acrstealer | cd598cea811d8f73ca7afffa40e5963be9a82e01bad8ffcebb104b475c091faa

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 08:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
webdav_payload.dll
Size 3.3MB
Sample260810-j321fayxev
SHA256 cd598cea811d8f73ca7afffa40e5963be9a82e01bad8ffcebb104b475c091faa
MD5 543c2c2319b6ac58c75a7c9aca798292
SHA1 958380a31cb33dbf14ba010be64a6a5fb00aa24d
SHA512 1d17ca569504c2a0b1b70d524c3d53ce0870bca2250026a0d630ad0e2df697aecf5adde3c34612992be62e3025e2d235ab871a9330fe81a78b4b2b1b42f4f2df
SSDEEP 24576:knSoKp2ulq70SV0hEqE8XBC808ycu4eWg7VJPmJ9BaSQm3XFK7PB:2sl7Q2yfB
TLSH
T110F5C4E12653E04EFC6841FE1F1BF7542B4E9235A12C535DE520AB88801F7739EADA1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery acrstealer persistence spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.3.1-alpha1

files.orchestratorlabs.cc

Decoy

fastly.net

Attributes

ddrs
https://telegra.ph/Jack-Little-04-18
guids
019fd84c-02e7-7a67-9097-4f73d632de4a

f1575b64-8492-4e8b-b102-4d26e8c70371
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Detects ACRStealer V4.x 39 IoCs

resource	yara_rule
behavioral1/memory/4316-2-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-5-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-8-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-9-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-41-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-47-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-51-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-57-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-100-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-136-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-146-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-188-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-193-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-194-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-349-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-350-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-348-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-354-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-356-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-793-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-794-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-836-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-843-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-850-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-856-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-862-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-870-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-876-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-882-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-883-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-889-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-896-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-897-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-906-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-912-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-913-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-920-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-963-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4316-2824-0x0000000002270000-0x0000000002320000-memory.dmp	family_acrstealer_v3

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 4316 created 3272	4316	rundll32.exe	56
PID 4316 created 3272	4316	rundll32.exe	56
PID 4316 created 3272	4316	rundll32.exe	56

Badlisted process makes network request 10 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
13	4316	rundll32.exe
14	4316	rundll32.exe
15	4316	rundll32.exe
19	4316	rundll32.exe
20	4316	rundll32.exe
21	4316	rundll32.exe
22	4316	rundll32.exe
112	4316	rundll32.exe
129	4316	rundll32.exe
130	4316	rundll32.exe

Executes dropped EXE 1 IoCs

pid	Process
3832	creator-ws.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4316	rundll32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1848	chrome.exe
784	msedge.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1700	msedge.exe
1700	msedge.exe
1232	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 4316	4124	rundll32.exe	88
PID 4316 wrote to memory of 1248	4316	rundll32.exe	92
PID 1248 wrote to memory of 224	1248	chrome.exe	93
PID 1248 wrote to memory of 1792	1248	chrome.exe	94
PID 1248 wrote to memory of 1792	1248	chrome.exe	94
PID 1248 wrote to memory of 1848	1248	chrome.exe	95
PID 1248 wrote to memory of 4496	1248	chrome.exe	96
PID 1248 wrote to memory of 4496	1248	chrome.exe	96
PID 1248 wrote to memory of 4152	1248	chrome.exe	98
PID 1248 wrote to memory of 1640	1248	chrome.exe	99
PID 1248 wrote to memory of 4152	1248	chrome.exe	98
PID 1248 wrote to memory of 1640	1248	chrome.exe	99
PID 1248 wrote to memory of 1576	1248	chrome.exe	100
PID 1248 wrote to memory of 1576	1248	chrome.exe	100
PID 1248 wrote to memory of 4564	1248	chrome.exe	101
PID 1248 wrote to memory of 4564	1248	chrome.exe	101
PID 4316 wrote to memory of 1700	4316	rundll32.exe	103
PID 1700 wrote to memory of 3496	1700	msedge.exe	104
PID 1700 wrote to memory of 784	1700	msedge.exe	105
PID 1700 wrote to memory of 776	1700	msedge.exe	106
PID 1700 wrote to memory of 4568	1700	msedge.exe	107
PID 1700 wrote to memory of 776	1700	msedge.exe	106
PID 1700 wrote to memory of 776	1700	msedge.exe	106
PID 1700 wrote to memory of 4568	1700	msedge.exe	107
PID 1700 wrote to memory of 1332	1700	msedge.exe	109
PID 1700 wrote to memory of 1332	1700	msedge.exe	109
PID 1700 wrote to memory of 1332	1700	msedge.exe	109
PID 1700 wrote to memory of 1888	1700	msedge.exe	110
PID 1700 wrote to memory of 1888	1700	msedge.exe	110
PID 1700 wrote to memory of 1888	1700	msedge.exe	110
PID 1700 wrote to memory of 4312	1700	msedge.exe	111
PID 1700 wrote to memory of 3752	1700	msedge.exe	112
PID 1700 wrote to memory of 4312	1700	msedge.exe	111
PID 1700 wrote to memory of 4312	1700	msedge.exe	111
PID 1700 wrote to memory of 3752	1700	msedge.exe	112
PID 1700 wrote to memory of 3752	1700	msedge.exe	112
PID 1700 wrote to memory of 2416	1700	msedge.exe	114
PID 1700 wrote to memory of 2416	1700	msedge.exe	114
PID 1700 wrote to memory of 4508	1700	msedge.exe	116
PID 1700 wrote to memory of 4508	1700	msedge.exe	116
PID 4856 wrote to memory of 1232	4856	firefox.exe	119
PID 4856 wrote to memory of 1232	4856	firefox.exe	119
PID 1232 wrote to memory of 3292	1232	firefox.exe	120
PID 1232 wrote to memory of 3292	1232	firefox.exe	120
PID 1232 wrote to memory of 3292	1232	firefox.exe	120
PID 1232 wrote to memory of 3292	1232	firefox.exe	120
PID 1232 wrote to memory of 2788	1232	firefox.exe	122
PID 1232 wrote to memory of 2788	1232	firefox.exe	122
PID 1232 wrote to memory of 2788	1232	firefox.exe	122
PID 1232 wrote to memory of 2788	1232	firefox.exe	122
PID 1232 wrote to memory of 644	1232	firefox.exe	123
PID 1232 wrote to memory of 644	1232	firefox.exe	123
PID 1232 wrote to memory of 644	1232	firefox.exe	123
PID 1232 wrote to memory of 1168	1232	firefox.exe	124
PID 1232 wrote to memory of 1168	1232	firefox.exe	124
PID 1232 wrote to memory of 1168	1232	firefox.exe	124
PID 1232 wrote to memory of 1168	1232	firefox.exe	124
PID 1232 wrote to memory of 5520	1232	firefox.exe	125
PID 1232 wrote to memory of 5520	1232	firefox.exe	125
PID 1232 wrote to memory of 5520	1232	firefox.exe	125
PID 1232 wrote to memory of 5520	1232	firefox.exe	125
PID 1232 wrote to memory of 5540	1232	firefox.exe	126
PID 1232 wrote to memory of 5540	1232	firefox.exe	126
PID 1232 wrote to memory of 5540	1232	firefox.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3272
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\webdav_payload.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\webdav_payload.dll,#1
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Badlisted process makes network request
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\2xugk2B9tFub9Bnh\creator-ws.exe
      "C:\Users\Admin\AppData\Local\Temp\2xugk2B9tFub9Bnh\creator-ws.exe"
      4⤵
      Executes dropped EXE
      PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbf784c728,0x7ffbf784c734,0x7ffbf784c740
    3⤵
    PID:224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,5393807776648989779,8854856385103444224,262144 --field-trial-handle=2000,i,10509024947711170854,6995112633656225693,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1996 /prefetch:2
    3⤵
    PID:1792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,10691866489493290999,14602817378131900884,524288 --field-trial-handle=2000,i,10509024947711170854,6995112633656225693,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1592 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,3294010759758286798,5495187978715776528,524288 --field-trial-handle=2000,i,10509024947711170854,6995112633656225693,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2384 /prefetch:8
    3⤵
    PID:4496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,17191117170612835450,6605123415165237839,2097152 --field-trial-handle=2000,i,10509024947711170854,6995112633656225693,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:1
    3⤵
    PID:4152
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,17768822046890982306,3841026365967904180,2097152 --field-trial-handle=2000,i,10509024947711170854,6995112633656225693,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:1640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4240,i,16526308996660353073,11919812336205433628,2097152 --field-trial-handle=2000,i,10509024947711170854,6995112633656225693,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4248 /prefetch:2
    3⤵
    PID:1576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4532,i,4421217432151448784,9906623518232383277,2097152 --field-trial-handle=2000,i,10509024947711170854,6995112633656225693,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4564 /prefetch:1
    3⤵
    PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ffbf3e0c188,0x7ffbf3e0c194,0x7ffbf3e0c1a0
    3⤵
    PID:3496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2056,i,3161280234661034430,1493128717598182559,524288 --field-trial-handle=2044,i,5916061822769434764,17866162081963776420,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
    3⤵
    - System Time Discovery
    PID:784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,15159525743946508481,13994208450951176109,262144 --field-trial-handle=2044,i,5916061822769434764,17866162081963776420,262144 --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:2
    3⤵
    PID:776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,3271450130099612285,7140039451387166152,524288 --field-trial-handle=2044,i,5916061822769434764,17866162081963776420,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:8
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,1002967516295485649,16786292438857247756,2097152 --field-trial-handle=2044,i,5916061822769434764,17866162081963776420,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:1332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,17719335080014331353,4731619618556748470,2097152 --field-trial-handle=2044,i,5916061822769434764,17866162081963776420,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:1888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4088,i,14710703536351607385,2980857192817726248,2097152 --field-trial-handle=2044,i,5916061822769434764,17866162081963776420,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4108,i,15347062959472225514,4896344771706567858,2097152 --field-trial-handle=2044,i,5916061822769434764,17866162081963776420,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:2
    3⤵
    PID:3752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,9736796015120443702,9115604814347398492,524288 --field-trial-handle=2044,i,5916061822769434764,17866162081963776420,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:8
    3⤵
    PID:2416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,4378697152695642557,2793437040046535855,524288 --field-trial-handle=2044,i,5916061822769434764,17866162081963776420,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
    3⤵
    PID:4508
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1232
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2340 -prefsLen 27099 -prefMapHandle 2344 -prefMapSize 270315 -ipcHandle 2424 -initialChannelId {2c6f271c-688f-4b3b-8b22-304fd3cb1003} -parentPid 1232 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1232" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:3292
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3700 -prefsLen 27240 -prefMapHandle 3704 -prefMapSize 270315 -jsInitHandle 3708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3716 -initialChannelId {d084c92b-4346-442d-97c1-564c56140c49} -parentPid 1232 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1232" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:2788
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3884 -prefsLen 27240 -prefMapHandle 3888 -prefMapSize 270315 -ipcHandle 3924 -initialChannelId {1fae2848-250d-43d0-ac2e-34fe32e4caf3} -parentPid 1232 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1232" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:644
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4304 -prefsLen 34739 -prefMapHandle 4312 -prefMapSize 270315 -jsInitHandle 4316 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4324 -initialChannelId {79e60cc7-8af0-4f16-96a8-8d4640b4c6c8} -parentPid 1232 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1232" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:1168
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4968 -prefsLen 34976 -prefMapHandle 4972 -prefMapSize 270315 -ipcHandle 2708 -initialChannelId {56f6d440-9b57-4b2d-8d57-d82f43610a92} -parentPid 1232 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1232" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      Checks processor information in registry
      PID:5520
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5192 -prefsLen 32864 -prefMapHandle 5196 -prefMapSize 270315 -jsInitHandle 5200 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5208 -initialChannelId {db596080-9704-426c-a331-16578e8e8f5d} -parentPid 1232 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1232" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      Checks processor information in registry
      PID:5540
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5224 -prefsLen 32864 -prefMapHandle 5228 -prefMapSize 270315 -jsInitHandle 5232 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5240 -initialChannelId {024017d9-6fcb-489f-9cb1-b83eb13c09f7} -parentPid 1232 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1232" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5548
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5604 -prefsLen 32916 -prefMapHandle 5608 -prefMapSize 270315 -jsInitHandle 5612 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5620 -initialChannelId {3e427e09-e68d-4b3b-99e6-07df9310a3e0} -parentPid 1232 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1232" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 6fe05628a20a86ceccec530e755c72fadf3c598804f750af7084a010525f9f90
MD5 e62a4229a2a6c6a8abb9bf04ea12df53
SHA1 be4dcb09d5f420ed06e1df8e2ac21bec0231b36a
SHA512 c6f6e54d4b74298ecd0b3905efcb81e474e003e7f122bf35c3abba7a38734720acd430fe48a9fc5a2ecfbf2bf2d3a722737ff2a3954770cf3a1ed4c9e211d596
SSDEEP 3072:A+Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Sm7Rkm1tYpBeh2BAog
TLSH
T179C3023B5D75ED3B5CB9A74EB08E0B1E2EF149A6C920DE9288D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 8b36e43232843fb1ca0a21c3344b07b38856ebf257f21ab46a9d549b0c3ebb3d
MD5 17f746a1e16b815f29f47fbfe1bd0e04
SHA1 70444643c16c033c890d0cf51b379e21ca230a63
SHA512 00c05a2bc0221ca19f81599bf311a4bab64f83d9dff7e36467b2313307a50a35175b7c5808b3b4c775c9c7c4ab148ded42c222ccd602d3db07d8cbc621cff13c
SSDEEP 192:P+x3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mx3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1C524640A7B787001EDE3D9725CB080771E3CA16DCF22A6915DB654694EB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a350985e5e5540edb71d3e044d28c275f112f4bd751bbca7f003536b5266cd7a
MD5 b0373e8fe55138a1f11811ff6638c53e
SHA1 f32d4e26afb429d2bdd0b5ccdcaed8f18bf92516
SHA512 8a0c00e34d44feea2dd54c99723d1b50e6f3b34d6390d86ac210c5e9c42d96297431dc46fcac442ccf35316f09248c5ccd2885df3bff1bbd8d14b6228226c1da
SSDEEP 192:MONf64BAQmiUy81DW5GBPKcl+FdGuom1baDe5U6:MONf6eAPNWzd0mSCU6
TLSH
T1C702FA34AC756C7B9EB2BE45F58637175FD8102BA6D45F54EBD82B1C00D724C234682A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 525597d2ac5a7d149284ae79799e57a43edb9f172c89bab66273b8101b9e7419
MD5 50ca97e1f93029cff7620ce8be3fcc5d
SHA1 e8fdda3dae4976b09a745b71ea489833bb2997b7
SHA512 cafd1bd76263b437ddfba67af30d0f383f92abc811865dc5e92c2c9469c4d1876a373c0787806f0a66e3b6e27b3d1f6c2c82dbfbfb94dde2e623534c80fadbf6
SSDEEP 192:AONw64BfQmiUypDK5GBPKcl+FdGuom1YKEMUWwrqJwAU6:AONw6ehgKzd0mEMqdAU6
TLSH
T1D41219306879AC2B5E92B105F4C63753AEE8117BED845F45F7E86B1C04DB39C2B0A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SspiCli.dll

Path C:\Users\Admin\AppData\Local\Temp\2xugk2B9tFub9Bnh\SspiCli.dll
Size 300KB
SHA256 8b1134784d8babc6ef24569abba93e20917679c51cd777de972bdc6fee2fca22
MD5 5368a0eda501b5bd821bb55664d04f6f
SHA1 b43e4c935b2ecda48a88ff79868a41610f029cf4
SHA512 df26d13641892e5ac17951fcca3c4b9a85dd3974622907e32a08c03251fbdf21fdfcdf16a4d6f0b012dc226791a50d8087b52bda9a284fe3a797bb6a11cb0c86
SSDEEP 3072:uksV22GHg8RMkkKht2MST0SwDiANhsXmB/0WHZOVYOPaq0CQlmz3G7d:ukseHHRMkOMST0SwDiANmX+tZ/ZmY
TLSH
T1C564291EF6A548A9DC7AC23DC5478226A7F2B9601352C7CF06508639EE1B7DA2F35F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WTSAPI32.dll

Path C:\Users\Admin\AppData\Local\Temp\2xugk2B9tFub9Bnh\WTSAPI32.dll
Size 174KB
SHA256 19d35e25e3ce431b7ca6b25cb60f19dff9ffbede098bc7762baadf4f6220974b
MD5 62a5d03fddd89c185393ce55152de8d8
SHA1 3c663e4e766475097ad0f64f64ec72fb942695f3
SHA512 08feed176fa20e0355c1e4b04c20aed75fb49372bbba2c3b1199406e016ad21c0a4bdcebfe116555acb11edfb9093c818ff958a9ae819b8b84ff1dff55185858
SSDEEP 3072:18ldGBK2dtlY4uJ+XKUNZIlG4FWvhxDMeWmQBxkfbn+Ro1ql8OCq9s6dez7:1skBK2dPY4uJBUNG3+xo/cbn+Ro4rqwc
TLSH
T1BF044A6E36A900EAE57A9138C562861AFBB37031232117DF0290C17D5F17BE87D3DB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

atom.dll

Path C:\Users\Admin\AppData\Local\Temp\2xugk2B9tFub9Bnh\atom.dll
Size 1.1MB
SHA256 2160f50bcca37cfc1d328664028e1a94617e344fc394928cf64b910405a96252
MD5 971fa397072c9ff81196ebcf46537029
SHA1 a3031836d680c38e89c61c95f05fd86f162ba99f
SHA512 92448ef6e132380bfe0a63ee9e474e12afb83f6a7699fe01d16ea6568b5d00e87c34d7b1db37804e333f08cd62a1f8bd022ddb125f77d624ae4b5c1968378de3
SSDEEP 24576:6+QPQItxXyCtQebcJLJBeRPyOgqBuySsVa:6+KQi+JmRaOgWha
TLSH
T165358C18E2D911A8E577EA38CBA2A132E6B1B4464771B5CF0B99C6051F73DD06B3F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

atom.dll

Path C:\Users\Admin\AppData\Local\Temp\2xugk2B9tFub9Bnh\atom.dll
Size 896KB
SHA256 b1f864ede74ddf42953c9e9548dcafe9805f988c8a636c2645a61d31877b3945
MD5 c1c8090b534a6abb2911d4c5d46b8c8f
SHA1 97b6985b02d20bc815899cc96461297a162f9e55
SHA512 8c3ead2bc2fe4e9b7723ef4b44b756b4297064a408200816569f95deb984f8f2e60186df120d8cd3832eeacbd2efcdcd628bd5b6fb9bfcd8f3cba50a35fc9d80
SSDEEP 12288:65iPPoPQIRzxXyCtQebIti+HpLwy3BeRPyjOAzl7IwgQzV8pnQG8zm07:6+QPQItxXyCtQebcJLJBeRPyOgqBu7
TLSH
T175157B19E29910B8E527D578CB96A233E670B15A0321BADF0BE9C6511FB3DE0573F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

creator-ws.exe

Path C:\Users\Admin\AppData\Local\Temp\2xugk2B9tFub9Bnh\creator-ws.exe
Size 561KB
SHA256 db1abdb2326eb2fd6153ba84f27b20d3ee1ca53a64df1776b3c820aef340de61
MD5 457142f0e24c04ac21fc367182c9e5a4
SHA1 9adc26789c178c72f66309324f0a70060a5b1afe
SHA512 5ec8d8411227071696ffb989867235049bb73d1bdafed25982df36c40159aad3478c0392400551a3d733cad082928f8c4573968a91b4bef3346c385e1050b57d
SSDEEP 6144:/KWYUfInjw6hRObw49+/cPc3F7q/gfMfKzdAnB37e4ObpF22NQy6GW590oaCjLY4:/TEc6mDcWIHBGB3C4+2
TLSH
T183C43B15FF5845E5D093E138D9A68615E3B33CD68B3087CB22A8932E2F33AD55D7A321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

creator-ws.exe

Path C:\Users\Admin\AppData\Local\Temp\2xugk2B9tFub9Bnh\creator-ws.exe
Size 64KB
SHA256 538b8c196f7386dd1a89653f64ea52377f4672bbb1b9f4a4edff2e88fc18386f
MD5 b06377a66161862c09ae15471db7ac8d
SHA1 fd3df9abe200da78deff23a64c28e876385c7f40
SHA512 5ebbf90149dbb135213a1db481c052aa0b9d4a8c5e901673dc9545c29de6b95f1a396569879ab03331f1e00ee112b7c46bb56d47edfede80aa0985699e69c6eb
SSDEEP 1536:1tWGOfkuLbuC5YKMc6vRPUOZZDUwqPamqBl:GLkCZCK4UOYdqz
TLSH
T12F53095B13680069C267E07DD2A68A0AE6B539055BA1BFCFC6708A172F7BFE4557F300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

encoding-conversion.dll

Path C:\Users\Admin\AppData\Local\Temp\2xugk2B9tFub9Bnh\encoding-conversion.dll
Size 23KB
SHA256 685cce3972313dbba027be3d5770cf0c360d165f9d8335529e5bebecbd6dfe27
MD5 e3c35dbbe9c3792b5e5d82f17ce288cf
SHA1 7c205e7d955f7e67809e212dac1d305b75113cf0
SHA512 c154e457dccaaf4e6a58c37892cf820f85a632a1dd08ed71a189b36614a66764a19642331b4ac3c91c61e9a01b229e4b8f082f78c03e805775b524cb2267eb03
SSDEEP 384:VMe9zcdgoGFDJoloh6nYPLpFzDGG5mDFzDGd8JN77hhdxC:VwOoGFSW0EBDGG5mDBDG63hXxC
TLSH
T1DDB24B859F2418A2E997CAB0F0E6D61FAE30B78167A1D2DF427CC1611FC1BC232B915D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\2xugk2B9tFub9Bnh\msvcp140.dll
Size 540KB
SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
MD5 4e3fa9bd90ef020c14359639dc19312b
SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
TLSH
T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

root-service-provider.dll

Path C:\Users\Admin\AppData\Local\Temp\2xugk2B9tFub9Bnh\root-service-provider.dll
Size 850KB
SHA256 f9651a6d5f970604ad5918734f3a41c06274cd0d392cffbad60fafb9def90452
MD5 c68f1ff358d9687f07a24f2740704726
SHA1 ae20ab4677a7e282b2bf96d7e6d644ee071e47de
SHA512 261b164f38808817cd192ffd3dac24920fb98fb0f69de6641726bfe43b95233cf46750f7f5579ffbece95d4a8894d3b17e1089ca55ac627a0b03bb1bf1907451
SSDEEP 12288:F0nkkxXfxAXg2GokubGCgqYWYDZxjRO5s1K6MlkfI:F0nJrAXg2BNblxNYDZxjR9s
TLSH
T18D05B61BBEB951E1C0BAC0399493653EF8B174A29B3157C75291971F1F23BE4AA3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\2xugk2B9tFub9Bnh\vcruntime140.dll
Size 120KB
SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 0d35c5e99871b4f02c490b9fd9dace34
SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
TLSH
T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\2xugk2B9tFub9Bnh\vcruntime140_1.dll
Size 46KB
SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
MD5 03b43160d21c08de07a79d0a1c5ee81d
SHA1 0a449093006af667432b83303614b53b62fc0d05
SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
TLSH
T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 d6101df7c36d635a544aabae990dc6a57e7acdbcf549708e87d19666fb8a8b46
MD5 a447bab25961c7ee8ab49d6f617235e8
SHA1 f229e47bf40aae5954082bc25b9c9f82a1a10ddf
SHA512 5aaf71d2a256b7bfc11bb1692bd9f9ea376c90d9bf6f46e67e76940ef344fedb7339d00383ebe075c661d06293d6723ed61e4f5f61f07881e2fde01807af96e1
SSDEEP 192:xN1d66JozGzgCl6mBM23POv5zbowWqmyjF8w:xrd66JozGzgC1OegbowWqmyjZ
TLSH
T1DED10EA4EA28863FC408023BCCA51B414F36395AEC4E7F2631DD745C2D4729E7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 ac3386774693ce67b5f7a263b4e2a67e46012b05d88977b495bb629357cb8169
MD5 04842133da731610fb759dfbb1ba7404
SHA1 16815f7245efb4bbb39db2146ae16f94d7d7af28
SHA512 a5e20446ccc26722a833fabefe218b4d6505f449cededdbf8d8f0fdf6f2ce29a6a69fd98eba8c5ca469f81682126fb04c4f57de6f60ce2dda2f762c54f5a1ea4
SSDEEP 192:xN1d66JozGzgCl6mBM2gPOv5zboPjsqmyjF8w:xrd66JozGzgC1OdgbobsqmyjZ
TLSH
T1BCE1FEA4EA28863FC408027BCCA61B414F35399ADC4E6F25359D745C2D472DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\events\events
Size 1KB
SHA256 b4b7504eab1518791f6e1dea86c588556e9d4192e844c9dc094c805c4f96590b
MD5 5e49c810b6c9ed86bc932dd94d4cdaf0
SHA1 97179f6f749d94fd8e07cac19fe05d7b508a4acd
SHA512 fde3be1ab576f6cd7114bbc7f448073fac65099a8dadf26d3d2fc84b54223afe14f5225f4044b25e45deb43a544c0ff7acf442e44041c4380d020ac05e64a42c
TLSH
T191115B5C39B84D7AA986E29C7850038EA3914F0A06871D474E52EF8DCED0AD9326E92D
MD5 SHA1 SHA512 TLSH

Submit Download

19ec239a-e737-4a62-be60-bdbeeb55ab63

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\19ec239a-e737-4a62-be60-bdbeeb55ab63
Size 2KB
SHA256 49f79785aa6357ea8a9fa6982bd9cec0f99045fb4b92180eaf5306f493901f1b
MD5 b8e9b32ba747903abed7801793f8d294
SHA1 8b81c7ae25af02b7a9744d8ccf14fd8d6f5afd01
SHA512 15a9922754c9834c6715889069ba7bee6d7e26c637ac111b0ca618cab7c7bb6360fdaed8927fa5672ec5acfba5ad5156b28412bfe38da421684b80d4721224ef
TLSH
T1924153EC3A789C774CABF18DD991339E57604A1350C618833F62EE4C8C96A59336E52B
MD5 SHA1 SHA512 TLSH

Submit Download

1c87e59e-99f3-4281-88ff-46565df84115

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\1c87e59e-99f3-4281-88ff-46565df84115
Size 235B
SHA256 f37b31f277f9f975fcfaa5ee2ccef2876f91ae031c59eb63d54c2197b11a0a9e
MD5 381b168d28684d279fd01d49c8de42b8
SHA1 119dbe340cfcc367029d16c77791bc62b59bc95c
SHA512 a57ada7393ac7808c2bf62831b7321c9910ff380040f509e5b07fe64e1a5da3e3ec8e98070cb985c50a846163453287a576bd58dc845db51517af9166d1126d1
TLSH
T1D7D097C068A8236D08008F02B4E16DC630858C33107C682099A18078E9FDAC44262807
MD5 SHA1 SHA512 TLSH

Submit Download

2c9d2605-10fe-4dbc-8d10-8d29691f16f5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\2c9d2605-10fe-4dbc-8d10-8d29691f16f5
Size 886B
SHA256 a356e5b34824834bdb18bda22c49d0cfd9ba616e8904a11a0871ee08538f9e3f
MD5 0e587323e7a0c3f348f210fb154f3109
SHA1 d47220c8fb7f8be675c26715bccc2dc9d308bf0b
SHA512 93ab48f3aef8939a24f74afbfa4f3ce0698107c10bf1769b0b3a7765c31e9567a8359d075f117bdfb58b6ccbaacc41143171451ad96ba4069793dbe9260d81ba
TLSH
T1791123D18E2479B38C68924BD5F17B434FD53523D0CA54143EA07A280DAA51F976F207
MD5 SHA1 SHA512 TLSH

Submit Download

4e642c6b-abd9-4da6-a8f8-f9ffd5d85d38

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\4e642c6b-abd9-4da6-a8f8-f9ffd5d85d38
Size 16KB
SHA256 76555f5799e4f20c3e1a79c7c2c0e962f74caba3f0b19b8f03b4f48dcc1ff9ec
MD5 950dec0033e3e0abef382ec1a160bda0
SHA1 4fe14751edfaf91d56e39ecdbf84a0dbc3b3c2ea
SHA512 e44c762e46ac27c6002b89ece35f8e88af95cb02967df3fc71f4983bd9c67b52e3402d90c2350ded5a4d7b9cc9061f90efa26f0584619201c464214857bae8ae
SSDEEP 192:8FvU6+GSnlLroX39Db2F6WZps2sTA7JY+ygoN0CNizW6amtkW1XB1jAxlCVsTOU6:avUXG0DBCUzW6amtNUesT7RiceDBSt6
TLSH
T11E72D856686045BB8251E369D4ECBFC3E2F628CF4C419FCADBE47D081DDA06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c09e7f6b-b55f-448c-b85f-1dec1dc8bdde

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\c09e7f6b-b55f-448c-b85f-1dec1dc8bdde
Size 235B
SHA256 91c8fc69e8c55b35254171eceb1c55fbb1cca47bd07893bc3574b9693e7b8c3e
MD5 d8b2dbd6f5e86146eb9c7a6d229be192
SHA1 3ea209f51049ad129fd21a55534ed148ac7850da
SHA512 f3c318bb20dda525d917d89c70b0b4ba69755ab490422fee7aee0b40748c81616ac69234a36f241bb1805ba381fe9e2b72e6473d9663bd7d13421342db0c4ed7
TLSH
T1F5D0978A2498235C08081F07B0E068E630844C3314B0B854EAD085389FF8DD941A2817
MD5 SHA1 SHA512 TLSH

Submit Download

e9fe7877-ae1a-456e-b1b2-f73e11ec0fc4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\e9fe7877-ae1a-456e-b1b2-f73e11ec0fc4
Size 883B
SHA256 efe112b282c8f054ac61e60720d80638b64743c1b43a89cb86a2cdbe166f6ebc
MD5 d043200c78262b8d7ed3c1ffb2ca6b30
SHA1 f724e3177fb576a8bba5868ea1ef4a52b4b3df02
SHA512 ea40cac6f67cb7e8feb80b97c0494694d16dea69a04c0cffca43c7671e37c2482f00a8874e9094cca80904ef4b24c116e3b05a19071f51302b13c6a1a6ca85b2
TLSH
T1EF110082A934BC73CC6C920BC69577525FE4252380CA40243EA169280CBE92E935EA0B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 3088f786381a329b356a67699410154ec61da68c2c646703580b0dcfb56fbd59
MD5 877c20fb830801692e9bbc2beeaf3743
SHA1 efcbd6c3d0c4c90e654d91c03329888fc90197a0
SHA512 c4eb8426ade695b5ca8ba1fa2d9c0c03c90631c0f80095296c98c06cdc83ff72c8cf227431fe7ebd28adfd4afa851be157a8d5cb876a6b64fbf6e0cb0f47cc3e
SSDEEP 96:xHcUTUuqGqdf2oE1zSu8SSlDdv9j1nERH9O+y1Bw88n8L4cnrzBHK:65Rdf2oEuSSQ9A1Bw88+w
TLSH
T1C6E13F7894088F7F74B676ACAC6888716AB2413BBBBF68C750B554C4050CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4316-350-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-889-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-354-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-348-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-0-0x0000000001F60000-0x0000000001F63000-memory.dmp

Download

memory/4316-349-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-194-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-193-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-188-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-146-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-793-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-794-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-836-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-843-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-850-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-856-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-862-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-870-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-876-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-882-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-883-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-356-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-896-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-897-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-906-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-912-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-913-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-920-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-963-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-136-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-100-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-2824-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-57-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-51-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-50-0x0000000075280000-0x00000000755DB000-memory.dmp

Download

memory/4316-47-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-41-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-9-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-8-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-5-0x0000000002270000-0x0000000002320000-memory.dmp

Download

memory/4316-2-0x0000000002270000-0x0000000002320000-memory.dmp

Download