acrstealer | cd598cea811d8f73ca7afffa40e5963be9a82e01bad8ffcebb104b475c091faa

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 08:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
webdav_payload.dll
Size 3.3MB
Sample260810-j321fayxev
SHA256 cd598cea811d8f73ca7afffa40e5963be9a82e01bad8ffcebb104b475c091faa
MD5 543c2c2319b6ac58c75a7c9aca798292
SHA1 958380a31cb33dbf14ba010be64a6a5fb00aa24d
SHA512 1d17ca569504c2a0b1b70d524c3d53ce0870bca2250026a0d630ad0e2df697aecf5adde3c34612992be62e3025e2d235ab871a9330fe81a78b4b2b1b42f4f2df
SSDEEP 24576:knSoKp2ulq70SV0hEqE8XBC808ycu4eWg7VJPmJ9BaSQm3XFK7PB:2sl7Q2yfB
TLSH
T110F5C4E12653E04EFC6841FE1F1BF7542B4E9235A12C535DE520AB88801F7739EADA1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery acrstealer sectoprat persistence rat spyware stealer trojan

Malware Config

Extracted

Family

acrstealer

Version

4.3.1-alpha1

files.orchestratorlabs.cc

Decoy

fastly.net

Attributes

ddrs
https://telegra.ph/Jack-Little-04-18
guids
019fd84c-02e7-7a67-9097-4f73d632de4a

f1575b64-8492-4e8b-b102-4d26e8c70371
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer
Family: SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

Detects ACRStealer V4.x 56 IoCs

resource	yara_rule
behavioral2/memory/4180-1-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-5-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-9-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-41-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-46-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-47-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-88-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-89-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-95-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-344-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-346-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-345-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-348-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-347-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-358-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-360-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-383-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-380-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-387-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-418-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-420-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-851-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-852-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-859-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-860-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-868-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-873-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-881-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-886-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-893-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-899-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-906-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-912-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-922-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-928-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-927-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-935-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-976-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-984-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-1061-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-2848-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-4075-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-4076-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-4094-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-4096-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-4103-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-4119-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-4121-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-4124-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-4132-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-4135-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-4602-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-4603-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-4604-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-4647-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4180-4651-0x00000000038C0000-0x0000000003970000-memory.dmp	family_acrstealer_v3

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4688-3075-0x0000000000400000-0x000000000046C000-memory.dmp	family_sectoprat

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 4180 created 5016	4180	rundll32.exe	82
PID 4180 created 5016	4180	rundll32.exe	82
PID 4180 created 5016	4180	rundll32.exe	82

Badlisted process makes network request 11 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	4180	rundll32.exe
2	4180	rundll32.exe
3	4180	rundll32.exe
137	4180	rundll32.exe
138	4180	rundll32.exe
139	4180	rundll32.exe
140	4180	rundll32.exe
141	4180	rundll32.exe
142	4180	rundll32.exe
143	4180	rundll32.exe
145	4180	rundll32.exe

Executes dropped EXE 2 IoCs

pid	Process
5412	pgocvt.exe
4588	pgocvt.exe

Loads dropped DLL 14 IoCs

pid	Process
5412	pgocvt.exe
5412	pgocvt.exe
5412	pgocvt.exe
5412	pgocvt.exe
5412	pgocvt.exe
5412	pgocvt.exe
5412	pgocvt.exe
4588	pgocvt.exe
4588	pgocvt.exe
4588	pgocvt.exe
4588	pgocvt.exe
4588	pgocvt.exe
4588	pgocvt.exe
4588	pgocvt.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TIEmounter = "cmd /c start \"\" /D \"C:\\ProgramData\\TIEmounter\" pgocvt.exe"	pgocvt.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4180	rundll32.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5412 set thread context of 4688	5412	pgocvt.exe	123
PID 4588 set thread context of 4756	4588	pgocvt.exe	128

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3768	chrome.exe
1488	msedge.exe

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1468	chrome.exe
Token: SeCreatePagefilePrivilege	1468	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
2840	msedge.exe
3996	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 4180	3908	rundll32.exe	89
PID 4180 wrote to memory of 1468	4180	rundll32.exe	90
PID 1468 wrote to memory of 2204	1468	chrome.exe	91
PID 1468 wrote to memory of 4844	1468	chrome.exe	92
PID 1468 wrote to memory of 4844	1468	chrome.exe	92
PID 1468 wrote to memory of 3768	1468	chrome.exe	94
PID 1468 wrote to memory of 4924	1468	chrome.exe	95
PID 1468 wrote to memory of 4924	1468	chrome.exe	95
PID 1468 wrote to memory of 6036	1468	chrome.exe	96
PID 1468 wrote to memory of 6036	1468	chrome.exe	96
PID 1468 wrote to memory of 5368	1468	chrome.exe	97
PID 1468 wrote to memory of 5368	1468	chrome.exe	97
PID 1468 wrote to memory of 2628	1468	chrome.exe	98
PID 1468 wrote to memory of 2628	1468	chrome.exe	98
PID 1468 wrote to memory of 2676	1468	chrome.exe	99
PID 1468 wrote to memory of 2676	1468	chrome.exe	99
PID 4180 wrote to memory of 2840	4180	rundll32.exe	100
PID 2840 wrote to memory of 4104	2840	msedge.exe	101
PID 2840 wrote to memory of 1488	2840	msedge.exe	103
PID 2840 wrote to memory of 3416	2840	msedge.exe	105
PID 2840 wrote to memory of 3416	2840	msedge.exe	105
PID 2840 wrote to memory of 3016	2840	msedge.exe	106
PID 2840 wrote to memory of 3016	2840	msedge.exe	106
PID 2840 wrote to memory of 3016	2840	msedge.exe	106
PID 2840 wrote to memory of 4676	2840	msedge.exe	107
PID 2840 wrote to memory of 4676	2840	msedge.exe	107
PID 2840 wrote to memory of 4676	2840	msedge.exe	107
PID 2840 wrote to memory of 3232	2840	msedge.exe	104
PID 2840 wrote to memory of 3232	2840	msedge.exe	104
PID 2840 wrote to memory of 3232	2840	msedge.exe	104
PID 2840 wrote to memory of 2972	2840	msedge.exe	108
PID 2840 wrote to memory of 2972	2840	msedge.exe	108
PID 2840 wrote to memory of 2972	2840	msedge.exe	108
PID 2840 wrote to memory of 3576	2840	msedge.exe	109
PID 2840 wrote to memory of 3576	2840	msedge.exe	109
PID 2840 wrote to memory of 3576	2840	msedge.exe	109
PID 2840 wrote to memory of 3156	2840	msedge.exe	110
PID 2840 wrote to memory of 3156	2840	msedge.exe	110
PID 2840 wrote to memory of 2584	2840	msedge.exe	111
PID 2840 wrote to memory of 2584	2840	msedge.exe	111
PID 2840 wrote to memory of 1412	2840	msedge.exe	112
PID 2840 wrote to memory of 1412	2840	msedge.exe	112
PID 3532 wrote to memory of 3996	3532	firefox.exe	114
PID 3532 wrote to memory of 3996	3532	firefox.exe	114
PID 3996 wrote to memory of 5732	3996	firefox.exe	115
PID 3996 wrote to memory of 5732	3996	firefox.exe	115
PID 3996 wrote to memory of 5732	3996	firefox.exe	115
PID 3996 wrote to memory of 5732	3996	firefox.exe	115
PID 3996 wrote to memory of 3068	3996	firefox.exe	116
PID 3996 wrote to memory of 3068	3996	firefox.exe	116
PID 3996 wrote to memory of 3068	3996	firefox.exe	116
PID 3996 wrote to memory of 3068	3996	firefox.exe	116
PID 3996 wrote to memory of 3400	3996	firefox.exe	117
PID 3996 wrote to memory of 3400	3996	firefox.exe	117
PID 3996 wrote to memory of 3400	3996	firefox.exe	117
PID 3996 wrote to memory of 5124	3996	firefox.exe	118
PID 3996 wrote to memory of 5124	3996	firefox.exe	118
PID 3996 wrote to memory of 5124	3996	firefox.exe	118
PID 3996 wrote to memory of 5124	3996	firefox.exe	118
PID 4180 wrote to memory of 5412	4180	rundll32.exe	121
PID 5412 wrote to memory of 4688	5412	pgocvt.exe	123
PID 5412 wrote to memory of 4688	5412	pgocvt.exe	123
PID 5412 wrote to memory of 4688	5412	pgocvt.exe	123
PID 5412 wrote to memory of 4688	5412	pgocvt.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:5016
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\webdav_payload.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\webdav_payload.dll,#1
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Badlisted process makes network request
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\qjeako4uLkpa58Ho\pgocvt.exe
      "C:\Users\Admin\AppData\Local\Temp\qjeako4uLkpa58Ho\pgocvt.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:5412
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe"
        5⤵
        
        PID:4688
  - - C:\Windows\SysWOW64\dllhost.exe
      "C:\Windows\SysWOW64\dllhost.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd97dcc728,0x7ffd97dcc734,0x7ffd97dcc740
    3⤵
    PID:2204
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,3169028953056506182,5261922396566989612,262144 --field-trial-handle=1940,i,4401380545499907080,17774912699189285706,262144 --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:2
    3⤵
    PID:4844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1484,i,1328204096460766335,7197171210383958852,524288 --field-trial-handle=1940,i,4401380545499907080,17774912699189285706,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,15231812547908794888,13240669812437052317,524288 --field-trial-handle=1940,i,4401380545499907080,17774912699189285706,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:13
    3⤵
    PID:4924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,12740057481062239797,264372059888395507,2097152 --field-trial-handle=1940,i,4401380545499907080,17774912699189285706,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:6036
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,10372071061786054020,3819205589531800305,2097152 --field-trial-handle=1940,i,4401380545499907080,17774912699189285706,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:5368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4524,i,2914739591746112559,12910798659855600610,2097152 --field-trial-handle=1940,i,4401380545499907080,17774912699189285706,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
    3⤵
    PID:2628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4504,i,5092782248436856820,17989383940042879527,524288 --field-trial-handle=1940,i,4401380545499907080,17774912699189285706,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:14
    3⤵
    PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ffd8e67c188,0x7ffd8e67c194,0x7ffd8e67c1a0
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,3358765564235752804,1737930563955968982,524288 --field-trial-handle=2812,i,16948399515829450875,16754564530817499517,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,18354075870516101231,6639782329839018181,262144 --field-trial-handle=2812,i,16948399515829450875,16754564530817499517,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:2
    3⤵
    PID:3232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,17357554812259353418,7191786697048126813,524288 --field-trial-handle=2812,i,16948399515829450875,16754564530817499517,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:13
    3⤵
    PID:3416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,18300169584898339284,2289398342717794268,2097152 --field-trial-handle=2812,i,16948399515829450875,16754564530817499517,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,10131183707818719271,14740568045360750796,2097152 --field-trial-handle=2812,i,16948399515829450875,16754564530817499517,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4112,i,8077668052779203986,8458952451696442574,2097152 --field-trial-handle=2812,i,16948399515829450875,16754564530817499517,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:9
    3⤵
    PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4100,i,4899657090127128021,7644384478285476138,2097152 --field-trial-handle=2812,i,16948399515829450875,16754564530817499517,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:1
    3⤵
    PID:3576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,4950578539821672681,18009056133040841541,524288 --field-trial-handle=2812,i,16948399515829450875,16754564530817499517,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:14
    3⤵
    PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,13574978935468777844,12252086215638634138,524288 --field-trial-handle=2812,i,16948399515829450875,16754564530817499517,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:14
    3⤵
    PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,16709917940951253798,8850579786814008424,524288 --field-trial-handle=2812,i,16948399515829450875,16754564530817499517,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
    3⤵
    PID:1412
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3996
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2292 -prefsLen 27019 -prefMapHandle 2296 -prefMapSize 270285 -ipcHandle 2360 -initialChannelId {fd235554-f13d-4bff-970c-36fc7bd88e04} -parentPid 3996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:5732
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3680 -prefsLen 27209 -prefMapHandle 3684 -prefMapSize 270285 -jsInitHandle 3688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3696 -initialChannelId {31866a23-e55f-4e72-a279-78317fb92e5b} -parentPid 3996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:3068
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3868 -prefsLen 27209 -prefMapHandle 3872 -prefMapSize 270285 -ipcHandle 3948 -initialChannelId {6a080ee8-0cdb-4a59-bd55-640b30785542} -parentPid 3996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3996" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:3400
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4640 -prefsLen 34708 -prefMapHandle 4648 -prefMapSize 270285 -jsInitHandle 4652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4660 -initialChannelId {ffe6076e-1ae8-4056-91a7-072c2e22f7f9} -parentPid 3996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:5124

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4916

C:\Windows\system32\cmd.exe
"cmd /c start "" /D "C:\ProgramData\TIEmounter" pgocvt.exe"
1⤵
PID:4764
- C:\ProgramData\TIEmounter\pgocvt.exe
  "C:\ProgramData\TIEmounter\pgocvt.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  PID:4588
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe"
    3⤵
    PID:4756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 7f0d061003f5ac6ba80b97884cb9467e5bdb6f2064b0cd8f84a382a970f65510
MD5 bd30d9638d6f177117df4a7404540abe
SHA1 9dc996ce8dac01b26cc4b671be7d10c2a260a268
SHA512 90354a85a6299d9e5b0dfae8a7ad5700165e0ce4488db146b932ba5a3d987fecb3fb406ebac0c3d9dc68a1ae174585c0eb29dd602c20c79fd418382a2310d230
SSDEEP 96:nMC0d+VUJ7oKfVHrSJEYvJVHQRDotok5y9DNB6EGyvP/e+0TZPEOLv4a:MC08UR5rYv3eDUD4Tgae+0TZsOP
TLSH
T162A11973A47A8D7BA976C58571026B43CEB5B07FE521AE90EADC1F0C01E70EC1301523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b07e0e6f-6a33-4cc2-b0a8-a182a9487d7b\index-dir\the-real-index
Size 120B
SHA256 1d70452fd9da9acf971f3c79ffccf0729d761f0f017046c591a1b700c6c1f17b
MD5 e175c26764afda0eb6386a7d1c17bda5
SHA1 44deeda9dd07ed7f2bc89633a638cdb4db40cc6c
SHA512 afd441be9bde1425d94ad7361a041f4d562766e06076e2b8690acdd13b23b9598518256aa43afdd4e8985ead7413ed8ca97d7485496b80842c4c95b4deb8ad76
TLSH
T162B01211CC554C56CD0F1771177F21A4373507EC88110B0710DD204FA4950EB80C5541
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5986ab.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b07e0e6f-6a33-4cc2-b0a8-a182a9487d7b\index-dir\the-real-index~RFe5986ab.TMP
Size 120B
SHA256 0bf94f7e22e7701e8ed5e90580d3417c2c631328989f7a1512934383acfd9371
MD5 5ea44760c395a77decb839958676d1b7
SHA1 ebb9034f258a2f360313b4762a4a02f2d79c3eb9
SHA512 934ef40e8d3c2233918f9e0eeae8966ad5a07b008f970fbd92d93a1193db27880abd577ea48a2667392f3c6741e07731d9c02f920062436f41d3f64df00f66be
TLSH
T14AB0123141904C70CC0A22701167829C33360C280424430720DA045F88614C840C1405
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 769a3eb5e4f91baf54eacfea3aa594d2de7b961d6407012165522c65e4984319
MD5 7905b6971cf61198bbe95dc79cdd5c3c
SHA1 acf6558e10d0cbd5dc41618b784e1aabd29124e8
SHA512 5398f7e446fdc9a685d78a63f9361275c394ac62f781a691c95472931813b62944b8ccd5e47542cfa3f5a783ea346681b06c6b115ca5235e0053866cbf9bde6c
SSDEEP 384:DNrRZyCSDnxTICYMEhIKyll7svbFKfk7:xFZJSDniwyI1l7svbF9
TLSH
T1EC44640A7B747001EDE2D9725CB080771E3CA16E8F22E6815DB654694EB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 35214535a2ee882967de8993865468cd65036fe8e45aefa0d3d00ffc5895ed77
MD5 74a8837c69706f19639306715afdcc65
SHA1 bb80b020ae7b6ac75ce5e4e62519fd8c775c1581
SHA512 9d0f73689d7e434d4ba62fc53bd7b3e0a695fb6fec1b48233af93c7ba99a0a87c0007db94c1dbd989ab096f0a659ba2585d5e200975be714e1244cde46c1dd13
SSDEEP 768:Qrv+4UNbdf3VqG4VD06K48dHeByERRFzjK3YbQeVH1SCj:QbsbJ3QGG+48dHSyw/FQEH1Z
TLSH
T15F03BE71A8A85E774CE7D2897683B617BEF4411382D41BA4C4CD6F4E828B4DC130BE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 3cd2aa7586ec0e7dedf1e08cc71a1db06d67fae73b9b70dad0b5ac40f1a5d9f7
MD5 7e5491d1f5cf59d78d2067cefbfefd5e
SHA1 a1c48045e328d82be8e80857d2acf418802ca55c
SHA512 aec7812257a0e53f7660590ed013bffcca13953a7e99e6b244cf10ddfe4bf80374fcc57a2f0b3c2e55cb5d913fc5979e73e3408c4db45a26d9e78259e4377649
SSDEEP 768:urv+4UNbdf3WqGmKD0U+K48dHeByERRFzjK3JceVH1SCj:ubsbJ3PG/T48dHSyw/FEH1Z
TLSH
T13B03BE70A4A89E734CEBD2897653B797BFF4012385C44BA4D4D9AF4E85860CD170BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\qjeako4uLkpa58Ho\VCRUNTIME140.dll
Size 120KB
SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 0d35c5e99871b4f02c490b9fd9dace34
SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
TLSH
T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mspdbcore.dll

Path C:\Users\Admin\AppData\Local\Temp\qjeako4uLkpa58Ho\mspdbcore.dll
Size 1.3MB
SHA256 c1ee9f10933c623d477287a61ca8256bbff1716cedb079a5df01ec46ef4cdf0c
MD5 72bcdeceac678c2c20571f5ae173a0b0
SHA1 4d2a744fc4705f772fdbdccba7e5c1d6be859f55
SHA512 a19dbb756191482323feac360c7920c81fc82b8328679b3f401dd2f96dcbff2381c57626e99febb107ea8e6a4d023303b04c89c1a1435eb99521bf209e9833f6
SSDEEP 24576:TyZhonc2FQKLXodrgvLVgKVMmG9nGgsGQAq/opZGjlHzXj:T+hT2FJwgv+OAq/opwj
TLSH
T147558D43F2A881ADC57AC078C65B5B1BEBB2784503109BEB42ACCE656F13BE54B7C351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\qjeako4uLkpa58Ho\msvcp140.dll
Size 540KB
SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
MD5 4e3fa9bd90ef020c14359639dc19312b
SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
TLSH
T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pgocvt.exe

Path C:\Users\Admin\AppData\Local\Temp\qjeako4uLkpa58Ho\pgocvt.exe
Size 57KB
SHA256 401d6c25a06df63fbc4e729e6275909e77f67a84ce46e7f1be7116ac8eef2c52
MD5 1bc08e8d5cb0cd3ba8bd9751151eaf67
SHA1 c0e5dc96ed893924790989f321a6fbdfd92c02cb
SHA512 00a11fe01e0f28e07000444931cff82cbfc7ac6aff609ff6bd2a65fe1b41199f97423829885685ac4f365019802a56debe5032bcde76a4c02b4189b0d5c1cf88
SSDEEP 768:i0z1RLpiSz9EVj1JN5kQvVbReK8Wu4JqzpsZ0Z9J0JHwg7bi9zv/:iwt/RY1JF3egu4Jqz+Z0dupOzX
TLSH
T18C43B341A7F80189F5FBAB74A97A55619A37BC9AAD30C31E0358C04D1FA3B909D70B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pgodb140.dll

Path C:\Users\Admin\AppData\Local\Temp\qjeako4uLkpa58Ho\pgodb140.dll
Size 86KB
SHA256 2dcb8bd692b6731fe41881666f8987126f1da87aad2145a54af6d5277e65bf91
MD5 3a0d768b76970066ec2c81d13d24228c
SHA1 14de26807718cc91f55a29d012f7ae40a6f8f051
SHA512 50499b53752a8316509d180ca5bcfa40620b9153b3a624bf68f5a4a77dca4be2fa3c0a53c0bb7772b9f91f8c726f3df846ee50654c893f9a196fd26965faa2a6
SSDEEP 1536:5C+zqGjget3KDhVUhsjvJOIx73Tq5BAj6G0zbZsHcJxDKfNAuA2lz3y:5CJwt6nksT75EuHcfKfNtAKry
TLSH
T15E834B85B6F4819DF1BB663099334A33D777F8995531D30F03A8861E2F67780AD2A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tbbmalloc.dll

Path C:\Users\Admin\AppData\Local\Temp\qjeako4uLkpa58Ho\tbbmalloc.dll
Size 2.4MB
SHA256 8c66696371ab4a2b7203ea88df6c39f4eac45fe20974f3883f2e5d88d8f4a9b1
MD5 5dc6a78d66d91621bb3100979c9b4a0d
SHA1 518c991400fab5ef5849ea92909215cf79d59424
SHA512 6b9ad2b73d43d5799bfd447fd943f1049e5d08c8c212ffa72036bda8721c3b296765cc340ce641679acf169e45d215c2356281aac6ec93ca087d35592d62dfc6
SSDEEP 49152:Gg+1nCONuWWJjhipxPYg+yysegvTqXhiyZM+T7yBjXPvyuspXnB5Bs:GTJxPYg+yysegvTqXhiyZM+T7yBjXPv7
TLSH
T186C5BF55A3C46AD9D017DE39D714B232C2B2B9234B76E0CB5A9AD30A0F76D904F3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\qjeako4uLkpa58Ho\ucrtbase.dll
Size 1.3MB
SHA256 c2ed69b4a1bb9432c75134e813c70539e27c8c1fe96a784d9be78c874e93d9d5
MD5 ef62e9b3d7203f825dbf5dda8d4770c9
SHA1 7f1f99f61082c63a645cea72d41481928b4d19cb
SHA512 cb79d334af2c436cd62d0f4be8ef8f4f89c4590c666125fd26a218426079beadb9da8cc99cdc28fcef6c3574a4941592f85019aa642f71f1e7559f599b75233c
SSDEEP 24576:T9KcgsGAmTfFqSgdDWqNUF3Z7Nkqnjqo3JYj8Jszg8mxvSZX0ypapJDBL:T9KpUmTfFqSgdDPq3DjqI08JXpJD9
TLSH
T15C55AE6176AD01E9C1BFD13DC64B4606E9B2781503708ADB03E94E792E3BBE9177B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\qjeako4uLkpa58Ho\vcruntime140_1.dll
Size 46KB
SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
MD5 03b43160d21c08de07a79d0a1c5ee81d
SHA1 0a449093006af667432b83303614b53b62fc0d05
SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
TLSH
T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 27fffcf0de802494382d55a40f1cc6e789b9edcc34a9f39ee1b38977a04d08ea
MD5 60878c9ed384d02d82b67a8b3a48657f
SHA1 c712de322a6ea2210d1295c0e86fc73a7136ad90
SHA512 065d8e6b5f2d09db02bad5cf0dbd1bc3172fd41defbb781487de956c376349735c6e6af0dbd516e8c81872834eb924ab3c13eef7c495b18828ad104718fb12de
SSDEEP 192:cbr1d66JoztdzgCl6mBM27Ov5zbo8WpRyjtyh:wd66Joz/zgC1ONbo8WpRyj6
TLSH
T177D1DB64EA28863FC404537BCCA61F014E36395B985E3F1531DD65082D5B2DE7A8D2BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 42b6b6600ad601414f09b1a93c7f869a70004e15929fa96bb04c24c466a03102
MD5 f8cb2b204fdcf751ee5285e41d9335df
SHA1 79b75e06af8b577dcb952e4d6e3f30ce6c3388b8
SHA512 d255756f795e4a5c848aaa013c2eae0d2bdbe0424d33b234f5cdce263ca5c288e4389b2320d9e7c0d04a388332d3cc49226adfdddb9e2f9ef24070f5ec9bb5b1
SSDEEP 192:cbC1/66JoztdzgCl6mc0diOv5zbo7z1pRyjjI:5/66Joz/zgC1jDboFpRyjc
TLSH
T154D1CB68F628823BC415023BCCB61F510E75388A989E3F2531DC251D2D572DEBB8E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b5a1355-d05b-490d-81ab-9232be36ba4d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\2b5a1355-d05b-490d-81ab-9232be36ba4d
Size 883B
SHA256 bda038b74fe5e529b544d8dfb631e447b29bf1d2d66b51e46612f63f2d5c1c06
MD5 af32ddddcf27ae7466a0a8fd1456914b
SHA1 9ec05054a798f98006acf626355094724c08d722
SHA512 88c4034c304d3c9af87cc39104ba13fd7d8c59512bca246b5621ef64d6b788fb5726599ef6eacc72fbbf807818c325072457b8b02091b4af8757d08ba2203c82
TLSH
T1F1110081AA30B6B2CD28829FC4553F128BE8782380D900147EA14F084E7E62FD7A674B
MD5 SHA1 SHA512 TLSH

Submit Download

3cb5376d-49d8-47b1-986c-86171205a1f4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\3cb5376d-49d8-47b1-986c-86171205a1f4
Size 235B
SHA256 f35042081f89d9e745830496fab12b635f1885b9bb5fe15bf34e4ff226d03141
MD5 00681148cab16a7d558042460bfe2e80
SHA1 0bae54b435dba39f1d215d5b16ed6889da4a9855
SHA512 7ce55a4c3aede640af49b6778c3e61bd900725bbad5c059fcd954b3e521e90e25ec7c504439e247c9ce5bb32cae51a0162bc93b26cda3981d0451fb5f89343cf
TLSH
T172D0978024982FAC08000F02F0E13DDA31494C3390A59870C55141B4AABA9C841A294F
MD5 SHA1 SHA512 TLSH

Submit Download

f132aeeb-6c3e-46ad-a9a9-f31b8f48c2f1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\f132aeeb-6c3e-46ad-a9a9-f31b8f48c2f1
Size 2KB
SHA256 4b41646925dc69182f3248129133d576a8a06cddd6c91d37872f1f9342a67d34
MD5 9d3b41e6279c09016428ea246c18f8d4
SHA1 0d6f7ebb16e0a10fc0a483a3b60b253985aca867
SHA512 efac59aea54b30215c7d85ad9b4aa8261b3d1ab499973b2ced691522101a10f0008da8657fe146118b985374220f057bb61a4f0645f426d0df07b36a67053312
TLSH
T1E741545C3A744C7A8CCBF69D9082378F97A49D1304C518432D41EF0CCED669E33AA56B
MD5 SHA1 SHA512 TLSH

Submit Download

fc83c232-109b-467d-aee4-c173929827f3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\fc83c232-109b-467d-aee4-c173929827f3
Size 16KB
SHA256 853361e9867d035eba4f7d45af575b3b4e7e8d7a8382e0cc6203837fb4219e07
MD5 db3d994fc3f72514211422d8a4c9d044
SHA1 f4c873314ea36c3d218b216cea8d825f90333c24
SHA512 8d2b44cad376a330d6391af4967f97b083c6814fc3219b58a5437d00324590f3f4320cd8dc343e35bd1419f909d8645ea634a2afc8c5686ad1577ac5b7ca08ee
SSDEEP 192:gWcC8GxE9vVJ8REhi6vzASyyRuSBi1pCvggQHhrgyGN7p72OcAR9mUIH9qTxR5AO:sC8E8vARki6vMSyyRZa1gyWWu6A
TLSH
T13F72DA561820897AC651E36994FC7FC7E6F538CB8C419FCA97E0BE082DDE06E512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\prefs.js
Size 6KB
SHA256 03e20ba8e9068d10ebfca21ff44abd426ebc5d410651b6df9a283916af1646ff
MD5 a4e474c98d3870596c97d7e868a8f2e1
SHA1 cf696d1931db2ec48fd274fb8d5500326d479391
SHA512 36e3c4f835fc6b738bfd781e0a0f7d0d2dcdd10198beb22e84297c00ce6116feccf8e110e46f48925edc39361471aaf2977c28b86bd597a7013b1aa5f0e37cdf
SSDEEP 96:xHBUTU1LqGqTfO1zS9SSlvdv9jqn0H2BoRHHBw88u8L4cnUsF:bsRTfOESSF2BoRBw88H
TLSH
T149E11E785508CB6F74B676ACAC648C316AB2413BBBBF28C750B554C4015CF3882F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\prefs.js
Size 6KB
SHA256 114f2e9b0535c4c4d9cb0ad448bd65ba59f71a2dbf0642cf92e6f098c0276148
MD5 decc773151a4faaeb31372498d4dd245
SHA1 2d93f572a279b17e0f99e7c9554be670ac4cbcda
SHA512 9dd4d31ece77ec3aa97fcb32705f795464bdf21f726cc1c7359b67a7fd3c2b40e9e8962954c9d9e87e6f18911840e81d2f451aab3dd146f89d58bc13999cf8f9
SSDEEP 96:xHBUTU1LqGqTfO1zS69BNSSlvdv9jqn0H2BoRHHBw88u8L4cnUsF:bsRTfO//SSF2BoRBw88H
TLSH
T18AE12F789108CB6F74B6766CAC688C316AB2413BBBBF28C750B554C4015CF3482F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4180-984-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-1061-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-0-0x0000000002C80000-0x0000000002C83000-memory.dmp

Download

memory/4180-469-0x0000000074690000-0x00000000749EB000-memory.dmp

Download

memory/4180-387-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-380-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-383-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-360-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-358-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-347-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-348-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-345-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-346-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-851-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-852-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-344-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-95-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-859-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-860-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-868-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-873-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-881-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-886-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-893-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-899-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-906-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-912-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-922-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-928-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-927-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-418-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-935-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-9-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-976-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-89-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-2848-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-88-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-47-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-46-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-41-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-420-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-5-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-1-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-4651-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-4647-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-4075-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-4604-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-4076-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-4603-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-4602-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-4135-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-4094-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-4096-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-4103-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-4119-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-4121-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-4124-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4180-4132-0x00000000038C0000-0x0000000003970000-memory.dmp

Download

memory/4688-3075-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/4980-4081-0x00000000033E0000-0x00000000039B2000-memory.dmp

Download

memory/4980-4083-0x00000000033E0000-0x00000000039B2000-memory.dmp

Download

memory/4980-4082-0x00000000033E0000-0x00000000039B2000-memory.dmp

Download

memory/4980-4071-0x00000000033E0000-0x00000000039B2000-memory.dmp

Download

memory/4980-4070-0x0000000000A70000-0x0000000000A73000-memory.dmp

Download