acrstealer | 72208131742dbaf6871f648e297a054c8ad58cd318e4391772cdf4db34989a39

Analysis

max time kernel
298s
max time network
293s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/09/2026, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 10.5MB
Sample260903-pbtsmsgm6v
SHA256 72208131742dbaf6871f648e297a054c8ad58cd318e4391772cdf4db34989a39
MD5 7dbe5a7928c4048d67413510bf15f3b2
SHA1 a6737313438f77142c2ac7c878dd40a31341d52f
SHA512 adf50f9432559b245c5029cbed4c91a8b0783078112a9f5985618ac6054b3f95e1c36b17fd4706c9e8eb01736205ca2e95d2c072e88f2fe7ffd5c6b3b1cff141
SSDEEP 98304:zOPwW4aV15KImMX+wP4UzFmt2a+sBZp5Fre0x7ahqR:GwW4ad6MuwPlz8Lp5Fre0xzR
TLSH
T187B65C6F72A8C12AC16EC27EC1A78F50ED33B0B51736C2FF529052655F12AC49E7E660
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery acrstealer persistence spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.3.8-alpha2

sync.canyonmere.cc

Decoy

cdnjs.cloudflare.com

Attributes

ddrs
https://telegra.ph/C-Introduction-08-21
guids
01a034f4-51c1-7e0e-a650-137d7032a680

f1575b64-8492-4e8b-b102-4d26e8c70371
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Detects ACRStealer V4.x 56 IoCs

resource	yara_rule
behavioral3/memory/4256-0-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-3-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-8-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-7-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-4-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-2-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-38-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-45-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-77-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-83-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-124-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-125-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-130-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-357-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-358-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-359-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-360-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-364-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-365-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-368-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-370-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-454-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-1463-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-1462-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-1466-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-1471-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-1470-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-1475-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-1469-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-1465-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-1513-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-1468-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-1519-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-1520-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-1524-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-1522-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-1528-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-1530-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-1535-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-1534-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-1539-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-1545-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-1548-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-1552-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-1557-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-1585-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-1607-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-1609-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-1644-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-2784-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-2785-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-2787-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-2791-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-2797-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-2799-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral3/memory/4256-3457-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 4256 created 3332	4256	wab.exe	54
PID 4256 created 3332	4256	wab.exe	54
PID 4256 created 3332	4256	wab.exe	54

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	Setup.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4256	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2128 set thread context of 4256	2128	Setup.exe	80

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1720	msedge.exe
1096	chrome.exe
3232	msedge.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329111742434092"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe
4256	wab.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
4256	wab.exe
4256	wab.exe
4256	wab.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
2128	Setup.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4652	msedge.exe
4724	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2128	Setup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 4256	2128	Setup.exe	80
PID 2128 wrote to memory of 4256	2128	Setup.exe	80
PID 2128 wrote to memory of 4256	2128	Setup.exe	80
PID 2128 wrote to memory of 4256	2128	Setup.exe	80
PID 2128 wrote to memory of 4256	2128	Setup.exe	80
PID 2128 wrote to memory of 4256	2128	Setup.exe	80
PID 2128 wrote to memory of 4256	2128	Setup.exe	80
PID 4256 wrote to memory of 4464	4256	wab.exe	81
PID 4464 wrote to memory of 3144	4464	chrome.exe	82
PID 4464 wrote to memory of 1096	4464	chrome.exe	83
PID 4464 wrote to memory of 3236	4464	chrome.exe	84
PID 4464 wrote to memory of 3236	4464	chrome.exe	84
PID 4464 wrote to memory of 3924	4464	chrome.exe	85
PID 4464 wrote to memory of 3924	4464	chrome.exe	85
PID 4464 wrote to memory of 5016	4464	chrome.exe	86
PID 4464 wrote to memory of 5016	4464	chrome.exe	86
PID 4464 wrote to memory of 3388	4464	chrome.exe	87
PID 4464 wrote to memory of 3388	4464	chrome.exe	87
PID 4464 wrote to memory of 3680	4464	chrome.exe	88
PID 4464 wrote to memory of 3680	4464	chrome.exe	88
PID 4464 wrote to memory of 5800	4464	chrome.exe	91
PID 4464 wrote to memory of 5800	4464	chrome.exe	91
PID 4464 wrote to memory of 5540	4464	chrome.exe	92
PID 4256 wrote to memory of 4652	4256	wab.exe	94
PID 4652 wrote to memory of 5404	4652	msedge.exe	95
PID 4652 wrote to memory of 1332	4652	msedge.exe	98
PID 4652 wrote to memory of 3232	4652	msedge.exe	96
PID 4652 wrote to memory of 1332	4652	msedge.exe	98
PID 4652 wrote to memory of 1332	4652	msedge.exe	98
PID 4652 wrote to memory of 5204	4652	msedge.exe	99
PID 4652 wrote to memory of 5204	4652	msedge.exe	99
PID 4652 wrote to memory of 3852	4652	msedge.exe	100
PID 4652 wrote to memory of 4452	4652	msedge.exe	101
PID 4652 wrote to memory of 3852	4652	msedge.exe	100
PID 4652 wrote to memory of 3852	4652	msedge.exe	100
PID 4652 wrote to memory of 4452	4652	msedge.exe	101
PID 4652 wrote to memory of 4452	4652	msedge.exe	101
PID 4652 wrote to memory of 4308	4652	msedge.exe	102
PID 4652 wrote to memory of 4308	4652	msedge.exe	102
PID 4652 wrote to memory of 5200	4652	msedge.exe	103
PID 4652 wrote to memory of 5200	4652	msedge.exe	103
PID 4652 wrote to memory of 2296	4652	msedge.exe	105
PID 4652 wrote to memory of 3340	4652	msedge.exe	106
PID 2296 wrote to memory of 2700	2296	msedge.exe	107
PID 4652 wrote to memory of 3088	4652	msedge.exe	108
PID 3088 wrote to memory of 2940	3088	msedge.exe	109
PID 1116 wrote to memory of 4724	1116	firefox.exe	111
PID 1116 wrote to memory of 4724	1116	firefox.exe	111
PID 5788 wrote to memory of 2664	5788	msedge.exe	114
PID 4724 wrote to memory of 688	4724	firefox.exe	115
PID 4724 wrote to memory of 688	4724	firefox.exe	115
PID 4724 wrote to memory of 688	4724	firefox.exe	115
PID 4724 wrote to memory of 688	4724	firefox.exe	115
PID 5788 wrote to memory of 1720	5788	msedge.exe	116
PID 5788 wrote to memory of 4460	5788	msedge.exe	117
PID 5788 wrote to memory of 3144	5788	msedge.exe	118
PID 5788 wrote to memory of 4460	5788	msedge.exe	117
PID 5788 wrote to memory of 3144	5788	msedge.exe	118
PID 5788 wrote to memory of 3144	5788	msedge.exe	118
PID 4724 wrote to memory of 760	4724	firefox.exe	120
PID 4724 wrote to memory of 760	4724	firefox.exe	120
PID 4724 wrote to memory of 760	4724	firefox.exe	120
PID 4724 wrote to memory of 760	4724	firefox.exe	120
PID 4724 wrote to memory of 2376	4724	firefox.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3332
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Enumerates connected drives
  - Suspicious use of SetThreadContext
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Program Files (x86)\Windows Mail\wab.exe
    "C:\Program Files (x86)\Windows Mail\wab.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4256
  - - C:\Windows\SysWOW64\dllhost.exe
      "C:\Windows\SysWOW64\dllhost.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff217cc728,0x7fff217cc734,0x7fff217cc740
    3⤵
    PID:3144
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1856,i,16911549033289826384,17536098458944120503,524288 --field-trial-handle=2076,i,11782496047657303151,1999197413296943875,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2104 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,2202985235712201218,18034840117611309914,262144 --field-trial-handle=2076,i,11782496047657303151,1999197413296943875,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2072 /prefetch:2
    3⤵
    PID:3236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1840,i,2397511580698705608,10357441842645369484,524288 --field-trial-handle=2076,i,11782496047657303151,1999197413296943875,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2544 /prefetch:13
    3⤵
    PID:3924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,7645880844176727043,9596345850015409019,2097152 --field-trial-handle=2076,i,11782496047657303151,1999197413296943875,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3220 /prefetch:1
    3⤵
    PID:5016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,1989453023883408033,7152636025830997021,2097152 --field-trial-handle=2076,i,11782496047657303151,1999197413296943875,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:3388
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3696,i,11140949496810521140,17314715708916886746,2097152 --field-trial-handle=2076,i,11782496047657303151,1999197413296943875,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4244 /prefetch:9
    3⤵
    PID:3680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4640,i,14782543457765492421,2736950112823195292,2097152 --field-trial-handle=2076,i,11782496047657303151,1999197413296943875,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4648 /prefetch:1
    3⤵
    PID:5800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,8061898661242444336,7388940661627702827,524288 --field-trial-handle=2076,i,11782496047657303151,1999197413296943875,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5420 /prefetch:14
    3⤵
    PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffefb48c188,0x7ffefb48c194,0x7ffefb48c1a0
    3⤵
    PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,3787360863133374560,10353729500511976235,524288 --field-trial-handle=2140,i,9029850829286341430,3157906439990620419,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1520,i,14181488951892507249,3754736103643455332,262144 --field-trial-handle=2140,i,9029850829286341430,3157906439990620419,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:1332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,1129952235852582047,17339427697142672627,524288 --field-trial-handle=2140,i,9029850829286341430,3157906439990620419,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:13
    3⤵
    PID:5204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,10386766743515713155,18311573674694059449,2097152 --field-trial-handle=2140,i,9029850829286341430,3157906439990620419,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,12083414302326464266,12139709719395943716,2097152 --field-trial-handle=2140,i,9029850829286341430,3157906439990620419,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,987123163753591201,10582431379923858248,524288 --field-trial-handle=2140,i,9029850829286341430,3157906439990620419,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,15243905809993568568,9003303889033265642,524288 --field-trial-handle=2140,i,9029850829286341430,3157906439990620419,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14
    3⤵
    PID:5200
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,9422037744311273256,17634366811833400862,524288 --field-trial-handle=2140,i,9029850829286341430,3157906439990620419,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
    3⤵
    PID:3824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,17118789486390974237,15684880839543259338,524288 --field-trial-handle=2140,i,9029850829286341430,3157906439990620419,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:2700
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,9422037744311273256,17634366811833400862,524288 --field-trial-handle=2140,i,9029850829286341430,3157906439990620419,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
    3⤵
    PID:3340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,16115640011766764565,17596885262170941441,524288 --field-trial-handle=2140,i,9029850829286341430,3157906439990620419,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=592
      4⤵
      PID:2940
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4724
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2840 -prefsLen 24445 -prefMapHandle 2844 -prefMapSize 268500 -ipcHandle 2920 -initialChannelId {08092f41-fd94-424f-9494-3fba08c003bc} -parentPid 4724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:688
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3684 -prefsLen 24611 -prefMapHandle 3688 -prefMapSize 268500 -jsInitHandle 3692 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3696 -initialChannelId {c31383ae-5a05-42c8-91ef-74aee6a26e14} -parentPid 4724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:760
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3900 -prefsLen 25494 -prefMapHandle 3904 -prefMapSize 268500 -ipcHandle 3948 -initialChannelId {1c044226-5553-4dd2-bd3f-9c9856ae90db} -parentPid 4724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4724" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:2376
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3836 -prefsLen 25688 -prefMapHandle 3832 -prefMapSize 268500 -jsInitHandle 3828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3692 -initialChannelId {f2ea3632-ba73-4fea-a8f6-1c1180a22747} -parentPid 4724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:3304

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3196

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x2f0,0x7ffefb48c188,0x7ffefb48c194,0x7ffefb48c1a0
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,6031381339509765099,416491172586888974,524288 --field-trial-handle=2116,i,18190987335328764253,16016387302455473932,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2004,i,2359753172973104807,3200847492409814667,524288 --field-trial-handle=2116,i,18190987335328764253,16016387302455473932,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:13
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1500,i,17956364922125344118,3223959897680620410,262144 --field-trial-handle=2116,i,18190987335328764253,16016387302455473932,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:3144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 190e5fc5200e2313df935adf7f74d2936cc86d492fbc4c2f35709d956ef4c9a6
MD5 5fd75a53db01282ba8607d6c1b33e50e
SHA1 1754de122ebc7b6530c54bea07203cfa743e366a
SHA512 193a3c66d23bca4d9a28d47db61078b230d61b02adab0cd20b29b8bae948bfcc92a050b2ae33f395497200f54a278587aecfdd9ff2a45170851615a13aa39b88
TLSH
T117E061A5CD21AC3709FD4729A1104745E750531B3781490F3B3D812D8FF463B8159D1C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 ebac390fe7fe29b2630a8b03e545117c22fbf8acc096f5443993b55dacf5b60c
MD5 3d1a45936ec97380497aae5e7b97d32c
SHA1 51e18e6c8268191dcb344db223134db912caacbb
SHA512 19bf674b3d7dc862666f4ebcfb38a616e9e50ef00f14c0b4f534b484daa487d0e349f034de8b00a743465578da06512f514c76ce05e4d89c37a18cd3f22d895e
SSDEEP 1536:n9ueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6mq:8DFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T101B30212CAAACE9BE5A49C79E4C413F3BEBE5F9523F1B9424166E4023DCE7042395730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 624eaf606d0845d9ef3f81652f29a5b8489b6543deb1e4fd4903c415238ee9d9
MD5 38623c06e100113cf825efa6a44b2386
SHA1 479d8e0c6d7d10c05203a37707a6249d2537a9ed
SHA512 452d7012b949688cabc6afbf4badfe9d02c090f30c06557f7f87b606cd716cda97771136964935eaa4d1668303889011f75ff599a79a6837c285ef84ebc2c8e7
SSDEEP 12:sUXhV0xosfxCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosfxWMk8xVZ4YWI30otWn
TLSH
T1CD257885B34494FFC8C35A7189BE27902774F6DE5F02836B6A377A0E2E271D44B48220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 acd2e75ecd8821f4454b95f25b6238696055d0c89fbd322b8a9938926b5b4a59
MD5 0f5d9a6585a5113efebba87d6fd0bfde
SHA1 cc843c1d26278d967bc193e61985cabc1e7bf632
SHA512 385634179221f2f889a3dfb3838ff4e6e4c3d2d43601ee5bd255940160a8b587f53a02e9ab49f28220099ac3ab24775e0ea43db09eae144f0478f16d4ab0a31c
TLSH
T114D0A7372B1DB4D4E3BD82769722C3811BB6259265434705F304CC1CD9B40C012D2AC7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 32303cc60a61c54695a10e22e5d4927afa9f3b317f38a1948b3d06b9908ad31c
MD5 fa1d2c7d03afb864bc0f0aeb5e1cf53a
SHA1 4193d63e49c8c734df72c75bc3bc68ccfb747550
SHA512 18e675c077e47d9f348de8d1e8289d3e14124bc45c1080067ad25b834aba4faa30eb3894a3408fff992d86eea6faa72110686428608635b48f56f06f7836bca8
TLSH
T12FD012273B0DA054E7A9C2729613C7921BB6646174434B05E315C95CA9B44E412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 22f7cfd488548ff6f2d80e454fa680156ee2f0adb234b7d140a1ade72a14c74f
MD5 c5fee6946c026c2a0fb404c150201f87
SHA1 2c8bd51b5e7ed452903090356aed729e38de8fde
SHA512 c4f063603c181e6139bd9a2bbb5fb612bd76d8f271d1e4364cf516ae9591046dff6ee2f54acefd3c6c7ad53412303da080e942d942481b2aecef99b4f3e8534c
SSDEEP 768:TsM8VWlkKSZXlFu/Icbr7BpsQoqeDhioX:TJ4WlRdAK7Bpsx3ioX
TLSH
T10713A37D62214D1EFAC795FC092B16362739F829D2CB6F0723B2FDD6662235A090E530
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 3c771c7f631ce3da2c54b013d1f80304451c9526a8c5800090c73aa6bd9a4267
MD5 94f7dd0c9bc68038502ff477be788081
SHA1 214839415698ffb5f61155b9be4d7190e7ccc11c
SHA512 b7d0b85835e0da59eae8b04034e34966671fc87040cf67164cdf0c8ed064c9ccd8c1f2155aefb0f8ed341ea2d8667a9d37ae99495360e28ac6c9c5f9177228ce
SSDEEP 6144:KbFV5bGK+mIPfL/yL/SmlL/YL/8L/VL/dL/r5L/iL/M:WFV5bGK+mIPfL/yL/nlL/YL/8L/VL/dd
TLSH
T1BF443BF70911A00BCBA852F5E2033E2EC17B455D7CE1E9E9E6784CD12825F32B6BDA54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 bcd769ceff46ff46f63febdf303b6b1c4724295736bc9c695ab19c2ead27f791
MD5 b2800146b76d8c9b671f1e8852b920a0
SHA1 d54a9236a2be2395dd0dea544993c62a14222391
SHA512 a0c271d684eecabc0b7a4f34a968d9dd7edb57950185ff5a2cf677e0a9aa954bc70d1a5ccffa06a85f3378727f7f1e89fc5929f85e27713deef3ea5d0569c7eb
SSDEEP 6144:TXx5LMrmUnTbc4KQDnInBOfBM+jD6MkFVtz:TB5LMrvTpKQDnqBEBxry
TLSH
T13E253AEECB682C82CE6B8774B0E0D9077E712183B68DC0D39944C5D897D6B8175E92BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 9bc7f0053d5ebe17a5eb11937611a668c4ea478c9f52e4aa150a1ba616aef2dc
MD5 95d636a85cf7799b06446374d399d027
SHA1 fa01e2ae87b3f8ac8e0c03bbfa48858725ae3ef3
SHA512 8a6e7f066c42ac34a39e29a8c87aa7096b6e7e09f8ae3220238de472127df12b5ec4a51989c2d060e9debe7d7f381591c94cddf6fb453aeeb5b6e3ac1ecc53a9
SSDEEP 49152:9mnYdCu9mFAipsbxoOKi7CiE/LLfT/LOd7HzRJoDz:9Y14wpsbR7C9Lv/3
TLSH
T110867DEDCA6898C3CD639970B0F0E9477C7413C3F995C1D68C98C684026B7C5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 372ba384b8fd812900fc182e7b1d428e0009631bc6fc5891ac35c2e35cd7eabb
MD5 57e4f7884fba18183c85ed3bfc459cbd
SHA1 d9166da897e32c73587d65d229af5c361714dc18
SHA512 e6e29b2e878b58097e7b3e29ba365da1c5499bdf4c5004d5f56ddbf66bd93960bd0216d08a5bd9bcd8746c9f52de708ee3f0ffac7751501257817dd2339073c4
TLSH
T1B4E020E874C6C21D59B034C7F2647F0881C97DD2E79E6E071701CCC47643501B341B56
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 3ee90d8939f7561d1aeda02c09cac612d85450074eea23024f5ce8443f188bf6
MD5 0b1947a618b59d81b4967fcebeb07099
SHA1 e5f3c62ccc17190e804a7f64ca3b9779a3d9c2e4
SHA512 66a9a0a572786de5ab560734e02f0f0c8e970b79779984c66c31277979d4454095dbb808fc4c5d706a1907e2325fcf5a554bdf697462608cf784b120b263807a
TLSH
T1CFE0268858ECC9AED06468D7877D670C82E239C3AA8C3E0A270B9C446141649EB8F2E4
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 3KB
SHA256 53c2a7a0d6440223b74fb2a7c5680c76828d0e92316e3db457987e5a0f0c28fd
MD5 ab783a5e09eaf09a14fce52e5780adad
SHA1 caba33a5346d0aef2273c48fb8ff5af57caefac8
SHA512 c69c527bb6e1121bfcaebf6f6c1062fc0ebe1acc89c1aa6b38f6b1e6ce64b4dbbf3c6f5a721be9dcf8a06adf4303dc4b7b6d9e9d97bf3fa82d3846de8ca8400d
TLSH
T126711EFB781D9827C3CA80F94583BEA9C61724BC8FDDEEC8D1BCA0E765552747624016
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 a3da93d8da5515cb50c1b4880deaf35c1deca8d21d6e35af2f623790ba9bc4c6
MD5 9898ce8b9458c1c8dce9de1580f8e6f5
SHA1 91d816eb17c71a392a4ca35c48cbb21bda124577
SHA512 7402419f49f45a63fb12bd1c2835b964c8805b71e48f7b08e8415afc4e8a8b3402234aa9289c8223a2ac17c5ef8f1e7aea80d277c06c362017c4e47aea3f1438
TLSH
T13AE0D8A894EDC1DF6254204B532E7B0CC3F13AC6DA8C2B092B069844B156104AB822E5
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 a5f06431a0387ac5e7480d93cfe6acd189d846d1d2cc0a1f495e392f10eea509
MD5 a468970cd9c89cf0a297618c78a29340
SHA1 871e23a27bd4a7948a81f1f0d5049a5f7964ed02
SHA512 ed226a1eef5f260a14f4d02b35728251abd38448b70802b1e3ae6576ed0254fcb624fd4ffd02f23e9fce8bc19d0318489c6999b7d4cf4c3d821b29217c3c8c60
SSDEEP 96:eIEumQv8m1ccnvS2QcFm+cEbCf5nFXMe5A4g:eIEumQv8m1ccnvS2QcYMh
TLSH
T1AFF2CDFA07236106D98444B0E4016FCFAF16404B47B6B6EC76D447E3F7A20E2B6B9796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 806e7340fccd280cb2a02d3e27cc31bc7302dbc735295c11eb709ccc07acc65c
MD5 4b6a9f7dd90e9fe3feb7edf979be8322
SHA1 9aeb00e0895e176a7bfdbdfc4a29acb84e48d248
SHA512 2c76a73834d6ea35c68960d53d72d2ffc1c554ad2e4f74de9350a183836f818aae70d4c93fa6b69059f2fab52c00a3113a275c54b1a1bc8b68059316d65cd1f7
SSDEEP 192:sxZBRmQDsM7XKTG5GN2ckwwIrpW/W6+WNGY0hGtphgi+IJ:sxZB7DsAXUei26W/bG5Hi+s
TLSH
T1C632D8466E68983B4CC7E61DFA657A53D3F55122A1905E489BFC8B0C04DB6DD230782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 33KB
SHA256 fbf40eb5dbf8f489e5fda16b6b003cf8f59f071925eacaff53a0fcd14bee4590
MD5 eab76c2c80cbe9d593001908c11faa79
SHA1 b4eb1e895d98fbde2cd18b54543e9ac278fe48f5
SHA512 5947eb0c3c0e8f421a570803c0f570d5692f90871336bb0d5ba9d8761620cc347ceac16b2b5792ea003a134cc1cb172e06374ce5d0c809fbd2e1a28a5d0126b6
SSDEEP 768:wpA4q8L02PS7pLuLnvbWRmj1Q3T8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3szZ4LlK:wpA4q8L02PqEnvbWRmj1Q3Tu1jaKszZZ
TLSH
T1EFF2FA3B780CCA7E4FC04A9DED566F8B6EA802CB9698C94047FE855C02C67EE51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\84929e18-7031-4aed-9651-196b2ec11ecb\index-dir\the-real-index
Size 2KB
SHA256 f966aa2cfce698f0fe67c4bfdd43cd16120f2a5cb90eec067c6bf1293e8d152c
MD5 1796bb56ee7f2137f0a7f5a05abcc6b0
SHA1 ef8b35898f0f27fbad133d692e089381bc22990c
SHA512 fb283b7a0b35a53699e43fb4978112f09030c2d3cb66eac2b0090b32beed85c7df4980ecd62e03d241ccb501c892b1c32c4243895e3d9e4671f5c4b88e7937ea
TLSH
T14041B7094D918AAFEC64407304F26CA87338ACEC4791AB67587C12366D0776E298B6FD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5869d1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\84929e18-7031-4aed-9651-196b2ec11ecb\index-dir\the-real-index~RFe5869d1.TMP
Size 2KB
SHA256 56d4f71c4bbd16d7edcc899b2d329556dd79c41750438d835cd331ac64dc6055
MD5 dcf7a888f53cace595995162b324a75e
SHA1 80bd48ed08b858146989921cd528c210f7957d10
SHA512 521f9fb8b3157f52b7303a1ac56caa1648aab858365977e9b05c1c8b448ba22ddf590a84d561a73784d8d32ac5f8e48c5ecf8dc5c9dc0e47236ecf998b3c5ed5
TLSH
T1A641DB8A4EC1CA2EEC9440730DE3B8B87339684087127B5774BC4236AC527EE2E4E0DD
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 320B
SHA256 398b22aee56aefbaef0dfe229f3b6250018874ce4a4a06b7040c2e7a09bee3ba
MD5 4b29af3d42fa1044ca7c93e51d717321
SHA1 485d94f03a1c4f4efff9a52be7f53e54a53b1d16
SHA512 6f1e3384ff4e79e736b14ee4328d1bc63fb83eba13679eb21617b84b5c30a24d357b7d4b480fba9f976cacd6b4535867179d6445606384a922f81bb3ae15242f
TLSH
T13FE0174A0B180323E84612F7689A32D91BE4C80C87EFAACB964FB07D9FD8A482405280
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 adcd5fdca0a8c5bcf61fcc16e9f1c85efbd8b708103843872f1f43f678546e1b
MD5 bcd6e6029567ae23b242b7f68bc2a4ce
SHA1 743382b39c86d22643a6c8c516bf93c7bca310b6
SHA512 55c32a44811ad02598b6f3c032f01d5d1653655616fc5d30daa18e61ea4b4458352a7a002b0db58d63349b47c4bd97303da30d0257bfa5094d25483a5cd86ddc
TLSH
T189E026D45AE8C17F625B204303AA970C82E67E67DACC3E0ABF02CC446182504B2D219A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 9aa0ed04e8d5aeeb11a32ef4f8736a2d42921e44b851195819e52ed56780fbc3
MD5 036f377886e3a39cbb14bc8a9185c7d8
SHA1 10d9e2f696036f07bed1052494e4136f127729f1
SHA512 921152350927f7aede8793eca0c503b63adbb49c0536f0fe27c591931b9e83eb48d3b493e7a17005cdd4cb323c39bab16939b69db1aeb23fec9424be61d4a99b
TLSH
T1B6E0D86467C9C66FA18B20875366F70C81E37962DADC6A19BF0A988462462407793168
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 c83c782a94213faab60bb9c1499fd3c68a58333ae6f11169caa016cff9d7ee69
MD5 1484b8602426e7d391f671ce0ee4d251
SHA1 0414e86744b7da839ea5d91ebec1e7a6c66d08d0
SHA512 bcdc5626f9df862a0ec340f37d013cf789eaebbdceba9f765ecb4608a97063fad712c3b9291560f3b19a9b9368c5319ff92ac9e30f2392fd3e5fc92355ae8ac0
TLSH
T1C9E026F49AE8C63F524B608343AAAB0C82F27E569BCD3B0EEB094844A141100B3E6199
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 da724d5fd513f32e819bad1064ea9fe937006d97cc94bbf21e30655c73984821
MD5 a4504dbc875ba39ee1d06414768025f0
SHA1 594c07233a536dd5e26735b097e456806d50f1cb
SHA512 04111691208fbe0a94fb9cf00339ca654244c00b9b00efab0e959a0e9256886d2509fe5ca38b7fbb63139a3640e1e1a5b3ad2565a52d7cd0fa7a596f5a2da260
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F52:GZLVDJjEDPV0/Zdu3+q
TLSH
T1B3B28E1272BA02023C7D390C92969B674A42F5633469ED7F7BB900B64E67E114EFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 13db021e933328129daf06655396c81899c844fc5b7590c0cab5f0be71ef9d2b
MD5 365025cf040564b2d67e93625c29eef6
SHA1 d6d638b44abd87ae3b1b462d83e8c3db37f75cd6
SHA512 83911e0f5db2dfa136354b34b7207d9314d0599e2cc7d9e247c61c3513ab4792ec01671812c8d2b2517772e0e1ba156072a47a6aa43d797fa938ddf3eb3cc4b1
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5w:GZLVDJjEDPV0/Zdu3x
TLSH
T164A28A1232BA02023C7D390C92969B674A42F5633069ED7F7BB940B64E67E125DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 10KB
SHA256 3080b056259e4516a00e0a81412aa8bc14f2028814fd9fef6bcc7ec2fb0cd94f
MD5 54605074e37a3d69223e9d4abfa5247a
SHA1 e99635a64b41f5ff8e69d23261d6965eb2c0bcef
SHA512 1e0dae54031c912febc402637c9dcc3b35e943804ccd5282e4bfad66c53779f5d03a809ed93f9659b0e799764a5a5d5823ea148cebd171904653cae9fdfb7c0a
SSDEEP 96:6+N89+qvOxZaQgOXUZeDWXWY1lDDseC6AWVylrQEvWWV0tLYBB5N:6+y5Oq5AsylrQEus0tL0B
TLSH
T1D4220E647E021B3BE90E4AF712798FD01BD2D581427766AEB621085D1DE2627C7C82FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 07dc6bc7ba92ad2310fd12dd321dcbcb9612ed7d1b733d1196b8a3acc3fa7842
MD5 a368ccabc358141bc27a0b003b4e33fc
SHA1 0055c6916ba8f50f34c3be0bf597a6ab308fe853
SHA512 e3b85a971c904f0195d248296d7ad7199a331a104582134a0455b129a12f28548c55e1b35ebdffee78679572c6a4e768f139e9b75c24d51d32f05f024a5d18af
TLSH
T11BE02094F4D9C59F60A520C75239570C93D13D83EE9C3E0D2F06C8486442144BF5B1E1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 9a1ad1fcca2de60b3b0e43d5f93b3f26fac1f5893db3ba36b67d79e3b616f62f
MD5 f17768a40e0fbf10f6d89ff2e9295e28
SHA1 d12db065c247bffb1f8cda2e415f6b6fcd813f54
SHA512 06e2215106c47dfc2e0dcd647600dd06db7afe25d8b2dd24ba5e6d1477dce8ce4f8ca2591b489201217a60a5baa3da72b3262a0515fd0553ad71f98fca25f6dd
TLSH
T1A6215E56F320C108E58E823E602B9B751738E8428FBCEC5F40B970352E72E000E8B7E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 cb891b36c4fe0d2f848310031720c9a57936b1b69da100033b605ee32c398cce
MD5 04a2f16a4fceefaf006ec00d070c9bb0
SHA1 f95731079dad8562505f6ab2190f6c563207780a
SHA512 aca3ece8c64af72a1729bbc4a4e7ef18ac21b37bb7d49ac64a3701f01750b8aa22594d7716b1c27194d30d8f5fe5af2dc79b7ef047f6686cdcfc6bf995aed4b4
TLSH
T180E0D864F4D4C1DF506520C30275A78C83E23D92EE982F092F028D4861422457F4F5A1
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 80a89145c2135699c788711f7196a4d5d5a25ba960b4bc8268a5a50818534d9b
MD5 3c4e1a4d6f2359ce3a4344b1dfb93831
SHA1 2798de5f9eca74f350ec6b66dfe0427d74181b7c
SHA512 0fe89eafdaa7ffc029457c325124fd12600e74d968d891d4ce5e38a356faf1a867979f8f0df53a5660de404e604b0395ea0cdbe2c360ec8f06d3c528957b5b8f
SSDEEP 384:n3iF9CcmyWCs38Nx8TUNTUlIxBPm3ek32nn9B8Qps4Jfb8G7vGSMW3r22e4KV8pa:yFccps36wgPKekmUKwGqSa2I8p0t
TLSH
T104B25A31EC68C9BBECE70FD9F74A6A06DEE01223959C99E8DAD85D0D00971DD170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 6ad7ab64a4d4c61954034c6ac6a19b0950373c85b4896b25bdb4e3f8ad1e9428
MD5 77c65ba7cec12259e8acd64fccb9d76e
SHA1 c4e3d1edf06fbef40c2d0ec9ac9a09c550e64b3c
SHA512 98809642201f87a69fd80dc10bc9e0e4702c475c656d136ef457b84df7de8861dcf4d973ac1c397365d3a4f1ac26ec776cd7b39c5862330237747ab05d9888d5
SSDEEP 384:nhiF9CcmyWCs38Ng8TUNTUlIxBPm3ek32nn9E9x4Jfb8G7vGSMW3rEeE4e4KV8pa:IFccps3bwgPKekmu7GqSe4I8p0t
TLSH
T143C26B31E869CDB7ECDA4FD9B78A2642DDE01263998C9EE8DAD84D0C00971DD170F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 87B
SHA256 b20ca4589c8f379b43c13ae0409461361bb90cecb1dee885333c0ee1d066e862
MD5 a34ec9c59051b8fbf03b12c026f7100d
SHA1 2a5424f849994f5d1035666e8773c60ceeeb2e66
SHA512 cb1fbbd5dc88f914a199591b71613a1df81b9150b5fa6933dc3e23b2adefec833b904a986e03508c567bb9781fbd054f68777cda3aaa893802755cd55a8d4521
TLSH
T11BB02447C473C00FF45540D1C45C034114F4C047011DD0015070D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 573KB
SHA256 edc2a572c854afe9093725c2352561cad86cfa538081c21fe95e49cdd2ea989e
MD5 5c92e1527b771317f0d5de7f1dfa3ba5
SHA1 78ed17717cb8b2363bdf04891ce9327da22d9ce7
SHA512 b6040d473dc5a487a6f6599850dad8785d7b621a4b29167047b901ca57b2126302ee07b41570d89b76c9a1745058c4fb73ff7781f21a9d25cf5b84f164889e5c
SSDEEP 12288:BiHVTZ0PuwnimEaldw8Xv7n1I7NvewjaW4ne6om5YescParlCi3tn11XD8R2u:BiH1ZGuoFEal+8f7n1IZGBjpoIPvyrlK
TLSH
T108C402F5F7A07CF3A7BE034A9D85AFAD07664622C74FA08C443B2BC2455372AAF65504
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 1KB
SHA256 c9d1e80a522a15b46265d715996e87e6787832e70ee3085cb4ce2a7b27a68f61
MD5 075b3c13357370691394b785ea9790ee
SHA1 97b84b4b2d8fc125bff362868ecd5fa1e468ca30
SHA512 536fed64cf725b6182e79d94aa03cd2b5b2116ab9ff5446edb0d77181b08803ed686acdf902339091fe5382043ec77f6bbd23cacb3aac8ffa242f1de1b829839
TLSH
T13B117084F728A53AE449C23ACC676B114F306055D48FBF25356CA10C9E2A71A76DD93D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 56161d430c632892e886cceb48030213db5f8b00e1df74c574ae1bfd0f0a401b
MD5 d049a8818f993eebe113abefc62430c9
SHA1 3af1e648566c9bda26ee55d027c47a737ba6ef11
SHA512 a41e798fd376afe5ba77bf2e1c3045b3ef35901a90f44d222830f9397e1a0249f50558b3ed8c5c37f0983502f86b4fdea96d422e94480b80f0b68b515f4def78
SSDEEP 192:qqiJ1d66Joz0dzgCl6mBM2LOv5zbooW+UyjD+:qqiHd66JozQzgC1ONbooW+Uyj
TLSH
T113D1FC64EA28867FC008527BCCA51B050F35399BD84E7F19319C75093D5B2DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Public\.ff_tmp\datareporting\glean\events\events
Size 2KB
SHA256 ab1f5f4ed6a0c07b6868ba5016ab6a173806c2ad7ed02a28abc8a9a612145507
MD5 088711f6abcf1fdbbb51780664c209d3
SHA1 ba5d9f2be5b11b09e78449305b38f8a43e4504f4
SHA512 4d6e592afd680013ff0c42d1956a10beea44765d922ca4756c0efe85e61ea352bdfb686d056caecfd1629bee3f2ce48f113a747aa7ad49dabbe27e5382105612
TLSH
T13251EF1D3BA48DBB9DCBF39CA440428E93690A0784572D836C36EFCDCD856D6311A93C
MD5 SHA1 SHA512 TLSH

Submit Download

0b1acf89-891a-4cbc-98b8-3c048cc18c45

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\0b1acf89-891a-4cbc-98b8-3c048cc18c45
Size 235B
SHA256 7e7552eeaf74eb31f00cb30ae3a956a7d2f03bbdfe2af8dc7e57f1531fc0bcb1
MD5 0caab5c79bf81a12e64b6f8a1acea0ec
SHA1 93125eada7adf46f7dccd6eae0f0b1a4bda59dca
SHA512 ebfce2b43c13ddb8f9c772caa9b4bbd99a80818a0dfd5e4d5473786c01c19c366603038f7282f2c3df22ce0b668081ae9c1694519119556989ed4d6aa0d1394b
TLSH
T1BBD097C02898335C48145F02B0F02DC630644C3364A6982096910338D9B9AC48291C26
MD5 SHA1 SHA512 TLSH

Submit Download

c5ef4106-81d3-4a80-89e9-ba04f23bdc9e

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\c5ef4106-81d3-4a80-89e9-ba04f23bdc9e
Size 796B
SHA256 831ff0e8cab4632cc080ff6f63ab7e827f407e192cc39ff44a929baf4afda5bd
MD5 3bd25765bb1f576fc253cbfeb58dd408
SHA1 6dfad14b74b6bc878c263a22e623a93af0120f66
SHA512 3b4a96a55d78474b35f0f58acb2ac1b02a62d757e774f0d54ea437dbfa7855a506fd416825ba74bd1efcb6bb8bcb3b7427f27bd04a4b5367eed7b5b3950d7f29
TLSH
T18201F641AB3470B25C3C9157C9D23B8907E47823C0DA95083E617E140DB705F6376707
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 4KB
SHA256 302761cd972b359411472c03bb19917c902449c44e7d5b538251638755534506
MD5 4066fd8a63de8d5ba2a6fa869adf8828
SHA1 3b15e6e427d0ca3b21f698bc3ad4a0ed5f6eaace
SHA512 81a31603b95926ceb7a5ab389084df02ed62ff99afa12ad03df9c9ce8a9c1194f5a98547b70d233b73d37c9eaacf1bc75fcf104ee31fcf8b5f451c4805ba1774
SSDEEP 96:xHaEqGqIdLzvt6ElW9hnCFX/m91w8hdcnr7v:s3RIdl6E/J/m91w8hAv
TLSH
T1F0A10F786544CB6F74B5776CBC648C71AAB2027BB77F688610B584C4410CF3886F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 3KB
SHA256 4b26cd140abb4f9d3fe1ea19309c1bad8b2c93f5a2eb695ea67c5dc6db04824e
MD5 e6d621149bd753b6a4a3253c2d27cca3
SHA1 3e328772fdbe6821f58a8d4362633e8d784c49a6
SHA512 41ce9b2ee6e9bc8bdffa39fbac7c9c59059286e1f95625b18f6596e9650017f046607e165b293d12a234aa4fc1d2369b6101ce94c83f5c622c50dc84c63ab720
TLSH
T19071EEB86154CF6F74B9B76CBC658861AAB2017BB77F688210F490C4400CF3856F9AE7
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 1KB
SHA256 8ffb78f3fdcf3ae54d3604506814a22dad735a39d5f325c299acb3c2e68c622e
MD5 5c22c302d1ba356217482ae1d494e142
SHA1 1e2e778bcfee73a186bd2dae96de9ec66763797d
SHA512 9ec10c454c0fa61528da449245d1c556f343f62afe215606374908123c1515356cc7cb8f049d5b71890210c624e1b0c890f0b7ea86c5ec7dcc9d7ee73b02967e
TLSH
T13231BEA529458F7FF0B4766CFC154664D6B3423BB77FAC4224B880858418F3446F69E7
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 a1056ffb74023826edbcad362270dc741102235d54949e60a9b129197fa589d9
MD5 73ae783906c34bd01543f5d331345c0d
SHA1 9a7b065d8f64cee01dba46e520668224a7e92cc2
SHA512 f92166c447ed4eb1ec4293f0e1830098c9a894d4b634068538195fa1c5e26afd8b0c1dab13a8dab101a5634fa31b72b7d52cee9881ffea766949aa1e5d11da73
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0nV23Cfi2f6E2A/2g42cRCH2ZMNXCK7mh980X:Oa16S6CdFAWqV4CfiaR/skZhJ730X
TLSH
T12C23348D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 376KB
SHA256 f099b23414a0e947ee734cf7a44334866f03981dec246bfd25fa93957ed403c4
MD5 08b941979b6985aa75632ceece82920c
SHA1 48ff80315fce3c37f2e5e1ab425eb520e103781c
SHA512 ae6c49284560eff9bf354364e21bcef15a73d48d81d70c5f2612af8bd324f0b71c9d394b7374a496cf8fe3eae17297a3bb532290019e1296884a11e85f4b9c09
SSDEEP 6144:haY3p6x3mcHpeHT+e3y3AI4Sq2tbFtPP1Ipvp6ua3q1:HeBq
TLSH
T1ED84E8A53064C193C322D837DB4DB3B7243FE29894E7E78893701748396EA1FAAD9355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2128-43-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-13-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-2743-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-367-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-5-0x00000240C3230000-0x00000240C3231000-memory.dmp

Download

memory/2128-11-0x000000000100D000-0x000000000100E000-memory.dmp

Download

memory/2128-363-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-12-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-1171-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-14-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-15-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-16-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-529-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-17-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-18-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-19-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-20-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-21-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-22-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-23-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-42-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-41-0x00000240C3230000-0x00000240C3231000-memory.dmp

Download

memory/2128-24-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-36-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-35-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-34-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-33-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-32-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-31-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-30-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-29-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-28-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-27-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-26-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/2128-25-0x0000000000FF0000-0x0000000001B5B000-memory.dmp

Download

memory/4256-1468-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-1528-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-45-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-77-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-83-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-124-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-125-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-130-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-357-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-358-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-359-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-454-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-368-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-360-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-2-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-4-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-7-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-364-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-1463-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-1462-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-8-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-365-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-3-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-1466-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-1471-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-1470-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-1475-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-1469-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-1465-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-1520-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-0-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-38-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-1513-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-1524-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-1522-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-1519-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-1530-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-1535-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-1534-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-1539-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-1545-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-1548-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-1552-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-1557-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-1585-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-1607-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-1609-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-1644-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-370-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-3457-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-2799-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-2797-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-2784-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-2791-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-2787-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4256-2785-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4760-2781-0x00000000038D0000-0x0000000003EA2000-memory.dmp

Download

memory/4760-2783-0x00000000038D0000-0x0000000003EA2000-memory.dmp

Download

memory/4760-2782-0x00000000038D0000-0x0000000003EA2000-memory.dmp

Download

memory/4760-2777-0x00000000038D0000-0x0000000003EA2000-memory.dmp

Download

memory/4760-2776-0x0000000001610000-0x0000000001613000-memory.dmp

Download