492	5432	powershell.exe	113
PID 6084 wrote to memory of 3512	6084	msedge.exe	115

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\PRE ALERT 510739420.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:5156
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless powershell.exe -w H -NoP -NOni -Command "&([scriptblock]::Create($env:JyYPkUdOyX70MD9))"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -w H -NoP -NOni -Command &([scriptblock]::Create($env:JyYPkUdOyX70MD9))
    3⤵
    - Badlisted process makes network request
    - Registers new Windows logon scripts automatically executed at logon.
    - Accesses Microsoft Outlook profiles
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:5432
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck"
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3992
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffe6996c728,0x7ffe6996c734,0x7ffe6996c740
        5⤵
        
        PID:5660
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1580,i,12782762489663839465,12555423992635185113,262144 --field-trial-handle=1904,i,66794853926387029,6383521047283893107,262144 --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:2
        5⤵
        
        PID:3900
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck" --force-high-res-timeticks=disabled --metrics-shmem-handle=1988,i,7777508991734189508,13923463114268152907,524288 --field-trial-handle=1904,i,66794853926387029,6383521047283893107,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5008
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck" --force-high-res-timeticks=disabled --metrics-shmem-handle=2168,i,8006587977561349289,2329536350235857800,524288 --field-trial-handle=1904,i,66794853926387029,6383521047283893107,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:13
        5⤵
        
        PID:3596
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2732,i,2305731924038990151,8548919492886330392,2097152 --field-trial-handle=1904,i,66794853926387029,6383521047283893107,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:1
        5⤵
        
        PID:5104
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2736,i,1455316934555082030,434750235257513786,2097152 --field-trial-handle=1904,i,66794853926387029,6383521047283893107,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
        5⤵
        
        PID:5280
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3076,i,4159691441997010460,9343097093558012925,2097152 --field-trial-handle=1904,i,66794853926387029,6383521047283893107,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
        5⤵
        
        PID:4588
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3096,i,1033771138981257045,9115462975242676302,2097152 --field-trial-handle=1904,i,66794853926387029,6383521047283893107,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:9
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2152
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4040,i,3376441055214009586,1605065225286227802,2097152 --field-trial-handle=1904,i,66794853926387029,6383521047283893107,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:9
        5⤵
        
        PID:3836
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4184,i,3566968042755555868,8525856996333064535,2097152 --field-trial-handle=1904,i,66794853926387029,6383521047283893107,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:1
        5⤵
        
        PID:2136
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck" --force-high-res-timeticks=disabled --metrics-shmem-handle=4224,i,2734245036649993208,18291498291757965305,524288 --field-trial-handle=1904,i,66794853926387029,6383521047283893107,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:14
        5⤵
        
        PID:3316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb33fcgf.bb2"
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:6084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\vb33fcgf.bb2 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\vb33fcgf.bb2\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ec,0x7ffe6601c188,0x7ffe6601c194,0x7ffe6601c1a0
        5⤵
        
        PID:5232
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb33fcgf.bb2" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1712,i,9395602783751921915,13252047018879051436,262144 --field-trial-handle=2160,i,5101311821265562623,16573656919217765150,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
        5⤵
        
        PID:2780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb33fcgf.bb2" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,8631279782468653168,2556393886808981054,524288 --field-trial-handle=2160,i,5101311821265562623,16573656919217765150,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb33fcgf.bb2" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,3819841141025729998,11381062773318971764,524288 --field-trial-handle=2160,i,5101311821265562623,16573656919217765150,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:13
        5⤵
        
        PID:4860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb33fcgf.bb2" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3100,i,16598120004904828497,15757062376746730874,2097152 --field-trial-handle=2160,i,5101311821265562623,16573656919217765150,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:1
        5⤵
        
        PID:4808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb33fcgf.bb2" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3104,i,12452903470097326880,6539424301108732873,2097152 --field-trial-handle=2160,i,5101311821265562623,16573656919217765150,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:1
        5⤵
        
        PID:5480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb33fcgf.bb2" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3364,i,7158044200914766329,14183719992877999094,2097152 --field-trial-handle=2160,i,5101311821265562623,16573656919217765150,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:1
        5⤵
        
        PID:2300
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb33fcgf.bb2" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3404,i,6012846778216378165,13180616341145011635,2097152 --field-trial-handle=2160,i,5101311821265562623,16573656919217765150,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:9
        5⤵
        
        PID:1696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb33fcgf.bb2" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3416,i,10095827535222864272,9961058161543079819,2097152 --field-trial-handle=2160,i,5101311821265562623,16573656919217765150,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:1
        5⤵
        
        PID:1704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb33fcgf.bb2" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3440,i,4381678316135543152,17894099417072864487,2097152 --field-trial-handle=2160,i,5101311821265562623,16573656919217765150,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:9
        5⤵
        
        PID:5504
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb33fcgf.bb2" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3484,i,739895240358529982,2597998070349881157,2097152 --field-trial-handle=2160,i,5101311821265562623,16573656919217765150,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
        5⤵
        
        PID:2312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb33fcgf.bb2" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3492,i,3292082395818965231,16228364707440443285,2097152 --field-trial-handle=2160,i,5101311821265562623,16573656919217765150,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:9
        5⤵
        
        PID:4996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb33fcgf.bb2" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3508,i,16277691957086169301,1965432877267342052,2097152 --field-trial-handle=2160,i,5101311821265562623,16573656919217765150,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:1
        5⤵
        
        PID:2340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb33fcgf.bb2" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3544,i,13066525042157439264,4632120617463539245,2097152 --field-trial-handle=2160,i,5101311821265562623,16573656919217765150,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:9
        5⤵
        
        PID:2424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb33fcgf.bb2" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3560,i,5065861166268626311,13313177802385120648,2097152 --field-trial-handle=2160,i,5101311821265562623,16573656919217765150,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:1
        5⤵
        
        PID:4548
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb33fcgf.bb2" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3588,i,9634548230974735170,677366967069905390,2097152 --field-trial-handle=2160,i,5101311821265562623,16573656919217765150,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:9
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb33fcgf.bb2" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3348,i,6947520573972820675,16019073303488958758,524288 --field-trial-handle=2160,i,5101311821265562623,16573656919217765150,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14
        5⤵
        
        PID:3512

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_ak1x5dmj.ixp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ak1x5dmj.ixp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\Crashpad\settings.dat
Size 40B
SHA256 cf351ef5fa3fee9d48d703bc238955cdb1d42d75e72a5e2feb3a79d20f352d9d
MD5 73b681808331651f4857c84feb6ed410
SHA1 87947e102acf12f0f71a48b13e6b53cfa2bee34a
SHA512 5b3ec1aad2b5f886a75396a06f14597c28eeba9eed861c9f694d6313db0edd0286dfb605e7d8250dc1c0ae5ba4ea7fa52438337c9becbdc11c6b6a6596456db2
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 d6f8a3348e409f24944444f17b8db15b9aba797ceb522735f79cc436a2a415af
MD5 3b4722ea1c84be2feb6d2c277a2f37c7
SHA1 cef4b02def6101e6281d8c85ef7704b6745b9639
SHA512 9aa3661eee832f6a456ad2f924d7ee885141711d7426a99234e6be98eae3c26f35a606e1be74b8cf392d2e9ce4cec6f37f2b17e3f93e69fd7a14258505cf7422
SSDEEP 6:/FoEXEIQSkNORLXa9hirjBx2/1g9OyBcAkEXCzQ5kll8UsZgB:d7XtQXNl9AsCXBcAkEDq/8Ucc
TLSH
T18F135E3EAB50AB8AE259503C5C5B6770C330D804D2D18A4FAA7134A8F348B21E40F3C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 425ee55d269a15ea59faa447f18210b663b94d5e671dadf405fced204fa6d3f2
MD5 37b37e29f4cb1f0a3c062ce6525752aa
SHA1 cc50a8969039df6856edd98ed61b3ae832bd45a5
SHA512 acc554951b685d8f8422e01cb20aa53e447b074532ed4daa7ebcb96406dadb4c83914fb1e941029d37a468e845edebca398946f7fb10883c5a292db9d474efe3
SSDEEP 48:Tl/VgYFvSpyyM1Xg+8DXJstp4MmXodVEPLVBKWwtl:p/HxSpyyug+gJw+jGVOLHKWol
TLSH
T19E4496F71C04EDC6E615CAF96C51A22CCD3286251C9AEE7DF63984660150DF371587B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 c51a4ce88c2eea81bc6b420105af62e40b679d9b7493b72653a419e26641f3cc
MD5 ddefcd3efac38902bee7978b557b40fc
SHA1 0bfa92f006180e5bd7905e060bdb2d7d526a0231
SHA512 c5d0804b247b7875814da6a2d780ffe7c08d1e6d994d61161ea70beae6847a1c722f70605302ede6157dfeaadc39e42cb853cfbd7d700774f0d5cbf5360ee52d
SSDEEP 48:pmsxoZkYK22u1xWF5g8dKeuvx1GUrGafgo0xHrDFv99X0lZH9/Aufwjj0wf5:M40zJXq5dIvx1GUrbmLDFvDX0Vxwj4A
TLSH
T138252BE5FD08193BC08751BA8BD07D8BCFE58350C18D54538A785A18FE18981C4513EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 f738160910a2b988c58902a495efaf6febbb38a5543f247595f70d7928d1b82f
MD5 cc426767774549e906df245da86c58ac
SHA1 f5dfabf3c61fa82957269764809026f0ded9deca
SHA512 f69140e7b140dbb0043848dc05e41f9154595611c7b93f299730a0ef1964d61ecfd54d6c7551e336693148dcd249db07385a4ff65dbb100dc8e9f8cfc87bc499
SSDEEP 768:vfDPLSgcRUv+Uahv4mUfDPLSgcRUv+Lahv44UfDPLSgcRUv+Zahv4VUfDPLSgcR4:NaNFaNxaNTaNjss
TLSH
T1D8165CB24F287E43E741EBB0BBCDDD1C7CB12295AC979C82E522926949F0FC41B8515E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\Default\Cache\Cache_Data\f_000001
Size 35KB
SHA256 66a737ef7af3f02892a6953459f3eafb319afdfbe55a9ee8dc29a4729ca5820b
MD5 639e38fde4abb6725dbd4c31c8fe9761
SHA1 becf398b4eaac1b4e229b0b485d0d22697eb5a33
SHA512 49ddad75378675cddc2b2eaca5346de827972c15c6769154224b2a72b52c3f33b3bd987cb0e60fc51b22ad009012cbd9341d59da7f1e53955f965a88ffb58f63
SSDEEP 768:WBsifO2FijIb5WqR07wcJMhG1MJ3meCXwi9wvMAWI8:WGBljIb5WFcpGwmeCgi9w+I8
TLSH
T149F202883697C912708FBDE4FAF9A302547994FE1AF2E0C4290BF4F1554D87575C632A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\Default\Cache\Cache_Data\f_000002
Size 68KB
SHA256 6cb2b7b885f4b1e09aa5fc5187589e0d011150c6b2b3a6140ef616f890581004
MD5 b1c469282cac79134bd4aed04c10f65d
SHA1 2ee7fb4b240ff8d1ed702a2a88a2bf177b09dd05
SHA512 e80f56a547d7f3d58ba1f8b70a7d6f55ee06021ea732f14c4f8cd0a3710d7ff6836d3ee59be5b7da31efe05fc7548190019b1b5ee4342eafe13a8fc53789dec4
SSDEEP 1536:0eIGaeEQNubiYEwrVETS9dEiD+kNNBM38GULO6c8zx6:pIGL3EG0VE5iD+kNNBM38/LXjt6
TLSH
T11263021EC09082DBFD41E2B535B91976C18F01A7FF5BB200BAA8727524C5F6F49A3489
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\Default\Cache\Cache_Data\index
Size 256KB
SHA256 11f1f5481919f42bd3dc92be8e57b8cbbeae779530b6941e9f94c8b536f86ec5
MD5 521d83d1b95846fbf390e7924695d3d0
SHA1 e5af8d05d68caf7ad7796e8643cc949d2f2cb2d6
SHA512 6f6eaa0e3ac2db2109c2a2d328fd93de0c821e732045ca50254da5f2dfc8e112edaf5d54858fe886a596bf740c17e816f7805252dec444c0beb69b582845cd56
SSDEEP 3:LsLllFlklNllklkXlrBJllLll/n8ll//WNtlNlXl3Nl/lZNtlQlZllll/:LsRa3lPVClteNtbklll
TLSH
T19E44016E93856E1AC3C802FDD46B8B60A378C809DA8F874B570576212CC17916E0F268
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 0dbae404005c864a95cfb9d528e41de6e0124b6120cce863446811f8abf88337
MD5 ed5f8690affe86ba5030a618d537ab24
SHA1 2697b436b8fb2ec736a9429490719d00a130846a
SHA512 28ebcb9e7013d081f0c94d72090e7c1a4517d68b6bf2c525009bfe6916435e406995f758cb1785e252360a9a3b02f4b22335eca09996eb553acb8fd96f04e857
TLSH
T1DFE02B81838C0F0DD32D96F7CDA603044A0A42C429BE3603A980C6C233524345248123
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 d8dca48559382e5e2a3a9f8ac759b1803da17afa9e8e07679ca24e8ecb9fb82c
MD5 7982e4a02f3fe196a5b48953b2778b49
SHA1 d751d2d8d65cf74f4a4430980c1da117199c0151
SHA512 eff97869b89ada7fc8fa86e2ae89028e4c189e8d24d77e5a7e46f97d3ef754960a59626b2fc9e76d65dc85e482516b20de31aecd03826d5071bf51772d20013f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 d74480937918dea59ee0e19d6c0faff4029d8d6727403f4e6a628f082ae70e6d
MD5 dd11efb69a8c7323b0bdf2c1895002de
SHA1 a03fc1ed607602deec883b033da836fb8a633de7
SHA512 fc1d473ccd2f5efbe43edd41b36874cc7f92862737e5bf6a8338d6abaec4d2985122b1e53562e239ecf858189fa0b97bc51edd03ea17dfaef75af7c22dbb2a08
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\Default\DawnGraphiteCache\index
Size 256KB
SHA256 4d6c9b6a32ff857f23c7b1891cc35f8cadeeb4c9033b074459e4fd76c721ae75
MD5 e9869ad69c486b9c01863e61accfc545
SHA1 ceca9a00d9a4b0d23a8bf834f4f2a73dfe1616d5
SHA512 29dc09ffddaab77efc5060053fb266c03e17de7311b2eb232ac2c44e3c06311f20675b1aab10fa248b98e24d56ddcde590dfe36bc89cafc98706b8059284ec3e
SSDEEP 3:LstlNllklkXlQ6K/:LsX3lPQJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\Default\DawnWebGPUCache\index
Size 256KB
SHA256 9dc1c98e7d031d52a1aedd7e3f4ac4eccf904907c617393846f83481a03a6ad1
MD5 5bfe15d56eec39a52ae6731b6c1dcb29
SHA1 458906ab82c0acb3717570795625b7b9d4842ba0
SHA512 cfc6be04fe869c21af258fef5ed6f6e0740aababf46d51e4c0d5b830a3313498be1ddb0f3b1720b40e45ccb11ffdb2aeba9e807d1aa5e872cb7a69605e0c1edb
SSDEEP 3:LstlNllklkXll/Ul:LsX3lPl/U
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\Default\GPUCache\index
Size 256KB
SHA256 8db40df9d88311b0b4a7369e3b45b06e34439bfb5482682cef81f50804dffc7d
MD5 ea3b318b1773d9a0ed7c0f91e7682f67
SHA1 310fdd81b837a72f1a3d1399bb51027bb1f7222d
SHA512 d337f126676373eb59da74ac34361cd3377c9b3f979c82bbd059554c50b9e6281d681cb415409bac1bbfb0ee7adc929ca32bd524e387d1d651173991b815e8f8
SSDEEP 3:LstlNllklkXlo:LsX3lPo
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

4cb013792b196a35_0

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\Default\Service Worker\ScriptCache\4cb013792b196a35_0
Size 10KB
SHA256 a99acceb13eb9a30ce2abec2430fdc88a126b9411e5eb7e15312fd6b2a88fd0b
MD5 b63b8cfd9981a377a74c57c1f323da4c
SHA1 873d1aa54669a4951bf228edd6894170c9be8d8b
SHA512 72af63998acb5d2ded85fcacf5887b6264206489b49cdef62f6c8c0c75558913973ffe54381acf6aceb3c4c874906bd5834f70c73eeeaa3d59f431f809d00e0a
SSDEEP 192:QORKXKKUEUu3gaYllgqJIUwNTvyDJPs/9QLP0J:QKOKKaL2yDJPse0
TLSH
T15C22D74A87F702A59065D1756F8F61839629811F2A19F54E3CDE43B46F06B3092FEFE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cb013792b196a35_1

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\Default\Service Worker\ScriptCache\4cb013792b196a35_1
Size 6KB
SHA256 dd618b52eda57ef47dcdb654e9dbe4c1085ff7219e45a78b6f98730ae601017c
MD5 03d2f0ece50763b57d1081d382f978b1
SHA1 28310dd7a845adc2f10047ccf28e5ac01b006ce1
SHA512 9f97366a06e47759a95fe263f387595e62918521d217e16ac0109cd0762da4d97e20faca547412120a5496567dab5b6eb1bae1edc3490e83092a33742722562b
SSDEEP 192:E6dUlGlL13Xn0uqkSnTrT6n6A+t16t9HD996:tdzlL1Hnjq7TrT6n6nt2P
TLSH
T154E1E89283329627CB2543FB41A7925333FD5548BFC2E12A6DA697E52C123F278DDD01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 1a33c27af458d9b615360165b10480b023fa36c2aeed274e8f54703a3c52691a
MD5 008557226f077f1bd2e7fa82ddc1bfd7
SHA1 cca95fddc1b60d63d4fa4d2d638cdffbd2b4c6b7
SHA512 562d99f5ca17ba0e8e8e2cce2fbb8bedee38490c729e8c392952c8ba48314de3cefe6226dbaca66cf1c07f12c6f742d377bea54ca07aefc204a3bd27dd01a961
TLSH
T1B7A0021202458110C10012F02A51A78C5304F9A58504062777E44356CC600508911344
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 e3a4ebfb64945843eb4ee499caad346882a494a783c488d75a7e5326d5f950fe
MD5 c498ab59d1236ec94405ce65a6a7cd0d
SHA1 5dfe32b2b7ce84d3437835a9aad6a34f97441b07
SHA512 bf2c71e3e642d76e10581b1f1bac1073bf24f87d3b78d08ddf86f2f53978de7442821b3a7aa51022cde440162f2a9dc60cf0f223cd86438c420e1d24d06df452
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\grsdlp4p.tck\GraphiteDawnCache\index
Size 256KB
SHA256 503828baccaea078ba7da69f230b43a3485326c718d7da652802bb86005f1c07
MD5 6377170e9f1fb3c24ab49dc4e53cdbd8
SHA1 54f3c2bc38237820ff5b94de9758b48480891c32
SHA512 3bfdcc70aa464f5de8f78520f3af2d8c83977d83c550e77176f2624b1a3685bb85a6255c843da87c9dcc7093c013c913379078d77384f7ef043777031eb570f8
SSDEEP 3:LstlNllklkXlji0l:LsX3lP3l
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\vb33fcgf.bb2\Crashpad\settings.dat
Size 280B
SHA256 e1263e22911082a74510b7b5042421d6cefd6d4a104f69c698eedb3f690555cb
MD5 2f7ea42ca8023e0f77d83a8e422dbdb9
SHA1 29feb15a6877f48c395cbff277c135d12ee82e3d
SHA512 f73adc2ab1b484d3a31cab4adb38f45695a0195feceaf0cc71294bbfc43b48f251ae6dd52a2a2f417d0eca6dc58ab1434a8a98b2e6c9565dab7c409c1e2114dd
TLSH
T1D3D022E0B3302030CB0CE3F2A0B02320C20CE80A808BBFE2E030000A88A083B030E882
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\vb33fcgf.bb2\Local State
Size 3KB
SHA256 f7167b012e801e910068430fe01de2582c941e510033728c7a502bc2a631e8f4
MD5 95c323ab09740d6903f610bd31f7b1ec
SHA1 940df09ab57bd2b5a008903a78213f91461420e7
SHA512 17c405115be16cffeaf51a6a682438f5ddf7073f2165ff71d0c8b9b6b572f2e1f4ef1fccfe407a0e7619f40e20418bfb8fc9c40197dafa646fd52a3bc4ad1c97
TLSH
T16181B7726429EC735AE56644BA8B37A39E7830B3DD45AF58E2D8171800DF6582B0DC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\vb33fcgf.bb2\Local State
Size 4KB
SHA256 70b79652c4e6b6fc68e5a695b6a2c0244cdc6ca8ec2928b0c0bb13e7b1cef14d
MD5 ec8db7c0eddbbef88148168036583a62
SHA1 6cbf50dbce8f465615482ce688b448b6999c43ee
SHA512 533d428c8c1e11f60b4d38d0fac1f63deec73c0f332f1a8fdb27b42a648357cb250a8b7984f84df3ed1ca495c9b4219f8bfa3c8ff470a146feec9f528c008a2d
SSDEEP 96:SRqGNkWQsFfy7O/PcGB58Frh/cInURoDotovghDuBSAyv6+Z8X0eUnDzOfq4a:RGNu37O9oooDUw6OC8XqDzX
TLSH
T110A1B8726439EC635EE5AA04F9C73357AEA82077D989BF98D6DC1A0C00DB7882709C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe595a0d.TMP

Path C:\Users\Admin\AppData\Local\Temp\vb33fcgf.bb2\Local State~RFe595a0d.TMP
Size 1KB
SHA256 11b90757ec4fa63fd3eab7532b4c2e1fffd542eec0859256ab31a33769e8b378
MD5 546d8a0c54448ac7088f4476d6aac05c
SHA1 298bf42913c1658f59f4348dac32c3bf5553440d
SHA512 1f5228dd677e2bf0384486027f94d1d9f97fa447edd3bdaa092377b1eff3e33da7ecf61eafb6e6f5a0107db888d2a740df7493ce0082cbd182add6372815e6e0
TLSH
T1D8319572A46CACB3B9914345B78F76671E34603AC2996E8893EC150801EBA9C271EC37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2152-156-0x00000234ABC10000-0x00000234ABD3E000-memory.dmp

Download

memory/2492-411-0x000001B92D200000-0x000001B92D32E000-memory.dmp

Download

memory/5432-17-0x0000019536620000-0x00000195366E8000-memory.dmp

Download

memory/5432-0-0x0000019532DC0000-0x0000019532DD0000-memory.dmp

Download

memory/5432-12-0x0000019532DC0000-0x0000019532DD0000-memory.dmp

Download

memory/5432-11-0x0000019532DC0000-0x0000019532DD0000-memory.dmp

Download

memory/5432-10-0x0000019532D90000-0x0000019532DA4000-memory.dmp

Download

memory/5432-9-0x0000019532D30000-0x0000019532D92000-memory.dmp

Download

memory/5432-8-0x0000019532CC0000-0x0000019532CE2000-memory.dmp

Download

memory/5432-16-0x0000019536480000-0x0000019536522000-memory.dmp

Download

memory/5432-1-0x0000019532DC0000-0x0000019532DD0000-memory.dmp

Download

memory/5432-21-0x0000019536A00000-0x0000019536A50000-memory.dmp

Download

memory/5432-20-0x0000019536830000-0x000001953683A000-memory.dmp

Download

memory/5432-19-0x0000019536820000-0x0000019536826000-memory.dmp

Download

memory/5432-18-0x00000195366F0000-0x000001953681E000-memory.dmp

Download

memory/5432-415-0x00000195369A0000-0x00000195369B2000-memory.dmp

Download