acrstealer | ec360687d55a94fb637dec26ffcaa58171b1501437db02d0485f86e1812016ae

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ec360687d55a94fb637dec26ffcaa58171b1501437db02d0485f86e1812016ae.bin.dll
Size 3.5MB
Sample260919-sprf8asdph
SHA256 ec360687d55a94fb637dec26ffcaa58171b1501437db02d0485f86e1812016ae
MD5 fcbc8cdae4a0c5cc0bd5e95b21987a51
SHA1 253f5e4ca4df454ed4d04fde7a3277a6b189a860
SHA512 e0ec0ce54651b2cfd56ce427d27903e51ab28786433c3eda865ab6ab22470519d3d5b5b35e44ed117451758c064c4452c9a6f7b87e1699dded18ce38c5efa604
SSDEEP 49152:H9WJUK/poxbEIscEOwWDgudxkwkDx2t8dKvUsZw7ilXsZWcalJHm0HPa4HrG9ewb:W
TLSH
T10506D6662D52782BD3FD32BC148B2F17B8BD7D6365F41CAA419409A478D2C79C2CBD0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution acrstealer persistence spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.3.1-alpha1

health.winnererasable.cc

Decoy

cloudflare.com

Attributes

ddrs
https://telegra.ph/Built-in-Types-08-01
guids
019fd851-d0e2-7805-ae09-2dd1daa78960

f1575b64-8492-4e8b-b102-4d26e8c70371
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Detects ACRStealer V4.x 57 IoCs

resource	yara_rule
behavioral2/memory/3552-1-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-5-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-9-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-41-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-46-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-47-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-88-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-105-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-147-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-185-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-206-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-243-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-248-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-395-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-396-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-397-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-400-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-404-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-468-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-466-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-931-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-932-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-937-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-938-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-940-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-943-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-945-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-947-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-946-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-949-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-951-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-957-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-964-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-969-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-970-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-972-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-974-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-976-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-980-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-984-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-982-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-988-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-996-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-995-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-1002-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-1004-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-1009-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-1052-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-1411-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-2627-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-2628-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-2666-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-2673-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-2677-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-2679-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-2680-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3552-2729-0x0000000003700000-0x00000000037BC000-memory.dmp	family_acrstealer_v3

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 3552 created 5700	3552	rundll32.exe	81
PID 3552 created 5700	3552	rundll32.exe	81
PID 3552 created 5700	3552	rundll32.exe	81

Badlisted process makes network request 12 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	3552	rundll32.exe
2	3552	rundll32.exe
3	3552	rundll32.exe
4	3552	rundll32.exe
5	3552	rundll32.exe
6	3552	rundll32.exe
133	3552	rundll32.exe
134	3552	rundll32.exe
136	3552	rundll32.exe
137	3552	rundll32.exe
140	3552	rundll32.exe
142	3552	rundll32.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3552	rundll32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4672	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5704	chrome.exe
4364	msedge.exe

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
3552	rundll32.exe
3552	rundll32.exe
3552	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3360	chrome.exe
Token: SeCreatePagefilePrivilege	3360	chrome.exe
Token: SeShutdownPrivilege	3360	chrome.exe
Token: SeCreatePagefilePrivilege	3360	chrome.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeIncreaseQuotaPrivilege	4672	powershell.exe
Token: SeSecurityPrivilege	4672	powershell.exe
Token: SeTakeOwnershipPrivilege	4672	powershell.exe
Token: SeLoadDriverPrivilege	4672	powershell.exe
Token: SeSystemProfilePrivilege	4672	powershell.exe
Token: SeSystemtimePrivilege	4672	powershell.exe
Token: SeProfSingleProcessPrivilege	4672	powershell.exe
Token: SeIncBasePriorityPrivilege	4672	powershell.exe
Token: SeCreatePagefilePrivilege	4672	powershell.exe
Token: SeBackupPrivilege	4672	powershell.exe
Token: SeRestorePrivilege	4672	powershell.exe
Token: SeShutdownPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeSystemEnvironmentPrivilege	4672	powershell.exe
Token: SeRemoteShutdownPrivilege	4672	powershell.exe
Token: SeUndockPrivilege	4672	powershell.exe
Token: SeManageVolumePrivilege	4672	powershell.exe
Token: 33	4672	powershell.exe
Token: 34	4672	powershell.exe
Token: 35	4672	powershell.exe
Token: 36	4672	powershell.exe
Token: SeIncreaseQuotaPrivilege	4672	powershell.exe
Token: SeSecurityPrivilege	4672	powershell.exe
Token: SeTakeOwnershipPrivilege	4672	powershell.exe
Token: SeLoadDriverPrivilege	4672	powershell.exe
Token: SeSystemProfilePrivilege	4672	powershell.exe
Token: SeSystemtimePrivilege	4672	powershell.exe
Token: SeProfSingleProcessPrivilege	4672	powershell.exe
Token: SeIncBasePriorityPrivilege	4672	powershell.exe
Token: SeCreatePagefilePrivilege	4672	powershell.exe
Token: SeBackupPrivilege	4672	powershell.exe
Token: SeRestorePrivilege	4672	powershell.exe
Token: SeShutdownPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeSystemEnvironmentPrivilege	4672	powershell.exe
Token: SeRemoteShutdownPrivilege	4672	powershell.exe
Token: SeUndockPrivilege	4672	powershell.exe
Token: SeManageVolumePrivilege	4672	powershell.exe
Token: 33	4672	powershell.exe
Token: 34	4672	powershell.exe
Token: 35	4672	powershell.exe
Token: 36	4672	powershell.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
3360	chrome.exe
1108	msedge.exe
2524	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 3552	4408	rundll32.exe	89
PID 3552 wrote to memory of 3360	3552	rundll32.exe	90
PID 3360 wrote to memory of 3468	3360	chrome.exe	91
PID 3360 wrote to memory of 5204	3360	chrome.exe	92
PID 3360 wrote to memory of 5704	3360	chrome.exe	93
PID 3360 wrote to memory of 5204	3360	chrome.exe	92
PID 3360 wrote to memory of 3600	3360	chrome.exe	96
PID 3360 wrote to memory of 4740	3360	chrome.exe	95
PID 3360 wrote to memory of 3600	3360	chrome.exe	96
PID 3360 wrote to memory of 4740	3360	chrome.exe	95
PID 3360 wrote to memory of 3804	3360	chrome.exe	97
PID 3360 wrote to memory of 3804	3360	chrome.exe	97
PID 3360 wrote to memory of 1552	3360	chrome.exe	98
PID 3360 wrote to memory of 1552	3360	chrome.exe	98
PID 3360 wrote to memory of 2732	3360	chrome.exe	99
PID 3360 wrote to memory of 2732	3360	chrome.exe	99
PID 3552 wrote to memory of 1108	3552	rundll32.exe	100
PID 1108 wrote to memory of 1236	1108	msedge.exe	101
PID 1108 wrote to memory of 5540	1108	msedge.exe	102
PID 1108 wrote to memory of 4364	1108	msedge.exe	103
PID 1108 wrote to memory of 5540	1108	msedge.exe	102
PID 1108 wrote to memory of 5540	1108	msedge.exe	102
PID 1108 wrote to memory of 776	1108	msedge.exe	104
PID 1108 wrote to memory of 776	1108	msedge.exe	104
PID 1108 wrote to memory of 5552	1108	msedge.exe	106
PID 1108 wrote to memory of 5520	1108	msedge.exe	107
PID 1108 wrote to memory of 5552	1108	msedge.exe	106
PID 1108 wrote to memory of 5552	1108	msedge.exe	106
PID 1108 wrote to memory of 5520	1108	msedge.exe	107
PID 1108 wrote to memory of 5520	1108	msedge.exe	107
PID 1108 wrote to memory of 1420	1108	msedge.exe	108
PID 1108 wrote to memory of 3996	1108	msedge.exe	109
PID 1108 wrote to memory of 1420	1108	msedge.exe	108
PID 1108 wrote to memory of 1420	1108	msedge.exe	108
PID 1108 wrote to memory of 3996	1108	msedge.exe	109
PID 1108 wrote to memory of 3996	1108	msedge.exe	109
PID 1108 wrote to memory of 4728	1108	msedge.exe	110
PID 1108 wrote to memory of 4728	1108	msedge.exe	110
PID 1108 wrote to memory of 2460	1108	msedge.exe	111
PID 1108 wrote to memory of 5012	1108	msedge.exe	112
PID 1108 wrote to memory of 2460	1108	msedge.exe	111
PID 1108 wrote to memory of 5012	1108	msedge.exe	112
PID 3280 wrote to memory of 2524	3280	firefox.exe	114
PID 3280 wrote to memory of 2524	3280	firefox.exe	114
PID 2524 wrote to memory of 5932	2524	firefox.exe	115
PID 2524 wrote to memory of 5932	2524	firefox.exe	115
PID 2524 wrote to memory of 5932	2524	firefox.exe	115
PID 2524 wrote to memory of 5932	2524	firefox.exe	115
PID 2524 wrote to memory of 456	2524	firefox.exe	116
PID 2524 wrote to memory of 456	2524	firefox.exe	116
PID 2524 wrote to memory of 456	2524	firefox.exe	116
PID 2524 wrote to memory of 456	2524	firefox.exe	116
PID 2524 wrote to memory of 1496	2524	firefox.exe	117
PID 2524 wrote to memory of 1496	2524	firefox.exe	117
PID 2524 wrote to memory of 1496	2524	firefox.exe	117
PID 2524 wrote to memory of 4552	2524	firefox.exe	118
PID 2524 wrote to memory of 4552	2524	firefox.exe	118
PID 2524 wrote to memory of 4552	2524	firefox.exe	118
PID 2524 wrote to memory of 4552	2524	firefox.exe	118
PID 2524 wrote to memory of 4124	2524	firefox.exe	119
PID 2524 wrote to memory of 4124	2524	firefox.exe	119
PID 2524 wrote to memory of 4124	2524	firefox.exe	119
PID 2524 wrote to memory of 4124	2524	firefox.exe	119
PID 2524 wrote to memory of 3304	2524	firefox.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:5700
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec360687d55a94fb637dec26ffcaa58171b1501437db02d0485f86e1812016ae.bin.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec360687d55a94fb637dec26ffcaa58171b1501437db02d0485f86e1812016ae.bin.dll,#1
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Badlisted process makes network request
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:3552
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command -
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4672
  - - C:\Windows\SysWOW64\dllhost.exe
      "C:\Windows\SysWOW64\dllhost.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe0afec728,0x7ffe0afec734,0x7ffe0afec740
    3⤵
    PID:3468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,17009073634676362527,5381886408409040336,262144 --field-trial-handle=1912,i,11192824820838445194,2487265249429330751,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
    3⤵
    PID:5204
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1488,i,8378648076339939237,16840299700443730009,524288 --field-trial-handle=1912,i,11192824820838445194,2487265249429330751,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3056,i,4006805440717109122,14750390259547531051,2097152 --field-trial-handle=1912,i,11192824820838445194,2487265249429330751,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:1
    3⤵
    PID:4740
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3076,i,11115421584787690131,13677507707996438426,2097152 --field-trial-handle=1912,i,11192824820838445194,2487265249429330751,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:1
    3⤵
    PID:3600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,12338888478577016998,9327161682271893246,524288 --field-trial-handle=1912,i,11192824820838445194,2487265249429330751,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:13
    3⤵
    PID:3804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4528,i,12661284984217646260,15072459057970841069,2097152 --field-trial-handle=1912,i,11192824820838445194,2487265249429330751,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:1
    3⤵
    PID:1552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4692,i,15174588436210961052,11116987162713938918,524288 --field-trial-handle=1912,i,11192824820838445194,2487265249429330751,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:14
    3⤵
    PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffe034cc188,0x7ffe034cc194,0x7ffe034cc1a0
    3⤵
    PID:1236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,14776703626730376894,518444210545089167,262144 --field-trial-handle=2476,i,7921307242607565261,477041881007828342,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:2
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,12768925534608072806,9318132766332233029,524288 --field-trial-handle=2476,i,7921307242607565261,477041881007828342,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,18303874308915010088,10381027674537295617,524288 --field-trial-handle=2476,i,7921307242607565261,477041881007828342,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:13
    3⤵
    PID:776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,11022696767955022349,17016571295161660561,2097152 --field-trial-handle=2476,i,7921307242607565261,477041881007828342,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:5552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,17344665348252423130,1955380629994413315,2097152 --field-trial-handle=2476,i,7921307242607565261,477041881007828342,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:5520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,10290942244460835593,4693846430053419693,2097152 --field-trial-handle=2476,i,7921307242607565261,477041881007828342,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:1
    3⤵
    PID:1420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4076,i,18165645390649464134,8541327975452747707,2097152 --field-trial-handle=2476,i,7921307242607565261,477041881007828342,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:9
    3⤵
    PID:3996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,6995784633870080893,6049422780381010799,524288 --field-trial-handle=2476,i,7921307242607565261,477041881007828342,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,10065277030304589295,5834204536303685711,524288 --field-trial-handle=2476,i,7921307242607565261,477041881007828342,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,3651959025114510563,15297395279074472140,524288 --field-trial-handle=2476,i,7921307242607565261,477041881007828342,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
    3⤵
    PID:5012
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2524
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2292 -prefsLen 27097 -prefMapHandle 2296 -prefMapSize 270315 -ipcHandle 2376 -initialChannelId {41219193-e35d-4da5-9e03-5302742a42b2} -parentPid 2524 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2524" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:5932
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3720 -prefsLen 27238 -prefMapHandle 3724 -prefMapSize 270315 -jsInitHandle 3728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3672 -initialChannelId {70b7572c-1932-40a4-8f52-c1823cfa6dc3} -parentPid 2524 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2524" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:456
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3896 -prefsLen 27238 -prefMapHandle 3900 -prefMapSize 270315 -ipcHandle 3956 -initialChannelId {b1522bbd-1638-4a0e-a20a-0a81fec0e079} -parentPid 2524 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2524" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:1496
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3212 -prefsLen 34786 -prefMapHandle 3096 -prefMapSize 270315 -jsInitHandle 3128 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4468 -initialChannelId {e91efadc-f7e7-4cdc-b6c2-61a3dd561ee4} -parentPid 2524 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2524" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:4552
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5012 -prefsLen 34974 -prefMapHandle 5000 -prefMapSize 270315 -ipcHandle 1612 -initialChannelId {40fe1ef5-d1d2-434e-ad2b-fad205cb3069} -parentPid 2524 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2524" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      Checks processor information in registry
      PID:4124
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5140 -prefsLen 32864 -prefMapHandle 5144 -prefMapSize 270315 -jsInitHandle 5148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5156 -initialChannelId {12a6d528-b6e5-4854-9611-3375d0119bf5} -parentPid 2524 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2524" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      PID:3304
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5196 -prefsLen 32864 -prefMapHandle 5200 -prefMapSize 270315 -jsInitHandle 5204 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5212 -initialChannelId {eb3c2790-a2b6-407f-91e8-3fc8ace50014} -parentPid 2524 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2524" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:1508

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4176

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 0a567bc99c19d9b496f3e86f84b2d046d3331cd08c3ddbaf84717a517634a13c
MD5 59456cbf2bde0106e25c49d2dfaa4cbf
SHA1 884e839180d6cea56960d10e72133580981f679b
SHA512 9a6fa64b0f59bec30cc02bd217805adac1fc65399363f42402a0bff6902f658bd76e8bf90103bc12ab46e6bb7832d7f474c73b5d83064c561ce0c4e19c7903e5
SSDEEP 96:sC0d+DYOC49mjc0XQKgfaHtpZnm5gRDotok57VDZB6MGyvY7Cq/0bOZ5v4a:sC0wR0jhgKR3ZnzDUDx/8TCq/0bOz
TLSH
T1DCA107B1A8AD6C7784B7D404B052BB07DEB832676461AF40A6ED1F1D20FB1EC1342527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 68f353a62995fc87917d7d1eef768abe00ffab02e1d3e469100f99b6987f6488
MD5 5ba62d3fe2ddefdf87e8dd139f3e421b
SHA1 1986deda7bda2ac5b490eacb9fe2784fb6d01648
SHA512 4e6a767b24298d2e01c8dbefa41509e1bc67cf2c2f34fd0bf866fc1017e1d15a470a5a95feb8ee1cccf4b8ccf5fa9054bcbb93919c00de89eeffec199b68baf9
TLSH
T19CD02BB5DFFCCC62D54820B802518E116085B41519490040DA03FC04DD110814D03555
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 648887a89dac8888df245d8758dcd78e85ae79931c9464f19b0967fcd69c3d2f
MD5 b053e18c94ac6f6c60a9e0a281e1687b
SHA1 17ed2d8ae6844c2878132336a2fea7d044381f8b
SHA512 abf3d05979a55f573445c0c7a95529a5899c0d9f55f350b3eb35132d8502e23e6c764ffc98e92f4374754aa22e9292fd03f8e6e8113c0e919f428e797e339bfa
TLSH
T151D02BB9DFECCD62D54820B402508E116095B4156D490040D903BC04DD110814D03569
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 769a3eb5e4f91baf54eacfea3aa594d2de7b961d6407012165522c65e4984319
MD5 7905b6971cf61198bbe95dc79cdd5c3c
SHA1 acf6558e10d0cbd5dc41618b784e1aabd29124e8
SHA512 5398f7e446fdc9a685d78a63f9361275c394ac62f781a691c95472931813b62944b8ccd5e47542cfa3f5a783ea346681b06c6b115ca5235e0053866cbf9bde6c
SSDEEP 384:DNrRZyCSDnxTICYMEhIKyll7svbFKfk7:xFZJSDniwyI1l7svbF9
TLSH
T1EC44640A7B747001EDE2D9725CB080771E3CA16E8F22E6815DB654694EB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 40a19f49f412325ca0f15e4f1ba4bc9ea225620e74e936463f4f4534b44ee366
MD5 9f6fa207e7577efe2753fdf9d619436e
SHA1 5771cc5c6b50feef8866d41e8e6a17110fd4fd8b
SHA512 bcc42754afb038457de2e31e3570bc09bbd1434b9a4882d2f4191b84b8dbd193217c489808bc6deaeb59b6ecd5984277217695ee7d3f618947fd52d4a7ef0393
SSDEEP 768:vw/UxvxjgC+5j3sVPt83ieOs2ojFnUPO4Qp7cPAiSm2eo4w4cciGrTF5DAgZbCMc:vdZj3+5j3shtEgojFwQpYoimeoR4ccFe
TLSH
T14203CF75A8A4AE73DCF397843A1D6347EFF1416395C12AA4CAED2E0D42873AD5307C46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d5b47bcde7fc75221a949e5227dc656476e4ad43683483046b2f6de09ea9651f
MD5 af86c92e8b23822368986cb6f21b9d2e
SHA1 0fab2fe4a609590e99e4dc8c455a056b3ba2abe7
SHA512 422a793dd4cf5eb1280fe21e8d9e515ed3bc51f9ec34cff978c0a9f25dd731de769bb46345b073b65e547e2192fd4d95163a98b8f12a25a187eff3fcf486257b
SSDEEP 768:vw/UxvxjgC+5j3GVSi8BieOs24RjFnUPO4Qp7cPAiSm2eo4w4cciGrTFIKAgZbCl:vdZj3+5j3GgiagmjFwQpYoimeoR4ccFM
TLSH
T11B03CF75A9A8AE339CF79644365DA3C7FFF111A398C11DA4CAE91E0D028739E170BC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 0334b39864d2690a31e9a1829ce08d796fda6d767f0e7404fdafbbea8e74dd3f
MD5 950f69c886ae81441e6d373ac2ae5643
SHA1 5c7951d1c9d0df19e48dac984491e5b739a9d62b
SHA512 a3cdfb59bd4b89c96605dd1e740966e7ae7c97ad97cd499f0061ac96d80d474f0677bfdab41e6b8c91176ef5bef3f8e07eb9021bab565e97dcc41a29b440771c
SSDEEP 192:U1d66JoztdzgCl6mBM2VOv5zbo8lyjAONz:ed66Joz/zgC1Orbo8lyjZ
TLSH
T14ED13EA4F918823FC048437BCCA21B054F39345B9C4E3F1A399D6408299B2DE368E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 71504f5b7aa2bec8449217063c03c5f06d4c22566ca182d195bf88ebf31aba06
MD5 68b2f16ffeb889314e79e0bfa197b935
SHA1 b276ef67117d33848bffe4709770227f3c15ae6a
SHA512 5808c2b3d72d3d1432cb13126afa5140f771bc0eef89caa895016c80e97268f92dd7bec847900f750253a72a0576671c7f3bc22445ae332f88fc60eb005731fb
SSDEEP 192:8Ov5zbo8WgCkyj4OA1d66JoztdzgCl6mBM2z:/bo8WPkyjed66Joz/zgC1OG
TLSH
T1A4D10C64F629963FC448827BCCB60F410F36389B9C4E7F29359C64082D5729E3A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 6c3f8a773bc8dd13ec8221671fb2856c1d67ee6fc88de6d6b3e3b2ed1fafc169
MD5 cdcdfa3765296f9813dfac38d723fcf6
SHA1 5f94e4fc38294803cb7512e565deede66c5ecc08
SHA512 d84c271638790ffee64745878abbabf7c8160459e75a8253cf4ab37b042b19af95dd6b008dcdbd2f676dbe10857e9e813f24b3ca38ed6b7f79c6667648c6500a
SSDEEP 192:q1/66JoztdzgCl6mc0dROv5zbo7sgCkyj4cN:U/66Joz/zgC1jIbowPkyjn
TLSH
T1F7E1FE64E628963BC004437BDCA61F410F3A389B9C4E3F2975AD64182D572DD3B8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 46682da8bd8503fa4f5a687265c5198a1408560489f800741164e0275cfeadb9
MD5 2fb0d4a99591ac0d6d9424f695b87a1b
SHA1 1b4f370aa695f6727287dd117c9789e0a08c7e1d
SHA512 c620a67e4b0d7d436b845b96f90ccbf700e177cb91cfd1701f1c7fa795f1091cc9c6fb5dc9a0b758d4530fb31e897b61ad2bf624daa672be499132eb176b4f5d
SSDEEP 192:QOv5zbo8sgCkyj4OC1d66JoztdzgCl6mBM2z:bbo8sPkyjgd66Joz/zgC1OG
TLSH
T133E1ED64E629963FC408427BCCA60B410F36389B9C4E7F29759C64082D572DD3A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\events\events
Size 1KB
SHA256 817ab688ba25047ad556b68408ede22cf45af8a35449b8c007f33420f91ceefd
MD5 2617724905ad7f10403d52eeac727016
SHA1 aadfe2893d1247836704a162d788367d2fbe2be3
SHA512 bc5a650a83eb83ba46e1042ca64ae859a80dc7fb5db88f78a4b4ce876625ca8456ca49cfcff99911b2f9dded6b6293774181dd1265746106710ef9ef3c025e6b
TLSH
T1B8115B5C3EF94E6AD8DBE298745007CE53554E4A04571D434D52EF8CCE90ADD317A43C
MD5 SHA1 SHA512 TLSH

Submit Download

1aedfcd8-5214-4521-a1b0-c8f309fdc6de

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\pending_pings\1aedfcd8-5214-4521-a1b0-c8f309fdc6de
Size 883B
SHA256 9e387501640ca38cf14ca7bd875d3721d5a310c290558d96b965eda3edab3017
MD5 9c0974c281c02cfce809f9bebd19e007
SHA1 11f6758937851f9a3ee6ed54cec8a1a8d7072a47
SHA512 be5ff6bee926730699979328458751c8c444cdc3c953aa812cde5c1e6d1ecb0adcf270310c80e81ca4e8f370ee782763eee9896e630bbf97d5afb33c291d07ce
TLSH
T1BF112390B63275B3CD6CC24BC8A537824FB4352380C595147DB55D040DBE52E972B347
MD5 SHA1 SHA512 TLSH

Submit Download

49295af1-7796-4222-8abb-0c04c504ee34

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\pending_pings\49295af1-7796-4222-8abb-0c04c504ee34
Size 886B
SHA256 59720ae0a5bdb72805e9498eed61295ab2f9913118251ce0adae581949df3cca
MD5 bad4345e1f0897f1112239a128d71f31
SHA1 be58a0938d6b91d94a2d6ef36a708298ac6e76d8
SHA512 98a9cb5cca9f012bd6c9fd29e1309e3bbe6aa29cf5e41b917735d53e6195dcad0afbbfd706597e69c128d3fc2ef2ed2e1b0ea5c645f4e24e0d32cc87bfd14304
TLSH
T184112390A732B972CC68C28B98A577835FA4702390C66A187DA55F180DEE51EA767207
MD5 SHA1 SHA512 TLSH

Submit Download

64f06031-7e82-48e6-bf27-dca589325a04

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\pending_pings\64f06031-7e82-48e6-bf27-dca589325a04
Size 2KB
SHA256 5fa6175a7d0545e4032ab2fe6e12e21a0c6eeb5cc195442276d9925dc695fc4e
MD5 d05588021188348ef205a5e38f358b5b
SHA1 4b4259a84ea2243528599f8c9d72414c42a58fdd
SHA512 2ab13a62fd8360cae047fb05f9e28cd3362d95c4c5ee01d43fb038e6ba1f8aa092c531b5c8bdc73d2d62b95dfbfab7ec950befa032cf535a871d98f76c25a15a
TLSH
T1B941311C7AB85D379CCAF18D9482238F57A04E1300C62C436D52DE4CCDD76AE73AB52A
MD5 SHA1 SHA512 TLSH

Submit Download

88841a1a-fe6c-437d-9413-2676346d9176

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\pending_pings\88841a1a-fe6c-437d-9413-2676346d9176
Size 16KB
SHA256 524b0e48f61d4c9439740327e29121967e8f3882ed235d6636c06fc403766d16
MD5 40c2036004b67e894a51ab164efd37ed
SHA1 f1de2d1d4682cf6762c5352c4f13b92677750473
SHA512 32d4e72c2bee014c7bc0b0eb8f89b9d2d9e3b2aad2f288228c00e03441153a780c30b8b1c0c930d5a86463bbe83beaa50c2a4ff47d45010ad6acf4627b39e561
SSDEEP 192:zthE3QiH1em14uBQsb6vfM7yVsR5YbjzxcFKx1KQFf7BWdzMf7tUYKM83Dlk:zthEgiauyic07ySR5YbjlEK7Kav
TLSH
T17872DA55686059BA9291E379D4FCBFC3E5F128CB4C419FCE8BE47D082DEA06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a265fd16-3458-4b70-b0f5-b132b9fa2738

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\pending_pings\a265fd16-3458-4b70-b0f5-b132b9fa2738
Size 235B
SHA256 594793765bf46fa2a5ee80e4d96032f7c6a937c463a634bd607c4316f4cdda2c
MD5 0813371ac1e4bf2de002d91a32fe7b08
SHA1 a7659e3ac92a3bb7ee90c77d39fec3345829a87b
SHA512 4f00c6bbecb0cded849949a14e7f8f5759c42bc7524e2dcf62a7a784f1e92ed25ac58efa108846a61782615e91c92f1123547cd0788a1a916b63b1a8b40f4ca3
TLSH
T12DD097C064A8BBBD48141F03F0E028C6326C8C3324765810D6914438DABCAC852A1A16
MD5 SHA1 SHA512 TLSH

Submit Download

dca99be0-b179-4332-9d0e-52f8a60d0427

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\pending_pings\dca99be0-b179-4332-9d0e-52f8a60d0427
Size 235B
SHA256 908aec1f144f274b1738d62a90549a2e265ff22d78c13e7fc7e36bcdc2bf7199
MD5 8e852b4a0ab07fb34c6f8a9ede18bba6
SHA1 cdc5e4df9c54ffafbe7a0da57972252404e58434
SHA512 cc7db5853b2e9a5894e6bd3f1cb804097b52b3740e8cbd3852fdf64bfea252930667f048f5f8ccee8a8a49edba15e4e3c10f0f8960e8b642c1bfc118a92fc50a
TLSH
T129D097C5658CA79D88040F03B2E068C6308C8C33207468109A920574AAF99C8029581B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\prefs.js
Size 6KB
SHA256 1ec7292caeda2d50a65848819d26cf4e9ea377443ff990c2433bc69efea6305c
MD5 8687b63978cec333291238ef15d009c5
SHA1 c68e0b2414c6714aa2453dd8f41d5a93ff3ace20
SHA512 7f5eec9cfdbd55957e3a67919e53dfd9727dde34550668c4ba4e50afaf2f5e5148615fa177339e550c25ca9b85ee3abc7b47a3a2d192e807ba4797317d8ade27
SSDEEP 96:xHPUTUZqGqLfhnj1zS1SSlXdv9jPnlHDU/IBRcvBw88u8L4cnABKH:F0RLfhnjcSSDDU/SRcvBw88d
TLSH
T1B9E120789148CF7F64B677AC6C6888316AB2013B7BBF68D750B55485050CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3552-943-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-972-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-466-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-404-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-400-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-397-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-396-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-526-0x00000000749A0000-0x0000000074D24000-memory.dmp

Download

memory/3552-395-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-248-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-243-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-206-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-185-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-147-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-105-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-88-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-47-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-46-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-41-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-9-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-931-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-932-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-5-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-1-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-937-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-938-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-940-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-0-0x00000000010F0000-0x00000000010F3000-memory.dmp

Download

memory/3552-945-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-947-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-946-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-949-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-951-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-957-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-964-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-969-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-970-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-468-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-974-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-976-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-980-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-984-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-982-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-988-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-996-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-995-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-1002-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-1004-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-1009-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-1052-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-1411-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-2729-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-2680-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-2679-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-2677-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-2673-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-2666-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-2628-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/3552-2627-0x0000000003700000-0x00000000037BC000-memory.dmp

Download

memory/4672-1420-0x000001C2F89D0000-0x000001C2F89EE000-memory.dmp

Download

memory/4672-1425-0x000001C2F8A00000-0x000001C2F8A0A000-memory.dmp

Download

memory/4672-1426-0x000001C2F89C0000-0x000001C2F89EA000-memory.dmp

Download

memory/4672-1427-0x000001C2F89C0000-0x000001C2F89E4000-memory.dmp

Download

memory/4672-1424-0x000001C2F89F0000-0x000001C2F89F6000-memory.dmp

Download

memory/4672-1412-0x000001C2F87F0000-0x000001C2F8812000-memory.dmp

Download

memory/4672-1417-0x000001C2F88B0000-0x000001C2F88CE000-memory.dmp

Download

memory/4672-1418-0x000001C2F88F0000-0x000001C2F89A2000-memory.dmp

Download

memory/4672-1419-0x000001C2F88D0000-0x000001C2F88DA000-memory.dmp

Download

memory/4672-1423-0x000001C2F89C0000-0x000001C2F89C8000-memory.dmp

Download

memory/4672-1422-0x000001C2F8A10000-0x000001C2F8A2C000-memory.dmp

Download

memory/4672-1421-0x000001C2F89B0000-0x000001C2F89BA000-memory.dmp

Download

memory/5176-2618-0x0000000000FC0000-0x0000000000FC3000-memory.dmp

Download

memory/5176-2626-0x0000000003250000-0x0000000003822000-memory.dmp

Download

memory/5176-2625-0x0000000003250000-0x0000000003822000-memory.dmp

Download

memory/5176-2624-0x0000000003250000-0x0000000003822000-memory.dmp

Download

memory/5176-2620-0x0000000003250000-0x0000000003822000-memory.dmp

Download