acrstealer | b38ceef4eb26aa6d2ccc3e9ef19996830d91b16261cf04768842f028f15e1eeb

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/09/2026, 09:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b38ceef4eb26aa6d2ccc3e9ef19996830d91b16261cf04768842f028f15e1eeb.bin.ps1
Size 1.4MB
Sample260915-ljb11sfl3t
SHA256 b38ceef4eb26aa6d2ccc3e9ef19996830d91b16261cf04768842f028f15e1eeb
MD5 f9de04a40b98f268fc2e52cb5ac7d415
SHA1 88bd700ffdb40c98956766b2b6052679d244eb21
SHA512 515589e1bdbf208b219554d24f700921877fca28db0f24e8525ddb0cb512fdf572ca7ab73f83d8f772ba475ff64db9bc46beaa8f090cb2ceb1818edbc08cc6ce
SSDEEP 12288:5xfe7fdtalBmONbTm7d7Ip+Zj9DWVoxYwNikuC541HI+fqmC+eUpi0Up8sbi5swo:0
TLSH
T1D36510523651FD7D029693B16E1646F0A46ACA80CFDF8556F24DCE8CA14EC863AF93C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution acrstealer persistence spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.3.10-alpha1

mail.novaform.cc

Decoy

fastly.net

Attributes

ddrs
https://telegra.ph/C-Introduction-08-21
guids
f1575b64-8492-4e8b-b102-4d26e8c70371

019fd84c-02e7-7a67-9097-4f73d632de4a
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 4984 created 1548	4984	rundll32.exe	81
PID 4984 created 1548	4984	rundll32.exe	81
PID 4984 created 1548	4984	rundll32.exe	81

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	4984	rundll32.exe
2	4984	rundll32.exe
5	4984	rundll32.exe
6	4984	rundll32.exe
7	4984	rundll32.exe
152	4984	rundll32.exe
153	4984	rundll32.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5940	powershell.exe
3912	PowerShell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1688	chrome.exe
3880	msedge.exe

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134339384415610848"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-696679853-3915825385-3233721679-1000\{94B331E7-B381-4C0B-A431-8B35B791C3E6}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3912	PowerShell.exe
3912	PowerShell.exe
5940	powershell.exe
5940	powershell.exe
5940	powershell.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
4984	rundll32.exe
4984	rundll32.exe
4984	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	3912	PowerShell.exe
Token: SeDebugPrivilege	5940	powershell.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
5516	msedge.exe
2508	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 5940	3912	PowerShell.exe	88
PID 5940 wrote to memory of 4984	5940	powershell.exe	89
PID 5940 wrote to memory of 4984	5940	powershell.exe	89
PID 4984 wrote to memory of 2852	4984	rundll32.exe	91
PID 2852 wrote to memory of 3940	2852	chrome.exe	92
PID 2852 wrote to memory of 1688	2852	chrome.exe	93
PID 2852 wrote to memory of 5020	2852	chrome.exe	94
PID 2852 wrote to memory of 5020	2852	chrome.exe	94
PID 2852 wrote to memory of 4684	2852	chrome.exe	96
PID 2852 wrote to memory of 4684	2852	chrome.exe	96
PID 2852 wrote to memory of 4172	2852	chrome.exe	97
PID 2852 wrote to memory of 4172	2852	chrome.exe	97
PID 2852 wrote to memory of 4116	2852	chrome.exe	98
PID 2852 wrote to memory of 4116	2852	chrome.exe	98
PID 2852 wrote to memory of 248	2852	chrome.exe	99
PID 2852 wrote to memory of 248	2852	chrome.exe	99
PID 2852 wrote to memory of 1472	2852	chrome.exe	100
PID 2852 wrote to memory of 1472	2852	chrome.exe	100
PID 2852 wrote to memory of 4356	2852	chrome.exe	101
PID 2852 wrote to memory of 4748	2852	chrome.exe	102
PID 2852 wrote to memory of 4748	2852	chrome.exe	102
PID 2852 wrote to memory of 5024	2852	chrome.exe	103
PID 2852 wrote to memory of 5024	2852	chrome.exe	103
PID 2852 wrote to memory of 4244	2852	chrome.exe	107
PID 2852 wrote to memory of 4464	2852	chrome.exe	109
PID 2852 wrote to memory of 1448	2852	chrome.exe	108
PID 2852 wrote to memory of 4244	2852	chrome.exe	107
PID 2852 wrote to memory of 1448	2852	chrome.exe	108
PID 2852 wrote to memory of 4464	2852	chrome.exe	109
PID 2852 wrote to memory of 5784	2852	chrome.exe	110
PID 2852 wrote to memory of 5784	2852	chrome.exe	110
PID 2852 wrote to memory of 5516	2852	chrome.exe	118
PID 2852 wrote to memory of 4800	2852	chrome.exe	131
PID 2852 wrote to memory of 5516	2852	chrome.exe	118
PID 2852 wrote to memory of 4800	2852	chrome.exe	131
PID 2852 wrote to memory of 3328	2852	chrome.exe	113
PID 2852 wrote to memory of 3460	2852	chrome.exe	114
PID 2852 wrote to memory of 3328	2852	chrome.exe	113
PID 2852 wrote to memory of 3460	2852	chrome.exe	114
PID 2852 wrote to memory of 5584	2852	chrome.exe	115
PID 2852 wrote to memory of 5584	2852	chrome.exe	115
PID 2852 wrote to memory of 1764	2852	chrome.exe	116
PID 2852 wrote to memory of 1764	2852	chrome.exe	116
PID 2852 wrote to memory of 2788	2852	chrome.exe	117
PID 2852 wrote to memory of 2788	2852	chrome.exe	117
PID 4984 wrote to memory of 5516	4984	rundll32.exe	118
PID 5516 wrote to memory of 5568	5516	msedge.exe	119
PID 5516 wrote to memory of 3880	5516	msedge.exe	120
PID 5516 wrote to memory of 1752	5516	msedge.exe	122
PID 5516 wrote to memory of 1752	5516	msedge.exe	122
PID 5516 wrote to memory of 3156	5516	msedge.exe	125
PID 5516 wrote to memory of 960	5516	msedge.exe	124
PID 5516 wrote to memory of 3156	5516	msedge.exe	125
PID 5516 wrote to memory of 3156	5516	msedge.exe	125
PID 5516 wrote to memory of 960	5516	msedge.exe	124
PID 5516 wrote to memory of 960	5516	msedge.exe	124
PID 5516 wrote to memory of 4232	5516	msedge.exe	121
PID 5516 wrote to memory of 4232	5516	msedge.exe	121
PID 5516 wrote to memory of 4232	5516	msedge.exe	121
PID 5516 wrote to memory of 4600	5516	msedge.exe	126
PID 5516 wrote to memory of 4600	5516	msedge.exe	126
PID 5516 wrote to memory of 4600	5516	msedge.exe	126
PID 5516 wrote to memory of 796	5516	msedge.exe	127
PID 5516 wrote to memory of 796	5516	msedge.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:1548
- C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
  powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\b38ceef4eb26aa6d2ccc3e9ef19996830d91b16261cf04768842f028f15e1eeb.bin.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3912
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\b38ceef4eb26aa6d2ccc3e9ef19996830d91b16261cf04768842f028f15e1eeb.bin.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5940
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Badlisted process makes network request
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:4984
    - - C:\Windows\SysWOW64\dllhost.exe
        
        "C:\Windows\SysWOW64\dllhost.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff412c728,0x7ffff412c734,0x7ffff412c740
    3⤵
    PID:3940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,17588661185000713656,15660679089446240818,524288 --field-trial-handle=2068,i,15036665390445814511,15154752832818529069,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,10899260065305964837,7611677131650241463,262144 --field-trial-handle=2068,i,15036665390445814511,15154752832818529069,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:2
    3⤵
    PID:5020
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,17206885102899746150,13102777627445725596,524288 --field-trial-handle=2068,i,15036665390445814511,15154752832818529069,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:13
    3⤵
    PID:4684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,7872329521417911789,8966553150781518942,2097152 --field-trial-handle=2068,i,15036665390445814511,15154752832818529069,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:4172
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,1105767578344791454,14368521301126374452,2097152 --field-trial-handle=2068,i,15036665390445814511,15154752832818529069,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:4116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4488,i,7023409397236556033,11643725114737820355,2097152 --field-trial-handle=2068,i,15036665390445814511,15154752832818529069,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:1
    3⤵
    PID:248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4724,i,13874391052670563558,15245374980498440887,524288 --field-trial-handle=2068,i,15036665390445814511,15154752832818529069,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:14
    3⤵
    PID:1472
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5292,i,326963850375825802,4794828309921586021,524288 --field-trial-handle=2068,i,15036665390445814511,15154752832818529069,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
    3⤵
    PID:4356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5396,i,315675724110657229,2825976015308857154,2097152 --field-trial-handle=2068,i,15036665390445814511,15154752832818529069,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
    3⤵
    PID:4748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5436,i,13336129802540969679,5564037758240504621,2097152 --field-trial-handle=2068,i,15036665390445814511,15154752832818529069,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
    3⤵
    PID:5024
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5740,i,4308150597513030930,15315421062454080864,2097152 --field-trial-handle=2068,i,15036665390445814511,15154752832818529069,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
    3⤵
    PID:4244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5752,i,10620830337864671825,18159246566760830236,524288 --field-trial-handle=2068,i,15036665390445814511,15154752832818529069,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
    3⤵
    PID:1448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5692,i,2027123865712312843,11168786506511182009,2097152 --field-trial-handle=2068,i,15036665390445814511,15154752832818529069,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
    3⤵
    PID:4464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5892,i,12552216906075296855,16727809246637938822,2097152 --field-trial-handle=2068,i,15036665390445814511,15154752832818529069,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:1
    3⤵
    PID:5784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5476,i,2830913416385964047,6774674966452514658,2097152 --field-trial-handle=2068,i,15036665390445814511,15154752832818529069,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:1
    3⤵
    PID:4800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5656,i,4551983344765879105,15746527310190943885,2097152 --field-trial-handle=2068,i,15036665390445814511,15154752832818529069,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
    3⤵
    PID:5516
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5992,i,1915472233234744515,17246403594491049010,2097152 --field-trial-handle=2068,i,15036665390445814511,15154752832818529069,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:1
    3⤵
    PID:3328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4488,i,1229621454649228484,11441428211908020417,524288 --field-trial-handle=2068,i,15036665390445814511,15154752832818529069,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
    3⤵
    PID:3460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4600,i,15096191493648399084,9543931553216380115,524288 --field-trial-handle=2068,i,15036665390445814511,15154752832818529069,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
    3⤵
    PID:5584
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5492,i,18189434241498319329,6836967447124292103,2097152 --field-trial-handle=2068,i,15036665390445814511,15154752832818529069,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1
    3⤵
    PID:1764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5332,i,5170395669243162878,10150784632326093635,2097152 --field-trial-handle=2068,i,15036665390445814511,15154752832818529069,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:9
    3⤵
    PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7fffe94dc188,0x7fffe94dc194,0x7fffe94dc1a0
    3⤵
    PID:5568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,1529162348699535042,12815683817049645404,524288 --field-trial-handle=2276,i,4206288564750033988,8371844306734125908,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,15670166855470801021,17966269607641878762,262144 --field-trial-handle=2276,i,4206288564750033988,8371844306734125908,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
    3⤵
    PID:4232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,2776695039834171714,6204432916135560513,524288 --field-trial-handle=2276,i,4206288564750033988,8371844306734125908,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:13
    3⤵
    PID:1752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,15887313167794070610,15461801885913719517,2097152 --field-trial-handle=2276,i,4206288564750033988,8371844306734125908,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,3869982882963640957,1023517736917793110,2097152 --field-trial-handle=2276,i,4206288564750033988,8371844306734125908,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,4260451894402744838,435658066024764488,2097152 --field-trial-handle=2276,i,4206288564750033988,8371844306734125908,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4156,i,7172636861887868501,6604666179489844946,2097152 --field-trial-handle=2276,i,4206288564750033988,8371844306734125908,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:9
    3⤵
    PID:796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,1579087879383642554,4770481555428331559,524288 --field-trial-handle=2276,i,4206288564750033988,8371844306734125908,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
    3⤵
    PID:2528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,3677688988008846178,16915283058771045275,524288 --field-trial-handle=2276,i,4206288564750033988,8371844306734125908,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
    3⤵
    PID:2960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,4073726750927678233,13975296147354119621,524288 --field-trial-handle=2276,i,4206288564750033988,8371844306734125908,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
    3⤵
    PID:360
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,12478530723492303263,9683184309473099714,524288 --field-trial-handle=2276,i,4206288564750033988,8371844306734125908,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,12478530723492303263,9683184309473099714,524288 --field-trial-handle=2276,i,4206288564750033988,8371844306734125908,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
    3⤵
    PID:2684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,15232941320088775379,7591099896718240124,524288 --field-trial-handle=2276,i,4206288564750033988,8371844306734125908,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
    3⤵
    PID:3116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,747298811022449674,1785655788965876155,524288 --field-trial-handle=2276,i,4206288564750033988,8371844306734125908,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:14
    3⤵
    PID:4668
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  PID:4184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    PID:2508
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2760 -prefsLen 24445 -prefMapHandle 2764 -prefMapSize 268500 -ipcHandle 2828 -initialChannelId {06cba40e-4861-4714-9208-574edf30c313} -parentPid 2508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:4912
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1920 -prefsLen 24610 -prefMapHandle 1924 -prefMapSize 268500 -jsInitHandle 3608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3616 -initialChannelId {ce8aedd4-c2d3-438d-aa2a-ac46689a4cb3} -parentPid 2508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:3748
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3800 -prefsLen 25493 -prefMapHandle 3804 -prefMapSize 268500 -ipcHandle 3812 -initialChannelId {6023ca86-40c2-4817-9fe9-d511f6dbe8a6} -parentPid 2508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2508" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:2368
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4128 -prefsLen 25603 -prefMapHandle 4132 -prefMapSize 268500 -jsInitHandle 4136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4144 -initialChannelId {34dad17e-7aa5-4110-ada6-8debf60e1e81} -parentPid 2508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:4640

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 9da5c1910258c846dc41bf5c74805dfbe59be2fa7f704e434a447f61fe79a526
MD5 19f763c6d16d6c8fd2db517b1a0a9853
SHA1 163d42c15aec03471abf1a9a4706aa462f3e84d8
SHA512 30f186c1a94f7051f8f0c299e3f1c658c01f3a0c14e84b221cb0cb2d580ff94a6d08f9415cd3efba9072511ab9fe4b15fd2d6d7975c4dee86822056c5095db77
SSDEEP 96:8C6xd+2+07WJ3aJPWyqgfdfrgnRDotok5B4DQB6FJGyvQCl47YMZPE4/Rv4a:8CUd57WJ3aJ+yhYDUDcUS0rYMZsM
TLSH
T139A118B1F4B95D7754FAC985F9023E43DEA8A15BA560EF84D8D90E0E20E74EC0357523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 a6673ce49b12fdcbb7d76835e1b016504a29767f7212d8e801c405cb7104ab24
MD5 ca6c08209c2d38cddd20d85d8c5dc47a
SHA1 cec1cabd103f18062e7cb4e4d6f0d8b419a6c0bd
SHA512 21049ac949a133b2d3655a743fa48fb77fd023763be431c403808d8b8cc86ade7133ad2fd2407bc2f19378bde77d294fb858d77ccfdd369434389ccbd4e515c6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T17AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 91a032a4ffcdd10503afdeb5220904a7e7cea899c3a55606bb3e90180ed9472e
MD5 f04321ebc7aa4a8f91bb5362a6c4c79b
SHA1 c98d3283204e4a0453e416a04c3ae56e4c3feed8
SHA512 c2faa7fae738d85299e6f63b9eaf33c25db5a255ea3f5f6a8551842b7e0cec73c7e8b5e86a9cfb9714287d2b382b57b7249bc70671dbfde2815d5937243570af
TLSH
T1DED02B71F678E8D2C140043C00420920705035061F6801C207034038040324B55012C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 59619e39464102fa53912dd9a15237954c5125d546c48a72b8bdb58ad9eb9753
MD5 f80a0057aa895d42a15b594d07d09f76
SHA1 2478a67794a5362ccf809b7a2c8f64a03c72fa32
SHA512 4a9ec8459a11d9e573883d5eacfd5386cf838bad2bd0b33ff1b37017f5f2cf6bfcef877344a87892e3c49ce624e0cae52791ded1593b8233138de87fd2e5e634
TLSH
T1C6D02B75F668E9D2C140043C00410920706035066F6801C206030038040324B55022C7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6d8c7c8-0232-45cd-9a31-7e9f5d0aa47f\index-dir\the-real-index
Size 168B
SHA256 c4ff6ae20b737c1ec2068f355dbd3a47d89248e12c5fd18bd10024de85907e5a
MD5 d917951b5392b28d0488aedeb5a8d0ea
SHA1 4d49517fe01d06acaf815e7767cb284dabb80437
SHA512 c3f3cb20380dfd3b15681e23c329023f87262a671bdd4a276ec13993e713480f5573d5cc6e4300299a70ec8d88b965d458a58b70b90b32de6a80901003e1677a
TLSH
T1B5C02B149C725040F86687713CBB30300C2034DC0006671B40FFE02DFC556D0F101204
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e64f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6d8c7c8-0232-45cd-9a31-7e9f5d0aa47f\index-dir\the-real-index~RFe59e64f.TMP
Size 168B
SHA256 8cfb9589d15c7dfe7f79267830904dcd4927a1a9b9daabcd32d69702b02becbb
MD5 f3850d302d1b87b8a789646bbad21253
SHA1 36f7a8d998f6c4d134a48185afff30058c37c032
SHA512 21c3d7fb5444112909bf3998564b357968bc120e9a4055ff7cb06178da5bb09f79bc9cf19073f7736648250725a7e624900fe33cb75d7f20288874fc14dd2b66
TLSH
T17BC022A08F22A020F8208BB228FB30302220A8080022222302FBE00EACA2AA0CA00300
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 189b6b6021c96d1055b62b4301318c2ee1ec0ccdb6cfa371342488cb6bc213db
MD5 4c5ca0188e77e7537561927eccf748a0
SHA1 46c050f2ff80a2b903152866ba14f66b5e636f32
SHA512 04cfe925f9834622ff15e504e2b7d495b14b2eea5b94e9fc74e100f16b4359981d02a861cab0bea64a217d811de53f6247bf98a0cd6a7d6f125ab272326ec7fb
SSDEEP 48:KUoIvK1+cTyFxIhKyc8ryJeIfKjys2IN8oG+p:KUowK1+KexGKycCqeIKjyTIN8oG+p
TLSH
T1BB91B420303B1240787F2958A0E4A7EE464175637438EE6F7FD914668E6BE084EFE5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0107befe8c5ae2e3432cdb2af8fc03a7ea13367f8130558bb5723051581ba925
MD5 6dfa98bb4f11a8810d4a46f68ac42cdc
SHA1 b8a9bc24025bd5335bb92d0d07bec5ce00365187
SHA512 3a06989c9d7d74bfebd97d607a2e3f70b8a2669dac054d3eba783b7b52264680c61192dbba5ad2e97eb3f78131333fe36bb26ffaa893581b17d9c7f4a4384523
SSDEEP 768:z/UxvxjgC+b3pdcZ0rfZWMYo8SUBw4Ot5AEl94BHYj/FAFTN/:GZj3+b3QBVa5AEncHYjNAFB/
TLSH
T1E203BF39DCA59927CCF6A785770B3387AEF184A3A5C12ED48DEC2D1E1A8725D134B806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 03d09bdcb2ab42b53d4c4709a8d8e4c6ad07a86e49d7fde4b3e766b799d90268
MD5 14fd87868f037c6158c0fcec0cc85d71
SHA1 e63454c80e2b210e8261edfc6307f52c7df0b97b
SHA512 cd58e29030fc30ef76d12b95f75ee548cc99b9f268c326970dff46e23b88765e5b844a027a23b172b58839e9e0f3761f7e6f6a5cfd2e3dd5f40c050b4e3baf47
TLSH
T1D1215733F3CC8624C89A413650CAAC1136B687DB419ECEAB7B84D154A43F699CE60660
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2852_1918359203\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Public\.ff_tmp\prefs-1.js
Size 4KB
SHA256 8e39263f5309c89dc42851cdb2f388f6e512c38611159b08cd0a9a5019eaab26
MD5 c525291216d360a2a0bc7ada13f01806
SHA1 b513b925e49d739363f4cd1bd447de850b788ec7
SHA512 a4621ee6da9c43faa31044accd63aca6dc9e78097a65b08c849d3956d1c35dabd72d4f0f7ae79140e4969411e0aa568a702c0b4fe67660d25f5e19ce9ba6a2a6
SSDEEP 96:xHaEqGqId0zvJ6ElW9hnfDe8qft1w8hGcnVf:s3RIdC6EqKX1w8hDf
TLSH
T1D7A11F786504CB7F75F6776CACA48C715AB2013BB7BF688610A58485014CF3886E9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 2KB
SHA256 3c80f10df0ef80751defcbfe491a5a4cf413a8fd262ecddf4104a28dd87a1059
MD5 f5ed4a1234f2a6b8cd8eed6a09b72d4b
SHA1 c486c2905289dc7ab0fc27cffe27e5a440e2eb44
SHA512 25fb0be1a7ddd9bdd8884071987b14562a204871074c33fc4767c598e15d8f48a59bd1f459f3801529faeb44d3fc48231225dca01f158f4b9d69b724b78f30ed
TLSH
T16F411DB955048B7FB4F9776CBC184572AE72417BFABF688214B49081010CF3846FAAE7
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 65817420e62c0ed436279d7421773b2d738accab222bd010a37c3c7c35f394f9
MD5 42a097709110cab4924a92e7b36326de
SHA1 7cb8d905bea267354ef34a48228d29c7684afd88
SHA512 4efc57ab67eb5de9ffa6c41750fba7befa226de4b36ea95a0841288c40989ad8f5f63b272b5aebcafeaa01ee3477be3227be2e1d713efd69d4094499cd36badd
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0R7ZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAWe7yh44CfiaR/skL0H7
TLSH
T14F23448D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 360KB
SHA256 80ccd83c25cabb8f3e87535f56599532704024f915e0294be53dd12c0cb04b5b
MD5 f13ed3138652ed384a0522bb510d43b9
SHA1 9f31ab1da17277dae07971b92cb2255b087f8055
SHA512 4fcba1b8ef3bd020871dad26c850199342be10d97c5fd18a71ff0a35e672b2e2f12f3564e2676c558c78c9d8ec22c112624ce9490b8279c8ba65b79725bf87b2
SSDEEP 6144:DaY3p6x38+eHPcHAb3y3Agi4Sq2tbmtPP1IpvN6uai/O:52i/O
TLSH
T11874D7B53094C197C321D83B9B4DB3A7243FD29894E7E68993702748396EA1F7AEC315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3912-13-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp

Download

memory/3912-63-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp

Download

memory/3912-30-0x0000027FDF7A0000-0x0000027FDF7B0000-memory.dmp

Download

memory/3912-25-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp

Download

memory/3912-29-0x0000027FDF7A0000-0x0000027FDF7B0000-memory.dmp

Download

memory/3912-22-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp

Download

memory/3912-0-0x00007FFFED53F000-0x00007FFFED540000-memory.dmp

Download

memory/3912-4-0x0000027FF7DE0000-0x0000027FF7E02000-memory.dmp

Download

memory/3912-3-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp

Download

memory/3912-5-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp

Download

memory/3912-6-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp

Download

memory/3912-7-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp

Download

memory/3912-12-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp

Download

memory/3912-11-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp

Download

memory/3912-10-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp

Download

memory/3912-9-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp

Download

memory/3912-28-0x0000027FDF7A0000-0x0000027FDF7B0000-memory.dmp

Download

memory/3912-8-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp

Download

memory/4640-3772-0x0000000003540000-0x0000000003B12000-memory.dmp

Download

memory/4640-3773-0x0000000003540000-0x0000000003B12000-memory.dmp

Download

memory/4640-3771-0x0000000003540000-0x0000000003B12000-memory.dmp

Download

memory/4640-3767-0x0000000003540000-0x0000000003B12000-memory.dmp

Download

memory/4640-3766-0x00000000012E0000-0x00000000012E3000-memory.dmp

Download

memory/4984-2529-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-2523-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-980-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-981-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-982-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-219-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-1029-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-181-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-168-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-134-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-91-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-87-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-81-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-48-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-4136-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-1909-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-41-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-39-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-38-0x0000000000B90000-0x0000000000BD2000-memory.dmp

Download

memory/4984-4134-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-4132-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-3795-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-3793-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-3794-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-3788-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-3785-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-3781-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-3774-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-3775-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-3530-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-2520-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-979-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-2525-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-2527-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-3495-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-2531-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-2535-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-2576-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-2583-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-2625-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-2711-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-3248-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-3275-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/4984-3470-0x0000000002AA0000-0x0000000002B68000-memory.dmp

Download

memory/5940-26-0x00000000746E2000-0x00000000746E3000-memory.dmp

Download

memory/5940-27-0x00000000746D0000-0x0000000074E8C000-memory.dmp

Download

memory/5940-21-0x0000000005810000-0x0000000005B6B000-memory.dmp

Download

memory/5940-17-0x00000000054B0000-0x0000000005516000-memory.dmp

Download

memory/5940-16-0x0000000004C90000-0x0000000004CB2000-memory.dmp

Download

memory/5940-15-0x0000000004D60000-0x00000000053AA000-memory.dmp

Download

memory/5940-14-0x00000000046D0000-0x0000000004706000-memory.dmp

Download

memory/5940-24-0x0000000005BB0000-0x0000000005BFC000-memory.dmp

Download

memory/5940-23-0x0000000005B70000-0x0000000005B8E000-memory.dmp

Download

memory/5940-18-0x0000000005520000-0x0000000005586000-memory.dmp

Download

memory/5940-31-0x0000000002670000-0x0000000002680000-memory.dmp

Download

memory/5940-32-0x0000000009C10000-0x0000000009CA6000-memory.dmp

Download

memory/5940-33-0x0000000009B30000-0x0000000009B4A000-memory.dmp

Download

memory/5940-34-0x0000000009BA0000-0x0000000009BC2000-memory.dmp

Download

memory/5940-35-0x000000000A510000-0x000000000AACA000-memory.dmp

Download

memory/5940-36-0x000000000B150000-0x000000000B7CC000-memory.dmp

Download

memory/5940-37-0x0000000002670000-0x0000000002680000-memory.dmp

Download

memory/5940-42-0x00000000746D0000-0x0000000074E8C000-memory.dmp

Download